Senior Detection & Response Engineer (Cyber Defense)

Location: UK; London listed as another location

Company

Nscale provides GPU cloud infrastructure engineered for AI start-ups and large enterprise customers.

What you will do

• Map detection coverage, identify telemetry gaps, and turn incidents, threat research, and recurring escalations into production detections.
• Validate AI-agent detection logic in shadow mode, make promotion decisions, and retune or retire noisy and stale detections.
• Automate enrichment, triage, containment, case handling, reporting, and security-platform integrations.
• Command security incidents, coordinate engineering and infrastructure owners, make containment decisions, and keep leadership informed.
• Run post-incident reviews, tabletop exercises, recovery tests, and maintain practical response playbooks.
• Assess escalations, execute approved containment, preserve evidence, document case outcomes, and drive lasting fixes.

Requirements

• 5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles.
• Ability to assess detection coverage, rule behavior, false positives, missed activity, and production impact.
• Fluency in attacker tradecraft and telemetry covering credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration.
• Working knowledge of Windows, macOS, and Linux internals, including persistence techniques and logging.
• Experience leading or centrally supporting a significant incident, including bridge management, prioritization, and leadership communication.
• Experience building in and securing public cloud environments such as AWS and GCP, with hands-on investigations across endpoint, identity, cloud, SaaS, network, or production workloads.
• Ability to automate repeat work using query languages, scripting, APIs, or workflow automation.
• Sound containment judgement, a calm methodical approach, willingness to challenge automated conclusions, and ability to produce clear investigation records and audit-ready case notes.
• Effective collaboration with engineering, infrastructure, and service owners.

Nice to have

• Experience with operational technology, industrial control systems, building management systems, or critical facilities.
• Experience with cloud or AI infrastructure, data centres, HPC, or availability-sensitive environments.
• Detection-as-code, detection testing, adversary emulation, or purple teaming experience.
• Experience building, tuning, or evaluating AI agents or LLM-based security tooling.
• Experience responding to ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents.
• Experience managing monitoring or response provider quality, or working in a follow-the-sun rotation.

Culture & Benefits

• Collaborative, supportive, innovative environment focused on ownership, accountability, openness, transparency, and urgency.
• Three-person regional rotation with roughly one operational week followed by two engineering and preparedness weeks.
• Out-of-hours on-call is required until all regional hubs are staffed; the intended end state is weekday regional coverage without night-time paging.
• Flexible workplace with autonomy to shape the working day.
• UK compensation package includes base pay, bonus, and equity, with performance reviews every 12 months.
• Progression through critical cross-functional initiatives and professional development support.

Hiring process

• Nscale does not accept unsolicited candidate submissions from recruitment agencies.
• Reasonable accommodations are available for candidates who need them.