Lead, Detection & Incident Response — Cloud Security

Nebius Group; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Competitive compensation

Equity upside

Remote-first

Career growth

Job summary

Nebius is seeking a Detection Engineering & Response Lead to build and run the D&R capability for Nebius Cloud. You will own detection engineering, threat intelligence, and incident response, leading a small team of analysts and engineers to drive robust security operations across cloud and bare-metal environments.

The role requires hands-on experience with cloud-native setups, SIEM rule development, and SOAR automation.

Qualifications

• 6+ years in security operations, detection engineering, or incident response.
• Hands-on experience with cloud-native environments (Kubernetes, Linux workloads).
• Strong detection engineering skills: writing and tuning rules/detections in SIEM Platforms (Chronicle, Splunk, Elastic) and SQL.
• Experience building or operating SOAR workflows and automating response at scale (Golang and Temporal).
• Working knowledge of threat intelligence frameworks (MITRE ATT&CK, Pyramid of Pain, Kill Chain).
• Solid IR fundamentals: memory forensics, log analysis, network traffic analysis, and post-incident reporting.

Responsibilities

• Lead detection development and maintain low false-positive/false-negative rates.
• Collaborate with 20+ teams to reduce noise while preserving signals for threat detection.
• Architect and operate detection coverage across cloud and bare-metal environments.
• Build and extend D&R tools and pipelines; onboard logs and automate response runbooks.
• Integrate threat intelligence into detection logic and IR playbooks.
• Lead end-to-end incident response: scoping, containment, root cause analysis, post-incident reviews.

Skills

Security operations

Detection engineering

Incident response

Kubernetes

Linux workloads

SOAR workflows

Threat intelligence

Post-incident reporting

Stakeholder management

Golang

Tools

SIEM (Chronicle/Splunk/Elastic)

SQL

Golang

Temporal

Falco

Tetragon

SOAR

Job description

Nebius is seeking a Detection Engineering & Response Lead to build and run the D&R capability for Nebius Cloud. You will own detection engineering, threat intelligence, and incident response, leading a small team of analysts and engineers to drive robust security operations across cloud and bare-metal environments.

The role requires hands-on experience with cloud-native setups, SIEM rule development, and SOAR automation.