Senior Detection & Response Engineer, Cyber Defense

About Nscale Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility. We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future. About the Role We're hiring a Senior Detection & Response Engineer in Cyber Defense to decide what Nscale detects, command incident response, and automate recurring security work across enterprise, cloud, production, data centre, and operational technology environments. You'll work with engineering, infrastructure, and service owners in a three-person regional rotation: roughly one operational week followed by two weeks focused on engineering and preparedness. In-house AI agents handle level 0 and level 1 around the clock; a managed provider covers weekends and escalates in defined circumstances. We're building follow-the-sun coverage across three regional hubs. Until every hub is staffed, the rotation includes out-of-hours on-call; the intended end state is conventional weekday hours in each region without night-time paging. This team owns detection engineering as well as response. Agents draft detection logic; you validate it and decide what goes live. Your mandate is to contain threats and fix recurring problems at their source, with success measured by the share of escalations permanently solved—not tickets closed. What you'll be doing Detection engineering - Map detection coverage against attacker tradecraft and our environments, identifying blind spots and telemetry gaps. - Turn incidents, threat research, coverage gaps, and recurring escalations into detection ideas, working with AI agents to build them. - Assess agent-proposed rule logic in shadow mode before promotion: what it catches, what it misses, and how much noise it creates. - Make the final call on production promotion and remain accountable for detection quality. You'll rarely write a query from scratch, but nothing goes live without your judgement. - Retune or retire noisy, stale, or irrelevant detections, and build the business case for closing telemetry gaps. Automation and platform engineering - Automate recurring enrichment, triage, containment, case handling, and reporting. - Improve first-tier agents so they resolve more independently and escalate with better context. - Build response actions, integrations, and agent tooling in our internal security platform, and prove they work in production. Incident command and preparedness - Command security incidents: set objectives, coordinate engineering, infrastructure, and service owners, and keep leadership informed. - Make containment decisions under time pressure, recognising what is pre-approved, what needs authority, and what could disrupt production. - Run post-incident reviews that lead to engineering improvements. - Design tabletop exercises and recovery tests, maintain practical playbooks, and automate steps that don't need a human. - Ensure the evidence, access, knowledge, and authority needed for an incident are in place beforehand. Your operational week - Assess escalations against asset and business context, decide on a response, and execute approved containment, including device isolation, session revocation, access restrictions, blocking, and evidence preservation. - Identify a lasting fix wherever warranted. Build detection and automation fixes with the agents, or specify control changes clearly for the owning team. - Close cases with a security disposition, an owner, evidence, actions taken, and required follow-up. - Hold the managed provider to our standards for evidence, analysis, routing, and closure quality. - Classify findings as risk indicators or actionable using the SSVC model, and hand over the queue at the end of your region's working day as follow-the-sun coverage is established. KPIs - Share of escalations permanently solved - First 90 days: one recurring alert class permanently resolved - First 90 days: coverage mapped for one area and at least one gap closed - First 90 days: first agent-proposed detections promoted and first platform feature shipped About You - 5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles. - Detection judgement: the ability to assess what a rule catches, what it misses, and how it will behave in production, with a focus on overall coverage. - Fluency in modern attacker tradecraft and its telemetry, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration. - Working knowledge of Windows, macOS, and Linux internals, including persistence techniques and logging. - Experience leading, or playing a central role in, a significant incident: running the bridge, setting priorities, and keeping leadership informed while maintaining the technical detail. - Experience building in and securing public cloud environments such as AWS and GCP, plus hands-on investigations across endpoint, identity, cloud, SaaS, network, or production workloads. - The ability to automate repeat work using query languages, scripting, APIs, or workflow automation. - Sound containment judgement and a calm, methodical approach when facts are incomplete or contradictory. - A willingness to challenge automated conclusions. You'll validate AI-generated analysis and detection logic rather than treating them as authoritative. - Clear investigation records, actionable escalations, audit-ready case notes, and effective collaboration with engineering, infrastructure, and service owners. Useful additional experience - Operational technology, industrial control systems, building management systems, or critical facilities. - Cloud or AI infrastructure, data centres, HPC, or other availability-sensitive environments. - Detection-as-code, detection testing, adversary emulation, or purple teaming. - Building, tuning, or evaluating AI agents or LLM-based security tooling. - Responding to ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents. - Managing monitoring or response provider quality while keeping decisions in-house. - Working in a follow-the-sun rotation. What we can offer you At Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core. - Highly competitive UK compensation package (base + bonus + equity), with performance reviews every 12 months. 🚀 - Join one of the fastest-growing AI infrastructure companies — your chance to directly shape how global AI capacity is planned and deployed. ✨ - Expect a dynamic progression plan tailored to your ambitions. Grow by leading critical cross-functional initiatives and shaping capital strategy — always with our full support. - Human-First Flexibility: We treat you as humans first. 🫶🏽 Our flexible workplace trusts Nscalers to deliver, giving you the autonomy to shape your day around life's moments. Equal Opportunities Statement We strongly encourage applications from people of colour, the LGBTQ+ community, people with disabilities, neurodivergent people, parents, carers, and people from lower socio-economic backgrounds. If there’s anything we can do to accommodate your specific situation, please let us know. The responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role. For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here. For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here. Nscale does not accept unsolicited candidate submissions from recruitment agencies.