# Senior Detection & Response Engineer, Cyber Defense at Nscale

Nscale is hiring a Senior Detection & Response Engineer, Cyber Defense in Houston, New York and San Francisco, United States. It pays $160k-$190k a year and Level rates it Little AI ●○○○; you can [apply on Nscale](https://jobsbylevel.com/go/c5933553-c964-4e6d-ba50-735b37c45ac4?utm_medium=ai-agent).

AI Level 1, AI centrality 35 out of 100. Houston; New York; San Francisco; Seattle.

## Details

- Company: [Nscale](https://jobsbylevel.com/companies/nscale)
- AI level: AI Level 1 (score 35 out of 100)
- Location: Houston; New York; San Francisco; Seattle
- Salary: $160k-$190k
- Posted: July 7, 2026
- Apply: https://jobsbylevel.com/go/c5933553-c964-4e6d-ba50-735b37c45ac4?utm_medium=ai-agent
- Free CV review for this job: https://jobsbylevel.com/cv-review?job=senior-detection-response-engineer-cyber-defense-at-nscale-3653e5

## Prepare for this job

The job page lists 5 likely interview questions for this offer, with a CV checklist: https://jobsbylevel.com/jobs/senior-detection-response-engineer-cyber-defense-at-nscale-3653e5

## Description

About Nscale Nscale is building the infrastructure platform for the AI era. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers, reducing the complexity of AI development and helping customers manage cost, innovate rapidly, and operate responsibly. We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future. About the Role We are hiring Detection & Response Engineers to decide what we detect, command the response when something is real, and automate everything in between, across enterprise, cloud, production, data centre, and operational technology environments. You will work in a three-person regional rotation. Roughly one week in three, you hold the operational slot: taking escalations, deciding fast, and acting. The other two weeks are engineering. You find where our detection coverage is thin and work with our AI agents to close it, build automation that removes human time from the response path, and make sure we are ready for the next incident. When a serious incident lands, you command it. If you have spent years closing the same ticket every Tuesday—and knowing exactly how to fix it for good, but never having the mandate—this is the job where that is the mandate. How this function works Read this section carefully. It is not a standard SOC, and the difference is the whole point. Agents hold the first tier. In-house security agents hold level 0 and level 1 around the clock. A contracted managed provider covers weekends and works alerts to conclusion, escalating to us only in defined circumstances. Work reaches you as an escalation with context already attached. One week in three on the operational rotation. Each regional team runs a three-person rotation in week-long blocks. One engineer holds the operational slot. The other two do detection engineering, automation, and incident preparedness, and both can jump in when escalations spike. Every escalation forks three ways: act, solve, or both. Act is the immediate containment. Solve is the engineering work that stops that alert class firing again: a new or tuned detection, an automation, or a control change. Most escalations are both. Your primary operational metric is the share of escalations permanently solved. Not tickets closed, and not mean time to close. If the same alert fires twice, we got it wrong the first time. Detection is this team’s job. There is no separate detection engineering team. Detection coverage is owned by this team working with our AI agents: you find the gaps and decide what good looks like, the agents draft the rule logic, and you assess, tune, and decide what goes live. Two classes, not five. We sort everything into risk indicator or actionable, using the SSVC model. If you have drowned in a five-tier severity scheme nobody trusted, you will like this. Building to 24 hours. We are building follow-the-sun coverage across three regional hubs. Each region hands the queue to the next as its working day ends, so everyone works conventional weekday hours in their own daylight. Until every hub is staffed, the rotation includes out-of-hours on-call. The end state is a team where nobody gets paged at night. What you'll be doing Detection engineering Map our detection coverage against attacker tradecraft and the real estate, and find where we are blind. Turn coverage gaps, incidents, threat research, and recurring escalations into clear detection ideas, and work with our AI agents to build them. Assess and tune the detection ideas and rule logic our agents propose, which run as shadow rules before they go live. Judge what each one catches, what it misses, and what its noise will

The description is cut here. Read the full offer: https://jobsbylevel.com/jobs/senior-detection-response-engineer-cyber-defense-at-nscale-3653e5

Source: https://jobsbylevel.com/jobs/senior-detection-response-engineer-cyber-defense-at-nscale-3653e5

## Cite this page

Level. https://jobsbylevel.com/jobs/senior-detection-response-engineer-cyber-defense-at-nscale-3653e5.

Get job alerts: https://jobsbylevel.com/newsletter