Security Analyst - Tier 3

Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.

Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.

Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.

Nebius is seeking a deeply experienced Security Analyst - Tier 3 for its Security Operations Center (SOC). This role is a senior individual-contributor position, leading challenging investigations, setting the standards the SOC operates by. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office.

• Lead complex, multi-stage, multi-domain investigations end to end, from scoping through deep technical analysis to a clear determination of impact and root cause.

• Serve as the SOC's senior escalation point and the quality gate for investigations across the team.

• Support the Incident Response team during confirmed incidents with continued telemetry investigation, scoping, and analytical depth.

• Continuously sharpen how the SOC investigates, identifying gaps in methods, runbooks, and tooling through daily casework and turning them into concrete improvements.

• Mentor Tier 1 and Tier 2 analysts through case reviews, coaching, and pairing during investigations.

• Partner with Security Engineering, Platform Security, Threat Intelligence, SOC Automation, and additional teams to turn what the SOC learns into stronger detection and response across Nebius.

• Participate in readiness activities - tabletops, post-incident reviews, and purple-team engagements.

• Participate in the on-call rotation as the senior point of contact outside business hours.

• Around 8-10 years of hands-on experience in security operations or incident response, with a track record of leading complex investigations.

Technical Expertise

• Expert-level investigation capability across multiple domains: endpoint, identity, cloud, and network.

• Solid understanding of cloud-native environments, including containers, Kubernetes.

• Deep practical fluency with EDR, SIEM query languages, and log analysis.

• Deep knowledge of Windows and Linux internals, applied to artifact and behavioral analysis.

• Fluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices.

• Strong scripting and data-analysis skills (Python, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions.

• Advanced certifications such as GCIH, GCFA, GNFA, GCFE, or OSCP are an advantage.

Leadership & Communication

• Technical leadership through credibility, raising the team's bar without relying on formal