Senior Detection & Response Engineer, Cyber Defense

nscaleoperationsukltd; United States; Hybrid; USD 160,000 - 190,000; Full time

Benefits offered by this job

Bonus potential

Equity

Job summary

nscaleoperationsukltd seeks a senior security engineer to join the Cyber Defense team. The role blends detection engineering with hands-on incident response across enterprise, cloud, data centre, and operational technology environments, with a three-person regional rotation.

The engineer leads containment during major incidents, tunes AI-proposed detection logic, and builds automation to reduce manual work, while ensuring final judgement on what ships.

Qualifications

• Several years of experience in security operations, detection engineering, or incident response across hybrid enterprise environments.

Responsibilities

• Map current detection coverage against attacker tradecraft and identify blind spots, then turn those gaps into clear detection ideas.
• Review and tune the detection logic and rules that AI agents propose, validating shadow rules before promotion to live production.
• Command the response during serious incidents, making fast containment decisions and acting as the lead until resolution.
• Build automation that removes human time from the response path, retiring or retuning noisy detections as needed.
• Triage escalations using a two-class risk indicator / actionable model (SSVC), splitting each into immediate act and permanent solve.

Skills

Security operations

Detection engineering

Incident response

On-call rotation

Job description

Role overview

A senior-level position on a Cyber Defense team that combines detection engineering with hands-on incident response across enterprise, cloud, production, data centre, and operational technology environments. The function is structured around a three-person regional rotation: roughly one week in three, the engineer holds the operational slot handling escalations, while the remaining two weeks focus on engineering work such as closing detection gaps, building automation, and preparing for the next incident. The team uses AI agents to draft detection logic, with the human engineer owning the final judgement call on what ships.

Responsibilities

• Map current detection coverage against attacker tradecraft and identify blind spots, then turn those gaps into clear detection ideas.
• Review and tune the detection logic and rules that AI agents propose, validating shadow rules before promotion to live production.
• Command the response during serious incidents, making fast containment decisions and acting as the lead until resolution.
• Build automation that removes human time from the response path, retiring or retuning noisy detections as needed.
• Triage escalations using a two-class risk indicator / actionable model (SSVC), splitting each into immediate act and permanent solve.

Requirements

• Several years of experience in security operations, detection engineering, or incident response across hybrid enterprise environments.
• Track record of permanently solving recurring alert classes rather than just closing tickets.
• Comfort owning a major incident live, not just contributing to post-incident review.
• Ability to assess, tune, and judge detection rule logic, including shadow-rule performance trade-offs.
• Willingness to participate in an operational on-call rotation, including out-of-hours coverage until follow-the-sun hubs are fully staffed.

Nice to have

• Prior experience with SSVC or other simplified severity frameworks.
• Familiarity with AI-assisted detection drafting and human-in-the-loop validation workflows.

Benefits and work setup

• Base compensation reported in the $160,000-$190,000 USD range, with potential bonus and equity components.
• Performance reviews on a 12-month cadence and a personalised progression plan.
• Flexible working arrangements designed around employee autonomy and life outside work.