Security Analyst - Tier 3

About Nebius:

Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.

Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.

Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.

The role

Nebius is seeking a deeply experienced Security Analyst - Tier 3 for its Security Operations Center (SOC). This role is a senior individual-contributor position, leading challenging investigations, setting the standards the SOC operates by. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office.

Your responsibilities will include:  

Lead complex, multi-stage, multi-domain investigations end to end, from scoping through deep technical analysis to a clear determination of impact and root cause.

Serve as the SOC's senior escalation point and the quality gate for investigations across the team.

Support the Incident Response team during confirmed incidents with continued telemetry investigation, scoping, and analytical depth.

Continuously sharpen how the SOC investigates, identifying gaps in methods, runbooks, and tooling through daily casework and turning them into concrete improvements.

Mentor Tier 1 and Tier 2 analysts through case reviews, coaching, and pairing during investigations.

Partner with Security Engineering, Platform Security, Threat Intelligence, SOC Automation, and additional teams to turn what the SOC learns into stronger detection and response across Nebius.

Participate in readiness activities - tabletops, post-incident reviews, and purple-team engagements.

Participate in the on-call rotation as the senior point of contact outside business hours.

We expect you to have:  

Experience

Around 8-10 years of hands-on experience in security operations or incident response, with a track record of leading complex investigations.

Technical Expertise

Expert-level investigation capability across multiple domains: endpoint, identity, cloud, and network.

Solid understanding of cloud-native environments, including containers, Kubernetes.

Deep practical fluency with EDR, SIEM query languages, and log analysis.

Deep knowledge of Windows and Linux internals, applied to artifact and behavioral analysis.

Fluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices.

Strong scripting and data-analysis skills (Python, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions.

Advanced certifications such as GCIH, GCFA, GNFA, GCFE, or OSCP are an advantage.

Leadership & Communication

Technical leadership through credibility, raising the team's bar without relying on formal authority.

Calm and structured during high-severity incidents, making sound decisions amid uncertainty.

Excellent written communication, turning complex investigations to clear narratives others can act on.

Fluent in English, written and verbal, comfortable working with international teams and stakeholders.

Benefits & Perks:

Competitive compensation

Career growth and learning opportunities

Flexibility and ownership

Collaborative and innovative culture

Opportunity to work on impactful AI projects

International environment and talented teams

What's it like to work at Nebius:

Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI 

Equ …