# Lead Detection Engineer

**Company**: Nebius
**Location**: Tel Aviv, Israel
**Work arrangement**: onsite
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/nebius/jobs/4930998101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_7dd5bfb5-0ea

## Description

Nebius is looking for a Lead Detection Engineer. This is an individual contributor role with full technical ownership. You will set the direction for detection engineering: the standards, the tooling, the coverage strategy, and the automation that operationalizes it all.

Responsibilities:

- Detection coverage strategy across endpoint, identity, cloud, and infrastructure , how it's measured, prioritized, and continuously improved.

- Detection-as-Code pipeline: version control, testing, peer review, CI/CD, and deployment practices for all detection logic.

- Architecture connecting detections to enrichment, triage, and automated response workflows.

- Technical standards for how detections are designed, tested, documented, deployed, and retired.

- Detection quality: fidelity metrics, false positive reduction, coverage measurement, and continuous validation loops.

- Design and build high-fidelity behavioral detections across SIEM and EDR platforms.

- Research emerging attacker techniques and translate threat intelligence into scalable, evasion-resistant detections.

- Validate detections through threat simulations and continuous detection testing.

- Partner with SOC analysts to close the feedback loop between detections and real investigations.

- Define and track detection engineering metrics; communicate coverage posture and effectiveness to security leadership.

- Make architectural decisions that scale as the team and organization grow.

Requirements:

- Minimum 3 years in detection engineering, security operations, or a hybrid offensive/defensive role , with demonstrated depth, not just breadth.

- Experience owning or leading detection engineering work as a senior technical contributor.

- Strong understanding of attacker tradecraft and adversary behavior.

- Hands-on experience with at least one enterprise SIEM and EDR platform , Splunk, Microsoft Sentinel, CrowdStrike, or equivalent.

- Cloud security depth across Azure, AWS, or GCP.

- Strong query development skills in SPL, KQL, Sigma, or similar.

- Strong scripting skills (python, powershell etc).

- Solid engineering practices: Git, CI/CD, code review, Detection-as-Code workflows.

- Experience using MITRE ATT&CK to design, validate, and measure detection coverage.

- Ability to make and defend technical decisions and establish standards others adopt.

Benefits & Perks:

- Competitive compensation

- Career growth and learning opportunities

- Flexibility and ownership

- Collaborative and innovative culture

- Opportunity to work on impactful AI projects

- International environment and talented teams

## Skills

### Required
- detection engineering
- security operations
- SIEM
- EDR
- cloud security
- query development
- scripting
- Git
- CI/CD
- Detection-as-Code
- MITRE ATT&CK

### Nice to have
- offensive security background
- threat hunting
- SOAR playbooks
- automated response workflows
- AI-assisted detection

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/nebius/jobs/4930998101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)