Senior Detection & Response Engineer, Cyber Defense

Nscale • Seattle, WA

8d • $160,000 - $190,000

About The Position

Nscale is hiring a Senior Detection & Response Engineer to determine detection coverage, lead responses to confirmed security incidents, and automate work across enterprise, cloud, production, data centre, and operational technology environments. The role combines operational response with detection engineering, automation, incident command, and preparedness. Engineers work in a three-person regional rotation: approximately one week in three is operational, with the remaining time focused on engineering and readiness. Until all regional hubs are staffed, the rotation includes out-of-hours on-call; the intended future model is follow-the-sun coverage during conventional weekday hours in each region.

In-house security agents handle level 0 and level 1 around the clock, while a contracted managed provider covers weekends and escalates defined cases. The team owns detection coverage, working with AI agents that draft rule logic; engineers assess, tune, and decide what goes live. Escalations are handled through immediate action, permanent fixes, or both, and the primary operational metric is the share of escalations permanently solved.

The role includes mapping detection coverage to attacker tradecraft and the estate, addressing telemetry gaps, improving first-tier agents, and building internal security-platform capabilities. The engineer also commands incidents, makes containment decisions, coordinates responders and informs leadership, and ensures post-incident reviews lead to engineering work. Operational duties include handling escalations, executing approved containment, documenting dispositions and evidence, and maintaining the quality of the managed provider’s work.

Within the first 90 days, the engineer is expected to learn and join the rotation, independently own common escalations, ship a permanent solve for a recurring alert class, map coverage in one area and close a gap, promote agent-proposed detections, add a platform feature, shadow an incident commander, and identify a telemetry gap with a business case.

Requirements

• At least 5 years of experience in detection engineering, incident response, security operations, threat hunting, security engineering, or related roles.
• Strong detection judgement: ability to assess what a rule catches and misses and how noisy it may be in production; thinks in terms of coverage, not just individual alerts.
• Fluency in modern attacker tradecraft, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration, and how these appear in telemetry.
• Working knowledge of Windows, macOS, and Linux internals, including persistence techniques and relevant logging.
• Incident command experience, including leading or playing a central role in a significant incident, running the bridge, setting priorities, and keeping leadership informed while maintaining technical oversight.
• Experience building in and securing public cloud environments such as AWS and GCP.
• Ability to automate repeated work using query languages, scripting, APIs, or workflow automation.
• Hands-on investigation experience across endpoint, identity, cloud, SaaS, network, or production workloads.
• Sound judgement when making containment decisions under time pressure.
• Willingness and ability to validate AI-agent analysis and detection logic rather than treating automated conclusions as authoritative.
• Ability to write investigations, escalations, and case notes that are clear, actionable, and suitable for later audit review.
• Calm, methodical approach when facts are incomplete or contradictory.
• Ability to work effectively with engineering, infrastructure, and service owners who do not report to the role.
• Willingness to take operational rotation and, until regional hubs are fully staffed, out-of-hours on-call.
• Ability and willingness to command live incidents.

Nice To Haves

• Experience in operational technology, industrial control systems, building management systems, or critical facilities.
• Experience in cloud infrastructure, AI infrastructure, data centres, HPC, or other availability-sensitive environments.
• Experience with detection-as-code, detection testing, adversary emulation, or purple teaming.
• Experience building, tuning, or evaluating AI agents or LLM-based security tooling.
• Response experience involving ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents.
• Experience holding a managed monitoring or response provider to a standard while keeping decisions in-house.
• Experience working as part of a follow-the-sun rotation.

Responsibilities

• Map detection coverage against attacker tradecraft and the estate; identify blind spots and telemetry gaps.
• Turn coverage gaps, incidents, threat research, and recurring escalations into detection ideas and work with AI agents to build them.
• Assess and tune agent-proposed detection ideas and rule logic, including their coverage, misses, and likely noise; decide whether to promote them to production.
• Retire or retune noisy, stale, or irrelevant live detections.
• Make the business case for closing telemetry gaps.
• Automate recurring response work, including enrichment, triage, containment, case handling, and reporting.
• Improve first-tier security agents so they can resolve more cases and escalate with better context.
• Build and ship capabilities in the internal security platform, including response actions, integrations, and agent tooling, and verify them in production.
• Command security incidents by setting objectives, coordinating engineering, infrastructure, and service-owner responders, and keeping leadership informed.
• Make containment decisions under time pressure, considering authority requirements and potential production disruption.
• Run post-incident reviews that result in engineering work.
• Design and run tabletop exercises and recovery tests; maintain playbooks and runbooks and automate steps that do not require human judgement.
• Ensure incident response has the necessary evidence, access, knowledge, and authority in place.
• Take escalations from agents and the managed provider, scope them using asset and business context, and decide and act.
• Execute approved containment, including isolating devices, revoking sessions, restricting access, blocking activity, and preserving evidence.
• Ensure escalations receive a permanent solution where warranted, through detection, automation, or clearly specified control changes.
• Close cases with a security disposition, owner, evidence, actions taken, and required follow-up.
• Hold the managed provider to standards for evidence, analysis, routing, and closure quality.
• Learn the incident command, escalation, evidence, and handover model and take a rotation slot; independently own common escalations.
• Within the first 90 days, deliver a permanent solve for a recurring alert class, map and improve detection coverage, promote agent-proposed detections, add a platform feature, shadow an incident commander, and identify a telemetry gap with a business case.

Benefits

• Highly competitive US compensation package with base salary, bonus, and equity; performance reviews every 12 months.
• Flexible workplace and autonomy to shape the workday.
• Potential competitive benefits package including medical, dental, and vision coverage, flexible paid time off, parental leave, and retirement plan participation.
• Dynamic progression plan tailored to individual ambitions, with opportunities to lead cross-functional initiatives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed