# DFIR Lead

**Company**: Nebius
**Location**: Israel
**Work arrangement**: onsite
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/nebius/jobs/4930968101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_9fff3184-6fc

## Description

Nebius is seeking a deeply technical DFIR Lead to build and lead the company's global incident response capability. The successful candidate will recruit, grow and direct a team of DFIR Experts, owning response execution, chain of custody and quality across Nebius' cloud, infrastructure, and platform environments.

Responsibilities:

- Build and lead Nebius' global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders.

- Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases.

- Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction.

- Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements.

- Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR.

- Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA).

- Raise the team's technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.

Requirements:

- 7+ years of hands-on incident response and digital forensics, including technical leadership of large-scale, high-impact incidents.

- Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability.

- Strong cloud-native platform security: containers and Kubernetes, CI/CD, secrets management, cloud control planes, and IAM attack paths.

- Fluency in attacker TTPs (MITRE ATT&CK, including the Cloud and Containers matrices), and hands-on experience with EDR, SIEM, and forensic tooling.

- Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale.

- Proven ability to lead under pressure and make high-quality decisions with incomplete data.

- Clear, concise communicator capable of briefing executives, Legal, Privacy, and non-technical stakeholders.

- Working knowledge of spoken and written English.

Benefits & Perks:

- Competitive compensation

- Career growth and learning opportunities

- Flexibility and ownership

- Collaborative and innovative culture

- Opportunity to work on impactful AI projects

- International environment and talented teams

## Skills

### Required
- incident response
- digital forensics
- cloud security
- Kubernetes
- containers
- CI/CD
- secrets management
- cloud control planes
- IAM attack paths
- MITRE ATT&CK
- EDR
- SIEM
- forensic tooling
- Python
- PowerShell
- SQL/KQL

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/nebius/jobs/4930968101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)