The Role

We are seeking an experienced Data Protection Lead to join the Cyber Security organization, reporting to the Head of Security Engineering under the CISO.
This role is responsible for leading the organization’s data protection domain, with a focus on data discovery, classification, and data loss prevention (DLP) across corporate and cloud environments.
You will define and drive data protection strategy, implement controls to protect sensitive data across its lifecycle, and ensure visibility into where data resides and how it is used. The role requires close collaboration with Security, IT, Engineering, Product, and GRC teams to reduce data exposure risks and enforce strong data governance practices.

Key Responsibilities

• Lead and own the organization’s data protection domain, including strategy, standards, and implementation
• Drive data discovery initiatives to identify sensitive data across databases, SaaS applications, endpoints, and cloud environments
• Define and implement data classification frameworks, labeling standards, and data handling policies
• Design and implement data loss prevention (DLP) controls across endpoints, email, SaaS, network, and cloud platforms
• Ensure protection of sensitive data across its lifecycle, including storage, processing, and transfer
• Lead implementation and optimization of data security technologies (e.g., DLP, DSPM, CASB/SSE, data classification tools)
• Define and enforce data access governance, including least privilege and monitoring of sensitive data access and usage
• Monitor and investigate data-related risks, exposures, and policy violations in collaboration with SOC and Security teams
• Conduct risk assessments and identify gaps in data protection controls across systems and business processes
• Support compliance and regulatory requirements (e.g., GDPR, ISO 27001, SOC 2) related to data security and privacy
• Collaborate with Engineering, IT, Product, and GRC teams to embed data security controls into systems and workflows
• Maintain documentation, standards, and guidelines for data security practices

Required Skills & Experience

• 6+ years of experience in cyber security, with a focus on data security, data protection, or information security
• Hands-on experience with data discovery, classification, and DLP solutions
• Strong understanding of data lifecycle management and data security principles
• Experience securing data across cloud environments and SaaS platforms
• Experience implementing and managing data classification and labeling frameworks
• Strong understanding of identity and access management and data access controls
• Experience working with data security tools (e.g., Microsoft Purview, Netskope, Symantec DLP, etc.)
• Experience working cross-functionally with Security, IT, Engineering, Product, and GRC teams
• Strong analytical and problem-solving skills
• Excellent written and verbal communication skills in English
• Strong analytical and problem-solving mindset
• Ability to communicate data security risks clearly to technical and non-technical stakeholders
• Proactive, detail-oriented, and ownership-driven
• Comfortable working in cross-functional teams in a dynamic environment

Nice to Have

• Experience leading or building data security or DLP programs in a growing organization
• Familiarity with DSPM (Data Security Posture Management) tools
• Experience with CASB / SSE platforms (e.g., Netskope, Zscaler)
• Knowledge of privacy and regulatory frameworks (GDPR, ISO 27001, SOC 2, etc.)
• Relevant certifications such as CISSP, CISM, or CDLP
• BSc in Computer Science, Information Security, or a related field

The role

Nebius is looking for a an experienced SOC Manager to join the Cyber Security organization, reporting to the Head of Detection & Response under the CISO.

This role is responsible for leading the organization’s Security Operations Center (SOC), overseeing 24/7 monitoring, detection, and response activities across cloud, infrastructure, SaaS, and enterprise environments.

The ideal candidate is both operationally strong and strategically minded, with hands-on experience in security operations, incident response, and team leadership. You will drive continuous improvement of detection and response capabilities while ensuring effective collaboration with Security, DevOps, Infrastructure, and Engineering teams.

 You’re welcome to work in our offices in Tel Aviv.

Your responsibilities will include: 

SOC Operations Leadership

• Lead and manage day-to-day SOC operations, including monitoring, detection, triage, and incident response.
• Oversee security alerts and incidents across SIEM, EDR/XDR, cloud security, and other detection platforms.
• Ensure timely and effective response to security incidents in accordance with defined SLAs and severity levels.
• Manage SOC analysts (internal or external), including task prioritization, shift coverage, performance, and professional development.

