About the role

ML Detection Engineers build the models that let our agentic SOC see what signature-based tools miss. You will engineer features from identity, endpoint, and cloud telemetry, train and tune detection models, and operationalize them as detection-as-code that runs at scale.

You will work shoulder-to-shoulder with SOC analysts and threat researchers, closing the loop between what attackers actually do and what our models learn to catch.

Key Responsibilities

Develop and tune ML models for anomaly and threat detection
Engineer features from identity, endpoint, network, and cloud telemetry
Reduce false positives while preserving detection coverage
Operationalize models through detection-as-code pipelines
Partner with the SOC to measure and improve detection effectiveness

Requirements

Bachelor's or Master's in CS, ML, or a related field
4+ years in ML engineering, ideally applied to security
Strong Python and experience with modern ML frameworks
Understanding of attacker TTPs and security telemetry
Experience deploying and monitoring models in production

Nice to have

Experience with streaming data and real-time inference
Familiarity with SIEM/data-lake architectures
Knowledge of adversarial ML and model evasion