Senior Staff Security Engineer, Incident Response

About Nscale

Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.

We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.

About the Role

We are hiring a Senior Staff Security Engineer, Incident Response to lead the technical response to Nscale's most serious cyber incidents and build the capabilities that make future responses faster, safer and more decisive.

This hands-on senior individual contributor role sits in Cyber Defence and reports to the Director of Cyber Defence. You will work across Security Operations, Detection and Security Data Engineering, Product, Platform, Identity, Enterprise and Infrastructure teams, and Offensive Security.

During a major incident, you will be the technical incident commander, setting the investigation strategy, directing technical workstreams and providing the evidence leaders need to make decisions. Between incidents, you will turn lessons from incidents and offensive testing into durable defensive capability, including safe AI-assisted and agentic response workflows.

What you'll be doing

Technical incident command

• Lead the technical response to high-severity incidents across enterprise, identity, endpoint, cloud, product, production, data centre and operational technology environments.
• Set investigation hypotheses and evidence priorities; direct workstreams; reconstruct attack paths; analyse persistence and root cause; and establish credible scope.
• Develop technical options and success criteria for containment, eradication, credential and session invalidation, recovery validation and heightened monitoring.
• Conduct hands-on investigations across Linux and Windows hosts, cloud control planes, identity systems, networks, applications and containers.
• Lead post-incident technical reviews that result in permanent engineering improvements.

Response engineering

• Build a response-engineering roadmap that turns recurring manual investigation and containment work into tested, version-controlled and observable capabilities.
• Automate evidence collection, enrichment, correlation, timeline generation, blast-radius analysis, asset and owner attribution, remediation tracking and response recommendations.
• Create executable playbooks for identity compromise, cloud control-plane intrusion, destructive attacks and ransomware, insider threat, supply-chain compromise, data exfiltration and production compromise.

Adversary-informed defence

• Turn red-team findings, incident evidence and threat intelligence into detections, preventive controls, response actions and regression tests.
• Drive remediation campaigns for vulnerabilities and attack paths that span engineering organisations, with clear ownership, measurable closure and executive visibility where needed.
• Run technical readiness exercises that test Nscale's ability to detect, investigate, contain and recover from realistic attacks before they reach production.

Agentic response and team development

• Define safe AI-assisted and agentic response workflows with scoped access, human approval for consequential actions, evidence provenance, output validation, auditability, rollback and emergency-stop controls.
• Mentor incident responders, SOC analysts, security engineers and service owners in adversary behaviour, investigation methods and technical decision-making.
• Participate in the incident-response on-call rotation.

KPIs

• Time to credible scope
• Time to contain and eradicate
• Share of investigative and response steps safely automated
• Closure of post-incident engineering actions

About You

• You have 10+ years in incident response, security engineering, offensive security, detection engineering, vulnerability management or a closely related technical security role.
• You have led the technical response to complex, high-severity incidents in cloud-scale, hybrid or globally distributed environments.
• You understand attacker behavior including credential and session theft, privilege escalation, persistence, lateral movement, command and control, defence evasion, data exfiltration and destructive activity.
• You have investigated Linux and Windows hosts, cloud environments, identity systems, network activity and related security telemetry.
• You can establish incident scope and make sound containment decisions from incomplete or conflicting evidence.
• You have strong software engineering or scripting ability and have built reliable security tooling, integrations or automation.
• You have turned offensive findings, incidents or vulnerability intelligence into durable detections, controls, remediation mechanisms and validation tests.
• You can lead urgent remediation across teams without direct reporting lines and communicate technical conclusions, uncertainty and trade-offs to engineers, executives and other stakeholders.
• You build repeatable mechanisms and develop the wider team rather than becoming a single point of failure.

What we can offer you

At Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core.

• Highly competitive US compensation package (base + bonus + equity), with performance reviews every 12 months. 🚀
• Join one of the fastest-growing AI infrastructure companies — your chance to directly shape how global AI capacity is planned and deployed. ✨
• Expect a dynamic progression plan tailored to your ambitions. Grow by leading critical cross-functional initiatives and shaping capital strategy — always with our full support.
• Human-First Flexibility: We treat you as humans first. 🫶🏽 Our flexible workplace trusts Nscalers to deliver, giving you the autonomy to shape your day around life's moments.

Equal Opportunities Statement

We strongly encourage applications from people of colour, the LGBTQ+ community, people with disabilities, neurodivergent people, parents, carers, and people from lower socio-economic backgrounds.

If there’s anything we can do to accommodate your specific situation, please let us know.

The responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role.

For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here.