search Browse Jobs
DFIR LeadNebius · Israel
Nebius logo

Nebius

company page ↗

DFIR Lead

🗓️ Posted 2026-09-09 Israel Hybrid ICT
💰 Salary Not shared 📊 Market 30,000 EUR–50,000 EUR/mo

About the Company

Nebius is leading a new era in cloud infrastructure for the global AI economy, building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers, Nebius owns the hard problems across compute, storage, networking and applied AI, from large-scale GPU orchestration to inference optimization. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, Nebius has a global footprint with R&D hubs across Europe, the UK, North America and Israel, and a team of 1,500+ including hundreds of engineers with deep expertise across hardware, software and AI R&D.

About the Role

Nebius is seeking a deeply technical DFIR Lead to build and lead the company's global incident response capability, including its people, tooling, and methodology, while remaining the hands-on technical authority on the hardest investigations. Reporting to the SOC Manager, the DFIR Lead will recruit, grow and direct a team of DFIR Experts, owning response execution, chain of custody and quality across Nebius' cloud, infrastructure, and platform environments. This is a hands-on role that balances deep technical work along with building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by. You're welcome to work in our offices in Tel Aviv, Israel.

Responsibilities

  • ● Build and lead Nebius' global DFIR capability: select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders.
  • ● Lead the technical response to major incidents hands-on, from escalation through containment, eradication, and recovery, and act as the final technical authority on the most complex cases.
  • ● Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments, including log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction.
  • ● Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements.
  • ● Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR.
  • ● Serve as the technical voice of incident response to executive leadership, Legal, and Privacy, delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA).
  • ● Raise the team's technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.