Lead Detection Engineer - Nebius B.V. - Tel Aviv, Israel

Nebius is looking for a Lead Detection Engineer. This is an individual contributor role with full technical ownership. You'll set the direction for detection engineering: the standards, the tooling, the coverage strategy, and the automation that operationalizes it all. You'll work closely with SOC analysts and Platform Engineering to make detection a first-class engineering discipline. You’re welcome to work in our offices in Tel Aviv, Israel Your responsibilities will include: - Detection coverage strategy across endpoint, identity, cloud, and infrastructure — how it's measured, prioritized, and continuously improved. - Detection-as-Code pipeline: version control, testing, peer review, CI/CD, and deployment practices for all detection logic. - Architecture connecting detections to enrichment, triage, and automated response workflows. - Technical standards for how detections are designed, tested, documented, deployed, and retired. - Detection quality: fidelity metrics, false positive reduction, coverage measurement, and continuous validation loops. - Design and build high-fidelity behavioral detections across SIEM and EDR platforms. - Research emerging attacker techniques and translate threat intelligence into scalable, evasion-resistant detections. - Validate detections through threat simulations and continuous detection testing. - Partner with SOC analysts to close the feedback loop between detections and real investigations. - Define and track detection engineering metrics; communicate coverage posture and effectiveness to security leadership. - Make architectural decisions that scale as the team and organization grow. We expect you to have: - Minimum 3 years in detection engineering, security operations, or a hybrid offensive/defensive role — with demonstrated depth, not just breadth. - Experience owning or leading detection engineering work as a senior technical contributor - Strong understanding of attacker tradecraft and adversary behavior. - Hands-on experience with at least one enterprise SIEM and EDR platform — Splunk, Microsoft Sentinel, CrowdStrike, or equivalent. - Strong query development skills in SPL, KQL, Sigma, or similar. - Solid engineering practices: Git, CI/CD, code review, Detection-as-Code workflows. - Experience using MITRE ATT&CK to design, validate, and measure detection coverage - Ability to make and defend technical decisions and establish standards others adopt. It will be an added bonus if you have: - Offensive security background or certifications. - Experience with threat hunting and detection validation frameworks. - Experience designing SOAR playbooks and automated response workflows. - Cloud security depth across Azure, AWS, or GCP. - Experience building AI-assisted detection, investigation, or triage workflows.