Staff Detection & Response Engineer, Cyber Defense

About Nscale

Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.

We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.

About the Role

We're hiring a Staff Detection & Response Engineer to lead the UK Cyber Defense hub technically, command incidents, and permanently solve recurring security problems. You'll mentor engineers and work with engineering, infrastructure, service owners, and other regional Hub Leads across enterprise, cloud, production, data centre, and operational technology environments.

In-house AI agents cover level 0 and level 1 around the clock, and a managed provider covers weekends, escalating in defined circumstances with context attached. You'll hold the operational slot roughly one week in three, remain the hub's senior escalation point every week, and spend the rest of your time on detection engineering, automation, and preparedness. Agents draft detection logic; you assess, tune, and decide what goes live. We classify cases as risk indicator or actionable using the SSVC model.

Success means making the queue smaller through lasting detection, automation, and control improvements. We're building follow-the-sun coverage across three regional hubs, with handovers at the end of each region's working day. Until every hub is staffed, the rotation includes out-of-hours on-call; the intended end state is conventional weekday hours in each region.

What you'll be doing

• Lead the UK hub technically
• Set the standard for investigation quality, detection judgement, and case hygiene through hands-on work, review, and mentoring.
• Pair with engineers on difficult escalations, review their investigations and detections, and help them develop into incident commanders.
• Keep cross-region handovers clear, work with other Hub Leads on consistent technical practice, and tell the team's manager where the hub needs support.
• Take part in interviews and help onboard new engineers.
• Command incidents
• Set incident objectives, coordinate responders across engineering, infrastructure, and service owners, and keep leadership informed.
• Make containment decisions under time pressure, understanding your authority and the potential impact on production.
• Coach other incident commanders and step in when an incident needs more senior support.
• Run post-incident reviews that result in engineering improvements, and follow through on delivery.
• Build detection coverage and automation
• Map coverage against attacker tradecraft and our estate, prioritise blind spots, and turn incidents, research, and recurring escalations into detection ideas.
• Assess agent-proposed rules in shadow mode: judge what they catch, what they miss, and how much noise they create before approving promotion. Review teammates' decisions and retire or retune stale detections.
• Identify telemetry gaps and build the business case to close them, including in operational technology and building management systems where we currently lack visibility.
• Automate enrichment, triage, containment, case handling, and reporting. Improve first-tier agents so they resolve more independently and escalate with better context.
• Ship and validate response actions, integrations, and agent tooling in our internal security platform.
• Prepare and operate
• Design and run tabletop exercises and recovery tests, including with leadership and other teams. Keep playbooks current and automate steps that do not need human judgement.
• Ensure responders have the evidence, access, knowledge, and authority they need before an incident happens.
• During your operational week, scope escalations against asset and business context and execute approved containment, including device isolation, session revocation, access restrictions, blocking, and evidence preservation.
• Close cases with a security disposition, owner, evidence, actions taken, and follow-up. Build a detection or automation where warranted, or give the owning team a clear control-change specification.
• Hold the managed provider to our standards for evidence, analysis, routing, and closure quality.

KPIs

• Share of escalations permanently solved
• First recurring alert class permanently retired within 90 days
• At least one priority detection coverage gap closed within 90 days
• First internal security platform feature delivered within 90 days

About You

8+ years of relevant experience in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles, including time as a senior or lead engineer.

Technical leadership and incident command. You've mentored engineers, raised standards through review and example, and repeatedly led significant incidents while keeping responders and leadership aligned.

Detection judgement. You can explain what a rule catches, what it misses, and how it will behave in production. You understand attacker tradecraft—from credential theft and session abuse through persistence, lateral movement, command and control, and exfiltration—and how it appears in telemetry.

Systems and cloud depth. You have deep knowledge of Windows, macOS, and Linux internals, persistence mechanisms, and logging, plus experience building in and securing public cloud environments such as AWS and GCP.

Hands-on investigation and automation. You bring deep investigation experience across endpoint, identity, cloud, SaaS, network, or production workloads, and use query languages, scripting, APIs, or workflow automation to remove repetitive work.

Sound judgement under pressure. You make considered containment decisions when facts are incomplete, remain calm, and help others do the same.

Critical assessment of AI output. You validate agent analysis and detection logic, challenge incorrect conclusions, and teach others to do the same.

Clear communication and influence. You write investigations another engineer can follow and escalations a leader can act on. You can coordinate engineering, infrastructure, and service owners across regions without relying on reporting lines.

Strong pluses

Technical leadership of a regional or site-based security team, or experience building a follow-the-sun rotation.

Operational technology, industrial control systems, building management systems, or critical facilities experience.

Work in cloud or AI infrastructure, data centres, HPC, or other availability-sensitive environments.

Detection-as-code, detection testing, adversary emulation, or purple teaming.

Building, tuning, or evaluating AI agents or LLM-based security tooling.

Response experience involving ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents.

Experience holding a managed monitoring or response provider to clear standards while keeping decisions in-house.

What we can offer you

• At Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core.
• Highly competitive UK compensation package (base + bonus + equity), with performance reviews every 12 months. 🚀
• Join one of the fastest-growing AI infrastructure companies — your chance to directly shape how global AI capacity is planned and deployed. ✨
• Expect a dynamic progression plan tailored to your ambitions. Grow by leading the UK hub technically, helping build a global security function as it scales, and taking on critical cross-functional work — always with our full support.
• Human-First Flexibility: We treat you as humans first. 🫶🏽 Our flexible workplace trusts Nscalers to deliver, giving you the autonomy to shape your day around life's moments.

Equal Opportunities Statement

We strongly encourage applications from people of colour, the LGBTQ+ community, people with disabilities, neurodivergent people, parents, carers, and people from lower socio-economic backgrounds.

If there’s anything we can do to accommodate your specific situation, please let us know.

The responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role.

For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here.

For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here.

Nscale does not accept unsolicited candidate submissions from recruitment agencies.