About the Company

Nebius is at the forefront of cloud infrastructure for the global AI economy, developing a full-stack AI cloud platform that simplifies the deployment of AI/ML solutions for developers and enterprises. Headquartered in Amsterdam and listed on Nasdaq (NBIS), we have a diverse team of over 1,500 engineers across multiple global R&D hubs.

The Team

The Detection and Response team focuses on enhancing Nebius's security monitoring capabilities and managing an end-to-end Security Incident Response program, encompassing people, processes, and tools.

The Role

We are seeking a Lead Detection Engineering & Response professional to establish and oversee our D&R capabilities. You will manage detection engineering, threat intelligence, and incident response functions while leading a growing team of analysts and engineers. This role involves handling complex security incidents, forensics, and shaping the D&R strategy.

Responsibilities

• Lead detection development to maintain low false-positive and false-negative rates.
• Collaborate with alert consumers (20+ teams) to ensure effective threat response.
• Architect and manage detection coverage across cloud and bare-metal environments.
• Enhance internal D&R tools and pipelines, onboarding new logs and automating response runbooks.
• Integrate threat intelligence into detection logic and incident response playbooks.
• Oversee end-to-end incident response, including scoping, containment, and post-incident reviews.
• Partner with Compliance and Engineering teams to balance threat detection with regulatory needs.
• Define and report on D&R metrics such as MTTD, MTTR, and detection coverage.
• Build and maintain a comprehensive Security Incident Response program.

Requirements

• 6+ years in security operations, detection engineering, or incident response, with 1-2 years in a leadership role.
• Extensive experience with cloud-native environments (Kubernetes, Linux, container-based).
• Proficient in detection engineering, including writing and tuning rules in SIEM platforms (e.g., Chronicle, Splunk, Elastic) and SQL.
• Experience with SOAR workflows and automating responses, preferably using Golang and Temporal.
• Familiarity with threat intelligence frameworks (MITRE ATT&CK, Kill Chain) and operationalizing them in detections.
• Strong fundamentals in incident response, including memory forensics and log analysis.
• Excellent stakeholder management skills, coordinating across various teams during incidents.

Nice to Have

• Experience with AI/ML and GPU cluster-related threats.
• Knowledge of eBPF-based detection or runtime security tools (Falco, Tetragon).
• Background in threat hunting.

What We Offer

• Competitive compensation with equity opportunities.
• Career growth and learning opportunities in a flexible, remote-first culture.
• Collaborative and innovative work environment with impactful AI projects.

If you are ready to shape the future of AI security at Nebius, we encourage you to apply and be part of our dynamic team.