Incident Response & Handling

• Own the full incident response lifecycle: detection, analysis, containment, eradication, and recovery.
• Act as the primary escalation point for complex or high-severity security incidents.
• Coordinate cross-functional response efforts with Security, IT, DevOps, Infrastructure, and Engineering teams.
• Ensure proper documentation, incident tracking, and execution of post-incident reviews (lessons learned).

Detection, Monitoring & Improvement

• Continuously improve detection capabilities, including development and tuning of use cases and alerting rules.
• Reduce false positives while increasing detection coverage, accuracy, and operational efficiency.
• Drive onboarding of new log sources and security telemetry into SIEM and monitoring platforms.
• Promote automation and orchestration (SOAR) to improve response times and reduce manual effort.

Governance, KPIs & Reporting

• Define, track, and report on SOC KPIs such as MTTD, MTTR, alert volumes, and incident trends.
• Build and maintain dashboards and executive-level reporting for the CISO and senior leadership.
• Develop and maintain SOC playbooks, runbooks, and standard operating procedures.
• Support audits, compliance activities, and alignment with security frameworks and policies.

We expect you to have: 

• 5+ years of experience in cyber security operations, SOC, or incident response roles.
• 2+ years of experience managing or leading SOC teams (internal or MSSP).
• Hands-on experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar) and EDR/XDR tools.
• Strong understanding of incident response processes and security operations workflows.
• Experience working in cloud environments (AWS, GCP, Azure) and modern infrastructure.
• Strong analytical and problem-solving skills with high attention to detail.
• Experience working cross-functionally with Security, DevOps, IT, and Engineering teams.

It will be an added bonus if you have: 

• Experience building or scaling SOC capabilities in a growing organization.
• Familiarity with SOAR platforms and security automation.
• Knowledge of threat intelligence and threat hunting methodologies.
• Experience working within a CISO organization or Security PMO.
• Familiarity with regulatory frameworks (ISO 27001, SOC 2, NIST, etc.).
• Background in SaaS, cloud-native environments, or large-scale enterprise systems.
• BSc in Computer Science, Information Security, or a related field.

Key Responsibilities

• Lead and coordinate of security incidents across Nebius’ cloud, infrastructure, and corporate environments.
• Act as Incident Commander during major incidents, driving containment, eradication, and recovery efforts.
• Support and maintain clear incident classification, escalation, and decision-making frameworks.
• Ensure 24/7 readiness through on-call structures, runbooks, and playbooks.

• Oversee advanced incident triage and forensic investigations across:
• Cloud platforms
• Network and perimeter security
• Identity and access systems
• Supply chain and third-party risks
• Partner with SOC, Threat Intelligence, and Threat Hunting teams to improve detection fidelity and reduce MTTR.
• Ensure evidence handling meets legal, regulatory, and forensic standards.
• Lead regulatory-ready incident documentation, timelines, and root cause analysis (RCA).
• Support audits, regulatory inquiries, and executive reporting related to security incidents.

• Serve as the primary incident response interface to:
• CISO and executive leadership
• Legal, Privacy, Compliance, and Communications teams
• Infrastructure, Network, IT, Platform, and Engineering leadership
• Deliver clear, factual, and risk-based incident briefings to senior leadership.
• Support customer and partner communications when security incidents impact trust or service availability.

• Support Nebius’ incident response program, including:
• Playbooks and runbooks
• Tabletop exercises and simulations
• Red/blue/purple team coordination
• Drive lessons-learned processes and ensure findings result in measurable control improvements.
• Define and track incident response KPIs (MTTD, MTTR, containment effectiveness).

• 8+ years in cybersecurity, with significant hands-on incident response leadership experience.
• Proven experience leading large-scale, high-impact security incidents in cloud or infrastructure-heavy environments.
• Experience operating in regulated or compliance-driven environments (SOC, ISO, financial services, cloud providers, etc.).

• Strong understanding of:
• Cloud security architectures
• Network security, IAM, endpoint security, and logging pipelines
• Threat actor tactics, techniques, and procedures (MITRE ATT&CK)
• Practical experience with SIEM, SOAR, EDR, NDR, and forensic tooling.
• Ability to validate technical findings independently and challenge assumptions.

