<div class="content-intro"><p><strong>About Nebius:</strong></p> <p>Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.</p> <p>Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.</p> <p>Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.</p></div><h3><strong><span data-ccp-props="{}">The role</span></strong></h3> <p>Nebius is seeking a deeply technical DFIR Lead to build and lead the company’s global incident response capability - its people, tooling, and methodology - while remaining the hands-on technical authority on the hardest investigations. Reporting to the SOC Manager, the DFIR Lead will recruit, grow and direct a team of DFIR Experts, owning response execution, chain of custody and quality across Nebius’ cloud, infrastructure, and platform environments.</p> <p>This is a hands-on role that balances deep technical work along with building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by.</p> <p><span data-ccp-props="{}"> You’re welcome to work in our offices in Tel Aviv, Israel.</span></p> <p><strong><span data-contrast="auto"><span data-ccp-charstyle="Strong">Your responsibilities will include:</span></span></strong><span data-ccp-props="{"134233117":true,"134233118":true}"> </span></p> <ul> <li>Build and lead Nebius’ global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders.</li> <li>Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases.</li> <li>Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction.</li> <li>Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements.</li> <li>Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR.</li> <li>Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA).</li> <li>Raise the team’s technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.</li> </ul> <p><strong><span data-contrast="auto"><span data-ccp-charstyle="Strong">We expect you to have:</span></span></strong><span data-ccp-props="{"134233117":true,"134233118":true}"> </span></p> <p>Experience</p> <ul> <li>7+ years of hands-on incident response and digital forensics, including technical leadership of large-scale, high-impact incidents (ransomware, nation-state / advanced threat actors, cloud intrusions, identity compromise).</li> <li>Experience building or leading IR teams and capabilities in cloud or infrastructure-heavy environments, which are highly regulated (SOC 2, ISO 27001, GDPR/NIS2).</li> </ul> <p>Technical Expertise</p> <ul> <li>Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability.</li> <li>Strong cloud-native platform security: containers and Kubernetes, CI/CD, secrets management, cloud control planes, and IAM attack paths.</li> <li>Fluency in attacker TTPs (MITRE ATT&CK, including the Cloud and Containers matrices), and hands-on experience with EDR, SIEM, and forensic tooling (e.g., Velociraptor, Volatility, X-Ways/EnCase).</li> <li>Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions.</li> </ul> <p>Leadership & Communication</p> <ul> <li>Proven ability to lead under pressure and make high-quality decisions with incomplete data; technical leadership through credibility across regions, without relying on direct authority.</li> <li>Clear, concise communicator capable of briefing executives, Legal, Privacy, and non-technical stakeholders.</li> <li><span data-contrast="auto"><span data-ccp-parastyle="Normal (Web)">Working knowledge of spoken and written English</span></span><span data-ccp-props="{"134233117":true,"134233118":true}"> </span></li> </ul><div class="content-conclusion"><p><strong>Benefits & Perks:</strong></p> <ul> <li>Competitive compensation</