Senior Detection & Response Engineer, Cyber Defense

nscaleoperationsukltd; United Kingdom; On-site; GBP 90,000 - 130,000; Full time

Job summary

Nscale is hiring a Senior Detection & Response Engineer to define what we detect, direct incident response, and automate recurring security work across enterprise, cloud, data centre and OT environments.

You’ll work in a three-person regional rotation with on-call coverage, collaborating with engineering and service owners. You’ll validate detection logic, make production-ready decisions, and drive containment and remediation to reduce escalations while strengthening security across global hubs.

Qualifications

• 5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles.
• Detection judgement: assess rule efficacy, misses, and production impact.
• Fluency in English.

Responsibilities

• Map detection coverage against attacker tradecraft and environments.
• Turn incidents, threat research, and gaps into detection ideas with AI agents.
• Assess agent-proposed rule logic in shadow mode before promotion to production.
• Retune or retire noisy detections and build a business case for telemetry gaps.
• Automate recurring enrichment, triage, containment, case handling, and reporting.

Skills

Detection engineering

Incident response

Threat hunting

Security operations

Security engineering

Job description

About Nscale

Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.

We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you'll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you'll be contributing to building the technology that powers the future.

About the Role

We're hiring a Senior Detection & Response Engineer in Cyber Defense to decide what Nscale detects, command incident response, and automate recurring security work across enterprise, cloud, production, data centre, and operational technology environments.

You’ll work with engineering, infrastructure, and service owners in a three-person regional rotation: roughly one operational week followed by two weeks focused on engineering and preparedness. In-house AI agents handle level 0 and level 1 around the clock; a managed provider covers weekends and escalates in defined circumstances. We’re building follow-the-sun coverage across three regional hubs. Until every hub is staffed, the rotation includes out-of-hours on-call; the intended end state is conventional weekday hours in each region without night-time paging.

This team owns detection engineering as well as response. Agents draft detection logic; you validate it and decide what goes live. Your mandate is to contain threats and fix recurring problems at their source, with success measured by the share of escalations permanently solved-not tickets closed.

What you'll be doing

Detection engineering

• Map detection coverage against attacker tradecraft and our environments, identifying blind spots and telemetry gaps.
• Turn incidents, threat research, coverage gaps, and recurring escalations into detection ideas, working with AI agents to build them.
• Assess agent-proposed rule logic in shadow mode before promotion: what it catches, what it misses, and how much noise it creates.
• Make the final call on production promotion and remain accountable for detection quality. You’ll rarely write a query from scratch, but nothing goes live without your judgement.
• Retune or retire noisy, stale, or irrelevant detections, and build the business case for closing telemetry gaps.

Automation and platform engineering

• Automate recurring enrichment, triage, containment, case handling, and reporting.
• Improve first-tier agents so they resolve more independently and elevate with better context.
• Build response actions, integrations, and agent tooling in our internal security platform, and prove they work in production.

Incident command and preparedness

• Command security incidents: set objectives, coordinate engineering, infrastructure, and service owners, and keep leadership informed.
• Make containment decisions under time pressure, recognising what is pre-approved, what needs authority, and what could disrupt production.
• Run post-incident reviews that lead to engineering improvements.
• Design tabletop exercises and recovery tests, maintain practical playbooks, and automate steps that don't need a human.
• Ensure the evidence, access, knowledge, and authority needed for an incident are in place beforehand.

Your operational week

• Assess escalations against asset and business context, decide on a response, and execute approved containment, including device isolation, session revocation, access restrictions, blocking, and evidence preservation.
• Identify a lasting fix wherever warranted. Build detection and automation fixes with the agents, or specify control changes clearly for the owning team.
• Close cases with a security disposition, an owner, evidence, actions taken, and required follow-up.
• Hold the managed provider to our standards for evidence, analysis, routing, and closure quality.
• Classify findings as risk indicators or actionable using the SSVC model, and hand over the queue at the end of your region's working day as follow-the-sun coverage is established.

KPIs

• Share of escalations permanently solved
• First 90 days: one recurring alert class permanently resolved
• First 90 days: coverage mapped for one area and at least one gap closed
• First 90 days: first agent-proposed detections promoted and first platform feature shipped

About You

• 5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles.
• Detection judgement: the ability to assess what a rule catches, what it misses, and how it will behave in production, with a focus on overall coverage.
• Fluency