N
Senior Detection & Response Engineer, Cyber Defense
Contract type
Ongoing
Work mode
Remote
Experience
Senior · 5+ years
Job description
Detection & Response Engineer at Nscale responsible for detection engineering, automation, and incident command across enterprise, cloud, production, data centre, and operational technology environments. The role operates in a three-person regional rotation, with roughly one week in three on operational escalation duty and the rest on engineering.
At a glance
- Work mode
- Remote
What you'll do
- Map detection coverage against attacker tradecraft and the estate, and find where we are blind
- Turn coverage gaps, incidents, threat research, and recurring escalations into clear detection ideas, and work with AI agents to build them
- Assess and tune detection ideas and rule logic proposed by agents, which run as shadow rules before going live
- Make the human call on promotion of detections to live
- Retire or retune live detections that are noisy, stale, or no longer relevant
- Identify telemetry gaps and make the business case for closing them
- Remove recurring toil from the response path: enrichment, triage, containment actions, case handling, and reporting
- Improve the agents that hold the first tier so they resolve more on their own and escalate with better context
- Ship new capabilities in the internal security platform, such as response actions, integrations, and agent tooling
- Command security incidents: set objectives, coordinate responders across engineering, infrastructure, and service owners, and keep leadership informed
- Make containment calls under time pressure
- Run post-incident reviews that end in engineering work
- Design and run tabletop exercises and recovery tests
- Keep playbooks and runbooks honest and turn steps that do not need a human into automation
- Take escalations from the agents and the managed provider, scope them against real asset and business context, decide, and act
- Execute approved containment, including isolating devices, revoking sessions, restricting access, blocking activity, and preserving evidence
- Close every case with a security disposition, an owner, the evidence, actions taken, and any required follow-up
- Hold the managed provider to our standard for evidence, analysis, routing, and closure quality
What we're looking for
- 5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles
- Detection judgement: can read a rule and say what it catches, what it misses, and how noisy it will be in production; thinks in coverage, not individual alerts
- Working knowledge of Windows, macOS, and Linux internals, including where attackers persist on each and what each one logs
- Incident command experience: has led, or been central to, a significant incident, running the bridge, setting priorities, and keeping leadership informed
- Experience building in, and securing, public cloud environments like AWS and GCP
- Automates what they repeat, using query languages, scripting, APIs, or workflow automation
- Hands-on investigation experience across endpoint, identity, cloud, SaaS, network, or production workloads
- Sound judgement on containment under time pressure
- Willingness to challenge automated conclusions and validate AI agent analysis and detection logic
- Writes investigations another engineer can follow, escalations a leader can act on in thirty seconds, and case notes that make sense years later in an audit
- Calm and methodical when facts are incomplete or contradict each other
- Ability to work effectively with engineering, infrastructure, and service owners who do not report to you
Nice to have
- Operational technology, industrial control systems, building management systems, or critical facilities experience
- Cloud infrastructure, AI infrastructure, data centres, HPC, or other availability-sensitive environments
- Detection-as-code, detection testing, adversary emulation, or purple teaming
- Building, tuning, or evaluating AI agents or LLM-based security tooling
- Response experience involving ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents
- Experience holding a managed monitoring or response provider to a standard while keeping decisions in-house
- Experience working as part of a Follow-the-sun rotation
Benefits
- Collaborative, supportive, and innovative environment
- Highly competitive UK
Apply
About Nscale
The GPU cloud engineered for AI
Nscale provides cost-effective, high-performance GPU cloud infrastructure for AI start-ups and large enterprise customers, reducing the complexity of AI development.
Key facts
- GPU cloud / AI infrastructure
- Provides GPU cloud infrastructure for AI
- Serves AI start-ups and large enterprise customers
- Culture of relentless innovation, ownership, and accountability
What they value
- Relentless innovation
- Ownership
- Accountability
- Openness and transparency
- Excellence and urgency