• Demonstrated ability to lead under pressure and make high-quality decisions with incomplete data.
• Clear, concise communicator capable of briefing executives and non-technical stakeholders.
• Strong cross-functional leadership skills without relying on direct authority.

The role

Nebius is looking for an execution-focused Project Manager to join the Cyber Security organization, reporting directly to the Head of PMO under the CISO.

This role is focused on driving delivery of cross-functional cyber security projects across cloud, infrastructure, SaaS, and enterprise environments. The ideal candidate is highly organized, detail-oriented, and execution-driven, with a strong ability to move initiatives forward and ensure completion.

You will work closely with security, engineering, IT, DevOps, and product teams to ensure consistent execution, remove blockers, and maintain momentum across multiple parallel initiatives.

 You’re welcome to work in our offices in Amsterdam.

Your responsibilities will include: 

Project Execution

• Drive end-to-end execution of multiple cross-functional cyber security projects, ensuring consistent progress and timely delivery.
• Translate high-level objectives into clear plans, tasks, timelines, and deliverables.
• Track day-to-day progress, dependencies, and blockers, and proactively drive resolution.
• Ensure projects are delivered on time, within scope, and aligned with security and business priorities.

Stakeholder Coordination

• Work closely with Security, IT, DevOps, Engineering, and Product teams to ensure alignment and execution.
• Facilitate ongoing communication, including status updates, meetings, and follow-ups.
• Support preparation of executive-level reporting and dashboards for the CISO and senior leadership.

Risk & Process Support

• Identify execution risks, delays, and bottlenecks, and work with stakeholders to mitigate them.
• Support prioritization efforts based on risk, business impact, and delivery constraints.
• Help improve project tracking, governance, and PMO processes.

We expect you to have: 

• 3–5 years of hands-on experience in project management.
• Experience managing technology-focused or cross-functional projects.
• Strong understanding of project management methodologies and best practices.
• Hands-on experience with project management tools such as Jira, Monday, Asana, or similar systems.
• Experience working with Agile, Scrum, or hybrid delivery models.
• Excellent written and verbal communication skills in English.
• Strong organizational skills with high attention to detail and ability to manage multiple priorities.
• Strong technological orientation with the ability to understand systems, architectures, and workflows.

It will be an added bonus if you have: 

• Experience working in a cyber security organization or on security-related projects.
• Background in SaaS, cloud infrastructure, or high-growth technology environments.
• Familiarity with security concepts such as vulnerability management, risk management, or compliance.
• BSc in Industrial Engineering and Management or a related field.

The role

Nebius is looking for an experienced Security Architect to join the Cyber Security organization, reporting to the Security Architect Manager.

This role focuses on designing and implementing secure architectures across corporate networks and cloud environments. You will play a key role in defining secure solutions, reviewing system designs, and ensuring security is embedded across enterprise infrastructure.

The ideal candidate brings strong hands-on expertise in network and cloud security, along with the ability to work closely with IT, Infrastructure, DevOps, and Engineering teams to drive secure and scalable implementations.

You’re welcome to work in our offices in Amsterdam.

Your responsibilities will include: 

• Design and implement secure architectures across corporate networks, cloud platforms, and hybrid environments.
• Define and maintain security standards, guidelines, and reference architectures aligned with organizational requirements.
• Review and approve architecture and design of new systems, infrastructure, and network changes.
• Design and support secure enterprise network architectures, including segmentation, Zero Trust, and remote access solutions.
• Define and implement controls for firewalls, ZTNA, proxies, and network access control (NAC).
• Design secure cloud architectures including IAM, networking, and workload protection.
• Ensure proper implementation of cloud security controls such as segmentation, encryption, and monitoring.
• Define and support identity and access management controls, including SSO, MFA, and privileged access.
• Contribute to endpoint security architecture, including EDR/XDR and device hardening standards.
• Identify security risks and architectural gaps and recommend mitigation strategies.
• Participate in architecture reviews, risk assessments, and security design discussions.
• Collaborate with SOC, Vulnerability Management, IT, and Engineering teams to improve overall security posture.
• Support implementation of security architecture initiatives and improvements across the organization.

