Security Response Engineer, Cyber Defense

About Nscale
Nscale is building the infrastructure platform for the AI era. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers, reducing the complexity of AI development and helping customers manage cost, innovate rapidly, and operate responsibly.
We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you'll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you'll be contributing to building the technology that powers the future.
About the Role
We are hiring Security Response Engineers to own what happens after an alert becomes real, across enterprise, cloud, production, data centre, and operational technology environments.
Agents and a managed security service provider (MSP) hold the level 1 queue. You take escalations, decide fast, act, and then make sure the same class of problem does not come back. Half the job is response. The other half is turning what you learned into engineering work that permanently retires the issue.
If you have spent years closing the same ticket every Tuesday-and knowing exactly how to fix it for good, but never having the mandate-this is the job where that is the mandate.
How this function works
Read this section carefully. It is not a standard SOC, and the difference is the whole point.

• You do not watch a queue. An in-house security agent and a contracted managed provider hold level 0 and level 1 around the clock. Work reaches you as an escalation with context already attached.
• Every escalation forks three ways: act, solve, or both. Act is the immediate containment. Solve is the engineering artifact you hand to the build teams so that alert class does not fire again. Most escalations are both.
• Your primary metric is the share of escalations permanently solved. Not tickets closed, and not mean time to close. If the same alert fires twice, we got it wrong the first time.
• Two classes, not five. We sort everything into risk indicator or actionable, using the SSVC model. If you have drowned in a five-tier severity scheme nobody trusted, you will like this.
• Follow-the-sun across hubs. Nobody works permanent nights.

What you'll be doing
Escalation response

• Take escalations from the agent and managed provider, scope them against real asset and business context, decide, and act.
• Execute approved containment, including isolating devices, revoking sessions, restricting access, blocking activity, and preserving evidence.
• Know what you can do immediately, what requires authority, and what could disrupt production if handled incorrectly.

The solve

• Ensure every escalation exits with an engineering artifact where one is warranted: a detection requirement, telemetry gap with a business case, control change, automation, or regression test.
• Specify the artifact clearly enough that the team building it can act without a second conversation. You do not build it; you make the required outcome unambiguous.

Investigation and evidence

• Build timelines from primary evidence across identity, endpoint, email, SaaS, cloud, network, production, and increasingly operational technology and building management systems, which are currently dark to us.
• Close every case with a security disposition, an owner, the evidence, actions taken, and any required follow-up.

Detection judgement

• Review candidate detections auto-authored by our research loop as shadow rules and assess their inside-out coverage.
• Make the human judgement on whether shadow detections should be promoted to live. You do not write the detection logic, but nothing goes live without your call.

Provider quality

• Reconcile the managed provider's case work, which lives in their platform rather than ours, against our standards.
• Hold the provider accountable for evidence, analysis, routing, and closure quality.

Readiness

• Contribute to threat hunts, incident reviews, tabletop exercises, recovery tests, the on-call rotation, and keeping runbooks honest.

First 90 days

• Independently own escalations across common classes, with defensible dispositions and evidence that stands up.
• Ship your first solve: an engineering artifact that permanently retires a recurring alert class.
• Learn the incident command, escalation, evidence, and handover model, and take a rotation slot.
• Review the managed provider's case quality against our standard and raise the first reconciliation findings.
• Judge and promote your first shadow detections to live.
• Take part in a threat hunt, tabletop, or recovery exercise.
• Name one telemetry gap with a business case behind it. Extra credit if it is in operational technology or building management systems, both of which we currently cannot see.

KPIs

• Share of escalations permanently solved
• Quality and defensibility of security dispositions and evidence
• Containment judgement and response effectiveness
• Quality and actionability of engineering artifacts
• Managed provider quality and reconciliation

About You

• 5+ years in security operations, incident response, threat detection, threat hunting, security engineering, or related roles.
• Hands-on investigation experience across endpoint, identity, cloud, SaaS, network, or production telemetry, with the ability to build a timeline from primary evidence rather than a vendor summary.
• Fluency in modern attacker tradecraft, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration.
• You automate what you repeat, using query languages, scripting, APIs, or workflow automation. When you hit the same problem a third time, your instinct is to build-not add another step to a runbook.
• Sound judgement on containment under time pressure, including knowing where your authority ends.
• You write investigations another engineer can follow, escalations a leader can act on in thirty seconds, and case notes that still make sense to someone reading them two years later in an audit.
• Calm and methodical when facts are incomplete or contradict each other.
• Willingness to challenge automated conclusions. AI-generated analysis is an input, not an authority; we expect you to validate it and notice when it is confidently wrong.
• Ability to work effectively with engineering, infrastructure, and service owners who do not report to you.

Strong pluses

• Operational technology, industrial control systems, building management systems, or critical facilities experience. We have a known gap here and will weight it heavily.
• Cloud infrastructure, AI infrastructure, data centres, HPC, or other availability-sensitive environments.
• Response experience involving ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents.
• Experience holding a managed monitoring or response provider to a standard while keeping decisions in-house.
• Detection testing, shadow-rule validation, threat hunting, or forensic readiness.
• Follow-the-sun, shift-based, or on-call operations.
• Certifications are useful, but not required.

How we will assess

• An investigation, end to end. Signal to evidence to scope to containment to disposition. We are listening for what you decided independently, what you escalated, and why.
• The solve. This is the most important answer in the process. Describe a recurring problem you permanently retired: the artifact, who built it, and how you proved it worked.
• Automation instinct. Tell us about recurring toil you inherited and whether you reached for a tool, a person, or a build.
• Judging a machine. Describe a time an alert, vendor, or model was confidently wrong and how you caught it.
• Writing. We may ask for a redacted investigation write-up or escalation note.

Where this leads
Response Engineers here develop the sharpest picture in the company of where the estate actually breaks. They are strong internal candidates for detection engineering, platform security, and identity roles as those pillars grow. We would rather grow our next engineers here than hire them all in.
This role may not be a fit if you:

• Want a queue to work through. There is not one.
• Measure success in tickets closed.
• Close cases without a security disposition or evidence.
• Forward vendor alerts without validating them.
• Want to write detections full time. That role is real and well funded here, but it sits in another pillar; we would rather point you towards it than mis-hire you into this one.

What we can offer you
At Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core.
Highly competitive US compensation package (base + bonus + equity) . click apply for full job details