Senior Detection & Response Engineer, Cyber Defense

About Nscale Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility. We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.

About the Role

We are hiring Detection & Response Engineers to decide what we detect, command the response when something is real, and automate everything in between, across enterprise, cloud, production, data centre, and operational technology environments. You will work in a three-person regional rotation. Roughly one week in three, you hold the operational slot: taking escalations, deciding fast, and acting. The other two weeks are engineering. You find where our detection coverage is thin and work with our AI agents to close it, build automation that removes human time from the response path, and make sure we are ready for the next incident. When a serious incident lands, you command it. If you have spent years closing the same ticket every Tuesday—and knowing exactly how to fix it for good, but never having the mandate—this is the job where that is the mandate.

What you'll be doing

Detection engineering Map our detection coverage against attacker tradecraft and the real estate, and find where we are blind. Turn coverage gaps, incidents, threat research, and recurring escalations into clear detection ideas, and work with our AI agents to build them. Assess and tune the detection ideas and rule logic our agents propose, which run as shadow rules before they go live. Judge what each one catches, what it misses, and what its noise will cost. Make the human call on promotion. You will rarely write a query from scratch, but nothing goes live without your judgement, and you are accountable for whether it is right. Retire or retune live detections that are noisy, stale, or no longer relevant. Identify telemetry gaps and make the business case for closing them. Automation Remove recurring toil from the response path: enrichment, triage, containment actions, case handling, and reporting. Improve the agents that hold the first tier, so they resolve more on their own and escalate with better context. Every gain here cuts the human time per alert and lets us cover more attack surface. Ship new capabilities in our internal security platform, such as response actions, integrations, and agent tooling, so every engineer and agent on the team gets faster, and prove each one works in production. Incident command Command security incidents: set objectives, coordinate responders across engineering, infrastructure, and service owners, and keep leadership informed. Make containment calls under time pressure, knowing what you can do immediately, what requires authority, and what could disrupt production if handled incorrectly. Run post-incident reviews that end in engineering work, not just a document. Incident preparedness Design and run tabletop exercises and recovery tests. Keep playbooks and runbooks honest, and turn the steps that do not need a human into automation. Make sure the evidence, access, knowledge, and authority we need in an incident are in place before we need them. Your operational week Take escalations from the agents and the managed provider, scope them against real asset and business context, decide, and act. Execute approved containment, including isolating devices, revoking sessions, restricting access, blocking activity, and preserving evidence. Ensure every escalation exits with a solve where one is warranted. Where the solve is a detection or automation, you build it with the agents. Where it is a control change, specify it clearly enough that the owning team can act without a second conversation. Close every case with a security disposition, an owner, the evidence, actions taken, and any required follow-up. Hold the managed provider to our standard for evidence, analysis, routing, and closure quality.

First 90 days Learn the incident command, escalation, evidence, and handover model, and take a rotation slot. Independently own escalations across common classes, with defensible dispositions and evidence that stands up. Ship your first solve: a detection, automation, or control change that permanently retires a recurring alert class. Map coverage for one area of the estate, name its top gaps, and work with the agents to close at least one. Assess, tune, and promote your first agent-proposed detections to live. Add your first feature to the internal security platform. Shadow the incident commander on a real incident or exercise. Name one telemetry gap with a business case behind it. Extra credit if it is in operational technology or building management systems, both of which we currently cannot see.

About You 5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles. Detection judgement. You can read a rule and say what it catches, what it misses, and how noisy it will be in production. You think in coverage, not in individual alerts. Fluency in modern attacker tradecraft, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration, and in how each shows up in telemetry. Working knowledge of Windows, macOS, and Linux internals, including where attackers per