We expect you to have: 

• 5+ years of experience in cyber security, with a focus on network and/or cloud security.
• Strong hands-on experience in enterprise network security (firewalls, segmentation, VPN, proxies, NAC, etc.).
• Experience working with cloud platforms (AWS, GCP, Azure) and cloud security best practices.
• Solid understanding of identity and access management (IAM), Active Directory / Entra ID, and access control models.
• Experience working in hybrid environments (on-premise + cloud).
• Strong understanding of security architecture principles and risk-based design.
• Experience working cross-functionally with IT, Infrastructure, DevOps, and Engineering teams.
• Strong analytical and problem-solving skills.

It will be an added bonus if you have: 

• Experience with Zero Trust architecture and network segmentation strategies.
• Familiarity with cloud security tools (e.g., Wiz).
• Experience with enterprise identity platforms (Entra ID / Azure AD, Okta, etc.).
• Knowledge of regulatory and compliance frameworks (ISO 27001, SOC 2, NIST, etc.).
• Experience in SaaS, cloud-native, or enterprise-scale environments.
• Relevant certifications such as CISSP, CCSP, or equivalent.
• BSc in Computer Science, Information Security, or a related field.

Position Overview: 

We are seeking a dedicated SOC Analyst to join our dynamic security team. The SOC Analyst will be responsible for monitoring, detecting, and responding to security incidents across our corporate infrastructure, SaaS platforms, data centers, and customer services. This role involves close collaboration with our MSSP partners to maintain a robust security posture as well as working with Product, R&D, IT and the different Datacentres.

Key Responsibilities:

• Security Monitoring: Continuously monitor security alerts and events across various platforms, including Office 365, corporate SaaS applications, and data centers.
• Incident Detection and Response: Identify potential security incidents, conduct initial triage, and coordinate with internal teams and MSSPs for effective response.
• Threat Analysis: Analyze security threats and vulnerabilities to assess potential impact on the organization.
• Collaboration: Work closely with MSSP partners and internal stakeholders to enhance detection capabilities and improve incident response processes.
• Documentation: Maintain detailed records of security incidents, including analysis, response actions, and lessons learned.
• Continuous Improvement: Participate in the development and refinement of SOC processes, playbooks, and procedures to enhance operational efficiency.

Qualifications:

• Education: Bachelor’s degree in Computer Science, Information Security, or a related field.
• Experience: Minimum of 2 years of experience in a SOC or similar security-focused environment.
• Technical Skills:
• Proficiency in using Security Information and Event Management (SIEM) tools.
• Familiarity with cloud security principles and experience with platforms such as Office 365 and other SaaS applications.
• Understanding of network protocols, intrusion detection systems, and incident response methodologies.
• Certifications: Relevant certifications such as CompTIA Security+, Certified Information Systems Security Professional (CISSP), or Certified Ethical Hacker (CEH) are preferred.

• Soft Skills:
• Strong analytical and problem-solving abilities.
• Excellent communication skills, both written and verbal.
• Ability to work collaboratively in a team environment.
• Attention to detail and a proactive approach to identifying and mitigating security threats.
• Fluent in English.

Role Overview

Nebius is seeking a Detection & Response Manager to lead and mature our security operations and adversary defense capabilities.

This role owns SOC operations, incident response, red teaming, and security automation (SIEM & SOAR) across cloud, data center, and enterprise environments.

The ideal candidate combines operational excellence, threat-adversary thinking, and automation-first execution.

Key Responsibilities

Security Operations Center (SOC) Leadership

• Own day-to-day SOC operations across cloud, data center, and corporate environments

• Define detection strategy aligned to Nebius threat models and crown jewels

• Ensure high-quality alerting, triage, escalation, and reporting

• Continuously reduce false positives and alert fatigue

Incident Response & Crisis Management

• Lead end-to-end incident response for high-severity security incidents

• Own incident command during crises (technical, executive, and regulatory coordination)

• Ensure post-incident reviews lead to real control improvements

• Maintain and regularly test incident response playbooks

Red Team & Adversarial Testing

• Manage red team and purple team activities (internal and external)

