{"id":3140979,"url":"https://alion.io/job/nebius-dfir-expert","title":"DFIR Expert","company":{"id":6364,"name":"Nebius","domain":"nebius.com","url":"https://alion.io/company/nebius","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":84,"open_postings":111,"ghost_share":0,"stale_share":0.622,"repost_share":0,"time_to_fill_p50_days":56,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Frontend","role_family":"Frontend","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Israel"],"countries":["IL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"EnCase","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"Velociraptor","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"X-Ways Forensics","optional":false}],"status":"live","first_seen_at":"2026-10-23T07:17:26Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-23T18:04:20Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Nebius:\nNebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.\nBuilt by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.\nListed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.\nThe role\nNebius is seeking a deeply technical DFIR Expert for its Digital Forensics and Incident Response (DFIR) team, working alongside the Security Operations Center (SOC). This role is a senior hands-on responder position, executing containment, eradication, and recovery on declared incidents and conducting the forensic investigations behind them, upholding the standards the DFIR team operates by.\nThis role reports to the DFIR Lead, under the Detection and Response function within the CISO Office.\nYour responsibilities will include: \nExecute the technical response to major incidents from escalation through to recovery, in partnership with and under the direction of the DFIR Lead.\nConduct end-to-end forensic investigations across cloud, platform, and endpoint environments.\nHandle evidence to a standard that meets legal, regulatory, and forensic requirements, including chain- of-custody discipline.\nReceive incident handoffs from the SOC and lead the response while the SOC continues to support the investigation.\nProduce post-incident deliverables: technical reports, root cause analyses (RCA), and regulatory-ready documentation.\nContribute to DFIR runbooks, tooling selection and maturation, and readiness exercises (tabletops and simulations).\nDrive lessons-learned into measurable improvements in controls, detection fidelity, and response readiness together with the SOC, Security Engineering, and Threat Intelligence teams.\nRaise the wider team's forensic capability through case walkthroughs and mentoring of SOC analysts, and participate in the DFIR on-call rotation, acting as the response point of contact outside business hours.\nWe expect you to have: \nExperience\nAround 5 years of hands-on digital forensics and incident response (DFIR) experience, including significant technical roles in large-scale, high-impact incidents (ransomware, advanced threat actors, cloud intrusions, identity compromise).\nExperience responding to incidents in cloud or infrastructure-heavy environments.\nTechnical Expertise\nDeep knowledge of Windows and Linux internals, with proven disk and memory forensics capability.\nCloud and container forensics: acquiring and analyzing evidence from cloud control planes, Kubernetes workloads, and identity systems.\nFluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices.\nHands-on experience with EDR, SIEM, and forensic tooling such as Velociraptor, Volatility, and X-Ways or EnCase.\nStrong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions.\nMalware triage capability sufficient to characterize behavior, extract indicators, and inform containment decisions.\nCertifications such as GCFE, GCFA, GNFA, GCFR, or GREM are an advantage.\nLeadership & Communication\nComposed and decisive under incident pressure, with the ability to take clear response actions.\nRigorous about evidence and intellectually honest: findings are validated and assumptions are labeled.\nClear, concise communicator, able to brief technical peers and the DFIR Lead as readily as Legal, Privacy, and executive stakeholders.\nA genuine partner to the SOC, sharing context freely and respecting the investigation that came before the handoff.\nFluent in English, written and verbal, comfortable working with international teams and stakeholders.\nBenefits & Perks:\nCompetitive compensation\nCareer growth and learning opportunities\nFlexibility and ownership\nCollaborative and innovative culture\nOpportunity to work on impactful AI projects\nInternational environment and talented teams\nWhat's it like to work at Nebius:\nFast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI \nEqual Opportunity Statement:\nNebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law.\nApplicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. \nIf you need accommodations during the application process, please let us know.","description_format":"text","description_chars":5315,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Data Centers & Colocation","Cloud Platforms (IaaS & PaaS)","AI Compute & Inference"],"lifecycle":[{"event":"open","at":"2026-10-23T08:28:34Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":56,"reasons":["conf:1","win:early","comp:brand"],"computed_at":"2026-10-23T19:12:58Z"},"pay":null,"html_url":"https://alion.io/job/nebius-dfir-expert","json_url":"https://alion.io/job/nebius-dfir-expert.json","meta":{"generated_at":"2026-10-23T19:12:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":456,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6364},"rest":"https://alion.io/mcp/rest/get_company?id=6364"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnebius-dfir-expert"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnebius-dfir-expert"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnebius-dfir-expert"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nebius-dfir-expert\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnebius-dfir-expert"}]}