The posting, in Nebius Group's own words
archived Sep 3, 2026About Nebius:
Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.
The role
Nebius is seeking a deeply technical DFIR and Incident Response Manager to build and lead the company’s global incident response capability - its people, tooling, and methodology - while remaining the hands-on technical authority on the hardest investigations. Reporting into the CISO Office, the Lead grows and directs a follow-the-sun team of responders across EMEA, Asia, and APAC, owning response execution and quality across Nebius’ cloud, infrastructure, and platform environments. This is a hands-on role that balances deep technical work alongwith building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by. You’re welcome to work in our offices in Tel Aviv, Israel.
Read the full posting ↓
Your responsibilities will include:
Build and lead Nebius’ global IR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders. Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases. Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction. Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements. Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR. Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA). Raise the team’s technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.