DFIR Lead
Hybrid (Tel Aviv)Full-timePosted 3mo ago
About the role
Nebius is seeking a deeply technical DFIR Lead to build and lead the company’s global incident response capability, while remaining the hands-on technical authority on the hardest investigations. The role balances leadership with technical execution across cloud, infrastructure, and platform environments, reporting to the SOC Manager.
Responsibilities
- Build and lead Nebius’ global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders.
- Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases.
- Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction.
- Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements.
- Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR.
- Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA).
- Raise the team’s technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.
Qualifications
- 7+ years of hands-on incident response and digital forensics, including technical leadership of large-scale, high-impact incidents (ransomware, nation-state / advanced threat actors, cloud intrusions, identity compromise).
- Experience building or leading IR teams and capabilities in cloud or infrastructure-heavy environments, which are highly regulated (SOC 2, ISO 27001, GDPR/NIS2).
Skills
Required:Incident response leadershipDigital forensics (Windows/Linux)Cloud security and environmentsTTPs & MITRE ATT&CK (Cloud/Containers)EDR/SIEM/forensic toolingScripting & data analysisCommunication to executives/Legal
Benefits
- Competitive compensation
- Career growth and learning opportunities
- Flexibility and ownership
- Collaborative and innovative culture
- Opportunity to work on impactful AI projects
- International environment and talented teams
Last updated Oct 7, 2026. Interested? Apply on the company site.
About Nebius
The ultimate cloud for AI explorers
Discover the most efficient way to build, tune and run your AI models and applications on top-notch NVIDIA® GPUs.
AI CloudToken FactoryGPUKubernetesSlurmManaged servicesTerraformAPI
More open roles at Nebius
- Staff Machine Learning Engineer, LLM Inference Optimization4d agoHybrid (Remote/Hybrid across listed locations) · ML
- Staff Site Reliability engineer - Network infrastructure - APAC4d agoRemote · Network Infrastructure
- Engineering manager - Network infrastructure - APAC4d agoRemote · Network Infrastructure
- Staff Software engineer - Network infrastructure - APAC4d agoRemote · Network Infrastructure
- Transportation Logistics Specialist4d agoHybrid (Europe) · Infrastructure