Staff Security Detection Engineer, Machine Learning

The role: 

We’re seeking a Staff Security Detection Engineer to build and mature SoFi’s machine learning–driven detection and anomaly detection program. You will own the detection and model lifecycle end to end; feature engineering, model training, tuning, and validation, operating over large-scale security data lakes and streaming pipelines. You’ll partner closely with our Security Operations Center (SOC), Security Operations Engineering, and Fraud programs to turn high-volume telemetry into high-confidence, low-noise detections at scale.

What you’ll do: 

• Design, build, and maintain machine learning models for anomaly detection (unsupervised clustering, time-series and seasonality baselines, isolation forests, autoencoders, risk scoring) with measurable precision/recall targets.
• Operationalize models and detections from notebook to production, including enrichment, correlation, and response playbook hooks (detection-as-code, CI/CD, model versioning, and rollback).
• Engineer and tune features from identity, endpoint, network, cloud, SaaS, and application telemetry stored in the security data lake to improve model signal quality.
• Partner with the SOC to triage, tune, and close detection feedback loops; use analyst dispositions as labels to retrain and improve models, reduce noise, and document runbooks.
• Collaborate with Threat Intelligence, Security Architecture, and Fraud stakeholders to translate threat hypotheses and scenarios into repeatable, model-backed analytics with clear success metrics.
• Establish model governance: offline and online evaluation, drift and data-quality monitoring, periodic retraining and re-baselining, explainability/traceability, and privacy-by-design controls.
• Participate in root-cause and post-incident reviews to identify new signals, features, and coverage gaps; backlog and deliver the resulting models and detections.
• Contribute to reference architectures, standards, and documentation for the ML detection platform, data lake, and pipelines across the security organization.
• Mentor engineers and analysts on applied ML, anomaly detection, detection tuning, data quality, and pipeline reliability.

What you’ll need: 

• 7+ years hands-on experience building and operating machine learning models for detection or anomaly detection in production (e.g., security, fraud, or abuse), across both supervised and unsupervised approaches.
• Hands-on experience with data lake and big-data technologies (e.g., Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS) for storing, transforming, and querying large-scale security telemetry.
• Strong programming and query skills in Python and SQL, with hands-on use of the ML and data stack (e.g., pandas, scikit-learn, PyTorch or TensorFlow) for feature engineering, model training, and automation.
• Solid understanding of security telemetry sources; identity and access (SSO, IGA, PAM), endpoint/EDR, network/proxy, cloud (AWS/GCP/Azure), and SaaS audit logs, and how to shape them into model features.
• Working knowledge of anomaly detection techniques (statistical baselining, clustering, isolation forests, autoencoders, time-series methods) and the end-to-end model lifecycle.
• Familiarity with security frameworks and adversary tradecraft (MITRE ATT&CK, kill chain) and how they map to detectable behaviors and model features.
• Experience collaborating with SOC/DFIR and fraud/risk teams; excellent written communication for models, detections, runbooks, and stakeholder updates.
• Ability to balance detection coverage, model precision, and operational load; metrics-driven mindset (precision/recall, false-positive rate, MTTD, alert fatigue).
• Bachelor’s degree in computer science, data science, statistics, a related field, or equivalent practical experience.

Nice to have: 

• Experience with streaming and real-time data engineering (e.g., Kafka, Kinesis, Pub/Sub, Flink, Spark Streaming) for near-real-time model scoring.
• Experience building and deploying ML models on AWS (e.g., SageMaker, S3, Glue, Athena, Lambda) for training, feature pipelines, and inference.
• MLOps practices – feature stores, model registries, experiment tracking, canary and shadow releases for reliable model deployment and retraining.
• Graph-based ML and analytics for entity relationships, risk propagation, and community detection.
• Experience applying deep learning or LLM-based approaches to security, log, or sequence data.
• Experience leveraging LLMs to design, analyze, and test detections.
• Relevant certifications (e.g., AWS/GCP machine learning or data engineering, Databricks, or equivalent).