Detection & Response Lead
Core
Building and running detection engineering, threat intelligence, and incident response functions for Nebius Cloud to improve security monitoring and maintain an end-to-end Security Incident Response program.
Role type
Lead engineering role (Detection & Response Lead)
Builds
Internal D&R tools, pipelines, runbooks, and an end-to-end Security Incident Response program
Domain
Cloud security, threat intelligence, incident response
Required skills
detection engineering, threat intelligence, incident response, cloud-native environments (Kubernetes, Linux, containers), SIEM platforms (Chronicle, Splunk, Elastic), SQL, SOAR workflows, Golang, Temporal, threat frameworks (MITRE ATT&CK), memory forensics, log analysis, network traffic analysis
Preferred skills
AI/ML and GPU clusters threat experience, eBPF-based detection, runtime security tooling (Falco, Tetragon), threat hunting
Technologies
Kubernetes, Linux, containers, Chronicle, Splunk, Elastic, SQL, Golang, Temporal, MITRE ATT&CK, Falco, Tetragon
Responsibilities
Lead detection development and tune rules to maintain low false-positive/negative rates; Architect and operate detection coverage across cloud and bare-metal environments; Build and extend internal D&R tools and pipelines; Integrate threat intelligence into detection logic and IR playbooks; Lead incident response end-to-end including scoping, containment, root cause analysis, and post-incident reviews; Define and report on D&R metrics (MTTD, MTTR, coverage, false positive rates); Build and maintain Security Incident Response program (people, processes, tools); Partner with Compliance and Engineering teams; Coordinate across engineers, compliance, legal, and executives during active incidents.
Seniority
Senior, hands-on IC with team leadership
