{"id":3685029,"url":"https://alion.io/job/nscale-senior-detection-response-engineer-cyber-defense","title":"Senior Detection & Response Engineer, Cyber Defense","company":{"id":48155,"name":"Nscale","domain":"nscale.com","url":"https://alion.io/company/nscale","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":90,"open_postings":26,"ghost_share":0,"stale_share":0.385,"repost_share":0.038,"time_to_fill_p50_days":56,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom","United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"GCP","optional":false},{"name":"HPC","optional":false},{"name":"Linux","optional":false},{"name":"LLM","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-03T13:38:17Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-05T11:22:22Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"About Nscale\nNscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.\nWe thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.\nAbout the Role\nWe're hiring a Senior Detection & Response Engineer in Cyber Defense to decide what Nscale detects, command incident response, and automate recurring security work across enterprise, cloud, production, data centre, and operational technology environments.\nYou'll work with engineering, infrastructure, and service owners in a three-person regional rotation: roughly one operational week followed by two weeks focused on engineering and preparedness. In-house AI agents handle level 0 and level 1 around the clock; a managed provider covers weekends and escalates in defined circumstances. We're building follow-the-sun coverage across three regional hubs. Until every hub is staffed, the rotation includes out-of-hours on-call; the intended end state is conventional weekday hours in each region without night-time paging.\nThis team owns detection engineering as well as response. Agents draft detection logic; you validate it and decide what goes live. Your mandate is to contain threats and fix recurring problems at their source, with success measured by the share of escalations permanently solved-not tickets closed.\nWhat you'll be doing\nDetection engineering\nMap detection coverage against attacker tradecraft and our environments, identifying blind spots and telemetry gaps.\nTurn incidents, threat research, coverage gaps, and recurring escalations into detection ideas, working with AI agents to build them.\nAssess agent-proposed rule logic in shadow mode before promotion: what it catches, what it misses, and how much noise it creates.\nMake the final call on production promotion and remain accountable for detection quality. You'll rarely write a query from scratch, but nothing goes live without your judgement.\nRetune or retire noisy, stale, or irrelevant detections, and build the business case for closing telemetry gaps.\nAutomation and platform engineering\nAutomate recurring enrichment, triage, containment, case handling, and reporting.\nImprove first-tier agents so they resolve more independently and escalate with better context.\nBuild response actions, integrations, and agent tooling in our internal security platform, and prove they work in production.\nIncident command and preparedness\nCommand security incidents: set objectives, coordinate engineering, infrastructure, and service owners, and keep leadership informed.\nMake containment decisions under time pressure, recognising what is pre-approved, what needs authority, and what could disrupt production.\nRun post-incident reviews that lead to engineering improvements.\nDesign tabletop exercises and recovery tests, maintain practical playbooks, and automate steps that don't need a human.\nEnsure the evidence, access, knowledge, and authority needed for an incident are in place beforehand.\nYour operational week\nAssess escalations against asset and business context, decide on a response, and execute approved containment, including device isolation, session revocation, access restrictions, blocking, and evidence preservation.\nIdentify a lasting fix wherever warranted. Build detection and automation fixes with the agents, or specify control changes clearly for the owning team.\nClose cases with a security disposition, an owner, evidence, actions taken, and required follow-up.\nHold the managed provider to our standards for evidence, analysis, routing, and closure quality.\nClassify findings as risk indicators or actionable using the SSVC model, and hand over the queue at the end of your region's working day as follow-the-sun coverage is established.\nKPIs\nShare of escalations permanently solved\nFirst 90 days: one recurring alert class permanently resolved\nFirst 90 days: coverage mapped for one area and at least one gap closed\nFirst 90 days: first agent-proposed detections promoted and first platform feature shipped\nAbout You\n5+ years in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles.\nDetection judgement: the ability to assess what a rule catches, what it misses, and how it will behave in production, with a focus on overall coverage.\nFluency in modern attacker tradecraft and its telemetry, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration.\nWorking knowledge of Windows, macOS, and Linux internals, including persistence techniques and logging.\nExperience leading, or playing a central role in, a significant incident: running the bridge, setting priorities, and keeping leadership informed while maintaining the technical detail.\nExperience building in and securing public cloud environments such as AWS and GCP, plus hands-on investigations across endpoint, identity, cloud, SaaS, network, or production workloads.\nThe ability to automate repeat work using query languages, scripting, APIs, or workflow automation.\nSound containment judgement and a calm, methodical approach when facts are incomplete or contradictory.\nA willingness to challenge automated conclusions. You'll validate AI-generated analysis and detection logic rather than treating them as authoritative.\nClear investigation records, actionable escalations, audit-ready case notes, and effective collaboration with engineering, infrastructure, and service owners.\nUseful additional experience\nOperational technology, industrial control systems, building management systems, or critical facilities.\nCloud or AI infrastructure, data centres, HPC, or other availability-sensitive environments.\nDetection-as-code, detection testing, adversary emulation, or purple teaming.\nBuilding, tuning, or evaluating AI agents or LLM-based security tooling.\nResponding to ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents.\nManaging monitoring or response provider quality while keeping decisions in-house.\nWorking in a follow-the-sun rotation.\nWhat we can offer you\nAt Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core.\nHighly competitive UK compensation package (base + bonus + equity), with performance reviews every 12 months. \nJoin one of the fastest-growing AI infrastructure companies - your chance to directly shape how global AI capacity is planned and deployed. \nExpect a dynamic progression plan tailored to your ambitions. Grow by leading critical cross-functional initiatives and shaping capital strategy - always with our full support.\nHuman-First Flexibility: We treat you as humans first. Our flexible workplace trusts Nscalers to deliver, giving you the autonomy to shape your day around life's moments.\nEqual Opportunities Statement\nWe strongly encourage applications from people of colour, the LGBTQ+ community, people with disabilities, neurodivergent people, parents, carers, and people from lower socio-economic backgrounds.\nIf there’s anything we can do to accommodate your specific situation, please let us know.\nThe responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role.\nFor information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here.\nFor information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here.\nNscale does not accept unsolicited candidate submissions from recruitment agencies.","description_format":"text","description_chars":8570,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible schedule"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Data Centers & Colocation","AI Compute & Inference"],"lifecycle":[{"event":"open","at":"2026-11-03T14:37:05Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker, Senior or Specialist Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker; Global Business Mobility: Senior or Specialist Worker","cap_exempt":false,"checked_at":"2026-11-05T06:29:30+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":56,"reasons":["conf:5","velocity","win:early","comp:brand"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/nscale-senior-detection-response-engineer-cyber-defense","json_url":"https://alion.io/job/nscale-senior-detection-response-engineer-cyber-defense.json","meta":{"generated_at":"2026-11-05T15:46:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20652,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":48155},"rest":"https://alion.io/mcp/rest/get_company?id=48155"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnscale-senior-detection-response-engineer-cyber-defense"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnscale-senior-detection-response-engineer-cyber-defense"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnscale-senior-detection-response-engineer-cyber-defense"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nscale-senior-detection-response-engineer-cyber-defense\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnscale-senior-detection-response-engineer-cyber-defense"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3685029}},{"tool":"search_jobs","arguments":{"company":"nscale.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3685029},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}