Senior Security Engineer, Incident Response

Senior Staff Security Engineer, Incident Response

Houston;
New York;
San Francisco;
Seattle

Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.

We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.

We are hiring a Senior Staff Security Engineer, Incident Response to lead the technical response to Nscale's most serious cyber incidents and build the capabilities that make future responses faster, safer and more decisive.

This hands-on senior individual contributor role sits in Cyber Defence and reports to the Director of Cyber Defence. You will work across Security Operations, Detection and Security Data Engineering, Product, Platform, Identity, Enterprise and Infrastructure teams, and Offensive Security.

During a major incident, you will be the technical incident commander, setting the investigation strategy, directing technical work streams and providing the evidence leaders need to make decisions. Between incidents, you will turn lessons from incidents and offensive testing into durable defensive capability, including safe AI-assisted and agentic response workflows.

• Lead the technical response to high-severity incidents across enterprise, identity, endpoint, cloud, product, production, data centre and operational technology environments.
• Set investigation hypotheses and evidence priorities; direct work streams; reconstruct attack paths; analyse persistence and root cause; and establish credible scope.
• Develop technical options and success criteria for containment, eradication, credential and session invalidation, recovery validation and heightened monitoring.
• Conduct hands-on investigations across Linux and Windows hosts, cloud control planes, identity systems, networks, applications and containers.
• Lead post-incident technical reviews that result in permanent engineering improvements.
• Build a response-engineering roadmap that turns recurring manual investigation and containment work into tested, version-controlled and observable capabilities.
• Automate evidence collection, enrichment, correlation, timeline generation, blast-radius analysis, asset and owner attribution, remediation tracking and response recommendations.
• Create executable playbooks for identity compromise, cloud control-plane intrusion, destructive attacks and ransomware, insider threat, supply-chain compromise, data exfiltration and production compromise.
• Turn red-team findings, incident evidence and threat intelligence into detections, preventive controls, response actions and regression tests.
• Drive remediation campaigns for vulnerabilities and attack paths that span engineering organisations, with clear ownership, measurable closure and executive visibility where needed.
• Run technical readiness exercises that test Nscale's ability to detect, investigate, contain and recover from realistic attacks before they reach production.

• Define safe AI-assisted and agentic response workflows with scoped access, human approval for consequential actions, evidence provenance, output validation, auditability, rollback and emergency-stop controls.
• Mentor incident responders, SOC analysts, security engineers and service owners in adversary behaviour, investigation methods and technical decision-making.
• Participate in the incident-response on-call rotation.

• Time to credible scope
• Time to contain and eradicate
• Share of investigative and response steps safely automated
• Closure of post-incident engineering actions

• You have 10+ years in incident response, security engineering, offensive security, detection engineering, vulnerability management or a closely related technical security role.
• You have led the technical response to complex, high-severity incidents in…