• Translate real-world adversary TTPs into detection and response improvements

• Ensure findings from red team exercises are remediated and verified

• Partner with product, cloud, and physical security teams on attack simulations

SOC Automation (SIEM & SOAR)

• Own SIEM and SOAR strategy, architecture, and roadmap

• Drive automation of detection, enrichment, response, and reporting

• Integrate identity, cloud, CI/CD, and physical security telemetry

• Measure SOC effectiveness using MTTD, MTTR, and coverage metrics

Threat Intelligence & Continuous Improvement

• Operationalize threat intelligence into detections and playbooks

• Track emerging threats relevant to cloud, AI, and infrastructure providers

• Continuously improve detection coverage against prioritized attack paths

What Success Looks Like (12 Months)

• Measurable reduction in MTTD and MTTR for high-severity incidents

• Majority of high-risk incidents detected internally, not externally

• Red team findings consistently detected and contained

• SOC automation meaningfully reduces manual effort

• Clear, trusted security reporting to CISO and leadership

Required Qualifications

• 7+ years in security operations, incident response, or threat detection

• Proven experience leading a SOC or incident response function

• Strong experience with SIEM and SOAR platforms

• Deep understanding of:

• Cloud security 

• Identity-based attacks and detection

• Endpoint, network, and application telemetry

• Experience running or managing red team / purple team activities

• Calm, decisive leadership under pressure

Preferred Qualifications

• Experience in cloud service providers, hyperscale, or infrastructure companies

• Familiarity with GPU / HPC environments or large-scale data centers

• Experience with DORA, SOC 2, ISO 27001 incident requirements

• Background in threat hunting or offensive security

Key Skills & Attributes

• Adversary-minded: thinks like an attacker, not a tool operator

• Automation-first mindset

• Strong communicator during crises

• Data-driven decision making

• High ownership, low ego

Why Nebius

• Defend one of the most advanced AI and GPU cloud platforms

• Influence security architecture at scale

• Operate at the intersection of cloud, physical infrastructure, and regulation

• Build a modern, high-impact detection & response function

The role

Nebius is looking for an experienced Security Architect Manager to join the Cyber Security organization, reporting to the Head of Security Engineering uner the CISO.

This role is responsible for leading the organization’s security architecture across corporate networks and cloud environments, ensuring secure design and implementation of enterprise infrastructure at scale.

The ideal candidate combines deep expertise in network and cloud security with strong leadership capabilities. You will define and drive security architecture across hybrid environments, working closely with IT, Infrastructure, Network, DevOps, and Security teams to ensure robust, scalable, and resilient security controls.

Your responsibilities will include: 

• Lead and manage the security architecture domain, including security architects and/or senior engineers.
• Define and maintain security architecture standards, guidelines, and reference designs across corporate and cloud environments.
• Act as the primary authority on enterprise security architecture across networks, identity, endpoints, and cloud platforms.
• Design and evolve secure enterprise network architectures, including segmentation, Zero Trust, and hybrid connectivity.
• Define and enforce security controls for corporate networks, data centers, and remote access solutions (ZTNA, proxies, NAC).
• Lead architecture and selection of network security technologies (e.g., firewalls, secure gateways, access control solutions).
• Lead security architecture across cloud platforms and hybrid environments.
• Define secure reference architectures for cloud networking, identity, and workload protection.
• Ensure proper implementation of cloud security controls, including IAM, segmentation, encryption, and monitoring.
• Define security architecture for endpoints and identity, including EDR/XDR, device hardening, SSO, MFA, and privileged access.
• Ensure secure baseline configurations and access control mechanisms across corporate and cloud environments.
• Identify architectural risks and security gaps and drive mitigation strategies across infrastructure and cloud environments.
• Establish and enforce architecture review processes and governance for new systems and changes.
• Collaborate with SOC, Vulnerability Management, IT, and Infrastructure teams to improve overall security posture.
• Contribute to the cyber security strategy and roadmap, including adoption of modern models such as Zero Trust.

