DFIR Expert

The role

Nebius is seeking a deeply technical DFIR Expert for its Digital Forensics and Incident Response (DFIR) team, working alongside the Security Operations Center (SOC). This role is a senior hands-on responder position, executing containment, eradication, and recovery on declared incidents and conducting the forensic investigations behind them, upholding the standards the DFIR team operates by.

This role reports to the DFIR Lead, under the Detection and Response function within the CISO Office.

Your responsibilities will include:

• Execute the technical response to major incidents from escalation through to recovery, in partnership with and under the direction of the DFIR Lead.
• Conduct end-to-end forensic investigations across cloud, platform, and endpoint environments.
• Handle evidence to a standard that meets legal, regulatory, and forensic requirements, including chain- of-custody discipline.
• Receive incident handoffs from the SOC and lead the response while the SOC continues to support the investigation.
• Produce post-incident deliverables: technical reports, root cause analyses (RCA), and regulatory-ready documentation.
• Contribute to DFIR runbooks, tooling selection and maturation, and readiness exercises (tabletops and simulations).
• Drive lessons-learned into measurable improvements in controls, detection fidelity, and response readiness together with the SOC, Security Engineering, and Threat Intelligence teams.
• Raise the wider team's forensic capability through case walkthroughs and mentoring of SOC analysts, and participate in the DFIR on-call rotation, acting as the response point of contact outside business hours.

We expect you to have:

Experience

• Around 5 years of hands-on digital forensics and incident response (DFIR) experience, including significant technical roles in large-scale, high-impact incidents (ransomware, advanced threat actors, cloud intrusions, identity compromise).
• Experience responding to incidents in cloud or infrastructure-heavy environments.

Technical Expertise

• Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability.
• Cloud and container forensics: acquiring and analyzing evidence from cloud control planes, Kubernetes workloads, and identity systems.
• Fluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices.
• Hands-on experience with EDR, SIEM, and forensic tooling such as Velociraptor, Volatility, and X-Ways or EnCase.
• Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions.
• Malware triage capability sufficient to characterize behavior, extract indicators, and inform containment decisions.
• Certifications such as GCFE, GCFA, GNFA, GCFR, or GREM are an advantage.

Leadership & Communication

• Composed and decisive under incident pressure, with the ability to take clear response actions.
• Rigorous about evidence and intellectually honest: findings are validated and assumptions are labeled.
• Clear, concise communicator, able to brief technical peers and the DFIR Lead as readily as Legal, Privacy, and executive stakeholders.
• A genuine partner to the SOC, sharing context freely and respecting the investigation that came before the handoff.
• Fluent in English, written and verbal, comfortable working with international teams and stakeholders.