Senior Detection & Response Engineer, Cyber Defense

About Nscale

Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.

We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.

About the Role

We are hiring Detection & Response Engineers to decide what we detect, command the response when something is real, and automate everything in between, across enterprise, cloud, production, data centre, and operational technology environments.

You will work in a three-person regional rotation. Roughly one week in three, you hold the operational slot: taking escalations, deciding fast, and acting. The other two weeks are engineering. You find where our detection coverage is thin and work with our AI agents to close it, build automation that removes human time from the response path, and make sure we are ready for the next incident. When a serious incident lands, you command it.

If you have spent years closing the same ticket every Tuesday—and knowing exactly how to fix it for good, but never having the mandate—this is the job where that is the mandate.

What you'll be doing

Detection engineering

Map our detection coverage against attacker tradecraft and the real estate, and find where we are blind.

Turn coverage gaps, incidents, threat research, and recurring escalations into clear detection ideas, and work with our AI agents to build them.

Assess and tune the detection ideas and rule logic our agents propose, which run as shadow rules before they go live. Judge what each one catches, what it misses, and what its noise will cost.

Make the human call on promotion. You will rarely write a query from scratch, but nothing goes live without your judgement, and you are accountable for whether it is right.

Retire or retune live detections that are noisy, stale, or no longer relevant.

Identify telemetry gaps and make the business case for closing them.

Automation

Remove recurring toil from the response path: enrichment, triage, containment actions, case handling, and reporting.

Improve the agents that hold the first tier, so they resolve more on their own and escalate with better context. Every gain here cuts the human time per alert and lets us cover more attack surface.

Ship new capabilities in our internal security platform, such as response actions, integrations, and agent tooling, so every engineer and agent on the team gets faster, and prove each one works in production.

Incident command

Command security incidents: set objectives, coordinate responders across engineering, infrastructure, and service owners, and keep leadership informed.

Make containment calls under time pressure, knowing what you can do immediately, what requires authority, and what could disrupt production if handled incorrectly.

Run post-incident reviews that end in engineering work, not just a document.

Incident preparedness

Design and run tabletop exercises and recovery tests.

Keep playbooks and runbooks honest, and turn the steps that do not need a human into automation.

Make sure the evidence, access, knowledge, and authority we need in an incident are in place before we need them.

Your operational week

Take escalations from the agents and the managed provider, scope them against real asset and business context, decide, and act.

Execute approved containment, including isolating devices, revoking sessions, restricting access, blocking activity, and preserving evidence.

Ensure every escalation exits with a solve where one is warranted. Where the solve is a detection or automation, you build it with the agents. Where it is a control change, specify it clearly enough that the owning team can act without a second conversation.

Close every case with a security disposition, an owner, the evidence, actions taken, and any required follow-up.

Hold the managed provider to our standard for evidence, analysis, routing, and closure quality.

First 90 days

Learn the incident command, escalation, evidence, and handover model, and take a rotation slot.

Independently own escalations across common classes, with defensible dispositions and evidence that stands up.

Ship your first solve: a detection, automation, or control change that permanently retires a recurring alert class.

Map coverage for one area of the estate, name its top gaps, and work with the agents to close at least one.

Assess, tune, and promote your first agent-proposed detections to live.

Add your first feature to the internal security platform.

Shadow the incident commander on a real incident or exercise.

Name one telemetry gap with a business case behind it. Extra credit if it is in operational technology or building management systems, both of which we currently cannot see.

About You

5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles.

Detection judgement. You can read a rule and say what it catches, what it misses, and how noisy it will be in production. You think in coverage, not in individual alerts.

Fluency in modern attacker tradecraft, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration, and in how each shows up in telemetry.

Working knowledge of Windows, macOS, and Linux internals, including where attackers persist on each and what each one logs.

Incident command experience. You have led, or been central to, a significant incident: running the bridge, setting priorities, and keeping leadership informed without losing the technical thread.

Experience building in, and securing, public cloud environments like AWS and GCP

You automate what you repeat, using query languages, scripting, APIs, or workflow automation. When you hit the same problem a third time, your instinct is to build—not add another step to a runbook.

Hands-on investigation experience across endpoint, identity, cloud, SaaS, network, or production workloads.

Sound judgement on containment under time pressure.

Willingness to challenge automated conclusions. You will work alongside AI agents every day, and their analysis and detection logic are inputs, not authorities. We expect you to validate them and notice when they are confidently wrong.

You write investigations another engineer can follow, escalations a leader can act on in thirty seconds, and case notes that still make sense to someone reading them two years later in an audit.

Calm and methodical when facts are incomplete or contradict each other.

Ability to work effectively with engineering, infrastructure, and service owners who do not report to you.

Strong pluses

Operational technology, industrial control systems, building management systems, or critical facilities experience.

Cloud infrastructure, AI infrastructure, data centres, HPC, or other availability-sensitive environments.

Detection-as-code, detection testing, adversary emulation, or purple teaming.

Building, tuning, or evaluating AI agents or LLM-based security tooling.

Response experience involving ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents.

Experience holding a managed monitoring or response provi