We expect you to have: 

• 7+ years of experience in cyber security, with a strong focus on network and cloud security.
• 2+ years of experience leading or managing security architects or senior security engineers.
• Deep expertise in enterprise network security (firewalls, segmentation, VPN, proxies, NAC, etc.).
• Strong hands-on experience with cloud platforms (AWS, GCP, Azure) and cloud security best practices.
• Strong understanding of identity and access management (IAM), Active Directory / Entra ID, and privileged access controls.
• Experience securing hybrid environments (on-premise + cloud).
• Hands-on experience with enterprise security technologies (e.g., Palo Alto, Check Point, Cisco, Zscaler, CrowdStrike, Microsoft Defender).
• Strong understanding of Zero Trust architecture principles.
• Experience working cross-functionally with IT, Infrastructure, Network, DevOps, and Security teams.
• Excellent analytical, problem-solving, and communication skills in English.

It will be an added bonus if you have: 

• Experience designing and implementing Zero Trust or network segmentation programs.
• Familiarity with cloud-native security tools (e.g., Wiz, Prisma Cloud, Defender for Cloud).
• Experience with enterprise identity platforms (Entra ID / Azure AD, Okta, etc.).
• Knowledge of regulatory and compliance frameworks (ISO 27001, SOC 2, NIST, etc.).
• Experience in large-scale enterprise or high-growth environments.
• Relevant certifications such as CISSP, CCSP, or equivalent.
• BSc in Computer Science, Information Security, or a related field.

The role

Nebius is looking for a highly technical, hands-on SIEM Engineer Lead to design, implement, and optimize advanced Security Information and Event Management (SIEM) capabilities. This role is responsible for developing detection strategies, improving security visibility, and driving automation across security operations processes. The ideal candidate will combine deep SIEM expertise with strong analytical and engineering skills to enhance threat detection, incident response efficiency, and security monitoring maturity. This is not a people management position, you will provide technical guidance, mentorship, and direction to SOC analysts, security engineers, and cross-functional teams

You’re welcome to work in our offices in Tel Aviv.

Your responsibilities will include: 

• Architect, deploy, and maintain enterprise SIEM platforms and related security monitoring infrastructure.
• Develop and optimize detection rules, correlation logic, and alert mechanisms to identify security threats and anomalous activity.
• Design and implement log ingestion pipelines, normalization, and enrichment processes across diverse data sources.
• Continuously improve detection coverage by analyzing threat intelligence, attacker techniques, and emerging vulnerabilities.
• Create and maintain dashboards, reports, and metrics to support security visibility and operational decision-making.
• Drive automation of security monitoring and response workflows using scripting, APIs, and orchestration tools.
• Perform tuning and performance optimization of SIEM platforms to ensure scalability and reliability.
• Conduct threat hunting activities and support complex security investigations using SIEM data.
• Collaborate with engineering, infrastructure, and security stakeholders to integrate new log sources and telemetry.
• Develop documentation, standards, and best practices for SIEM configuration, logging, and detection engineering.
• Create APIs and interfaces that enable AI agents to query SIEM, pull evidence, and execute actions

We expect you to have: 

• 5+ years of experience in cybersecurity with strong focus on SIEM engineering or security monitoring.
• Hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, CrowdStrike, Elastic, or similar.
• Strong knowledge of log analysis,event correlation, and detection engineering.
• Experience with data pipelines, log parsing, and schema design.
• Experience with SOAR platforms and security automation.
• Experience with scripting or programming (e.g., Python, PowerShell, Bash) for automation and integrations.
• Solid understanding of network protocols, operating systems, cloud environments, and common attack techniques.
• Familiarity with frameworks such as MITRE ATT&CK, NIST, or CIS for detection mapping and security controls.
• Experience integrating threat intelligence and security tools with SIEM platforms.
• Knowledge of cloud logging and monitoring (AWS, Azure, GCP).
• Strong knowledge of Kubernetes architecture and security concepts
• Experience with Terraform, CI/CD pipelines and Detection as code workflow

It will be an added bonus if you have: 

• Experience building and deploying LLM-based AI agents
• Experience in transitioning from manual SOC to AI-augmented operations.
• Relevant security certifications
• Certification in cloud computing, including administration, development, engineering, or architecture.
• Knowledge of AI safety and reliability - guardrails, validation, human oversight mechanisms