Staff Security Detection Engineer (Machine Learning)

• We’re seeking a Staff Security Detection Engineer to build and mature SoFi’s machine learning–driven detection and anomaly detection program
• You will own the detection and model lifecycle end to end; feature engineering, model training, tuning, and validation, operating over large-scale security data lakes and streaming pipelines
• You’ll partner closely with our Security Operations Center (SOC), Security Operations Engineering, and Fraud programs to turn high-volume telemetry into high-confidence, low-noise detections at scale
• Design, build, and maintain machine learning models for anomaly detection (unsupervised clustering, time-series and seasonality baselines, isolation forests, autoencoders, risk scoring) with measurable precision/recall targets
• Operationalize models and detections from notebook to production, including enrichment, correlation, and response playbook hooks (detection-as-code, CI/CD, model versioning, and rollback)
• Engineer and tune features from identity, endpoint, network, cloud, SaaS, and application telemetry stored in the security data lake to improve model signal quality
• Partner with the SOC to triage, tune, and close detection feedback loops; use analyst dispositions as labels to retrain and improve models, reduce noise, and document runbooks
• Collaborate with Threat Intelligence, Security Architecture, and Fraud stakeholders to translate threat hypotheses and scenarios into repeatable, model-backed analytics with clear success metrics
• Establish model governance: offline and online evaluation, drift and data-quality monitoring, periodic retraining and re-baselining, explainability/traceability, and privacy-by-design controls
• Participate in root-cause and post-incident reviews to identify new signals, features, and coverage gaps; backlog and deliver the resulting models and detections
• Contribute to reference architectures, standards, and documentation for the ML detection platform, data lake, and pipelines across the security organization
• Mentor engineers and analysts on applied ML, anomaly detection, detection tuning, data quality, and pipeline reliability

Benefits

• Generous vacation and holidays
• Paid parental leave for eligible employees
• 401(k) and education on retirement planning
• Monthly contribution up to $200 to help you pay off your student loans
• Great health & well-being benefits including: telehealth parental support, subsidized gym program
• Comprehensive health, vision, dental, life insurance, and disability benefits
• Fertility and family planning options
• Flexible time off
• Free financial classes
• Tuition reimbursement on approved programs, up to $5,250 per year- Strong programming and query skills in Python and SQL, with hands-on use of the ML and data stack (e.g., pandas, scikit-learn, PyTorch or TensorFlow) for feature engineering, model training, and automation
• Working knowledge of anomaly detection techniques (statistical baselining, clustering, isolation forests, autoencoders, time-series methods) and the end-to-end model lifecycle
• Experience collaborating with SOC/DFIR and fraud/risk teams; excellent written communication for models, detections, runbooks, and stakeholder updates
• Familiarity with security frameworks and adversary tradecraft (MITRE ATT&CK, kill chain) and how they map to detectable behaviors and model features
• Solid understanding of security telemetry sources; identity and access (SSO, IGA, PAM), endpoint/EDR, network/proxy, cloud (AWS/GCP/Azure), and SaaS audit logs, and how to shape them into model features
• Ability to balance detection coverage, model precision, and operational load; metrics-driven mindset (precision/recall, false-positive rate, MTTD, alert fatigue)
• 7+ years hands-on experience building and operating machine learning models for detection or anomaly detection in production (e.g., security, fraud, or abuse), across both supervised and unsupervised approaches
• Bachelor’s degree in computer science, data science, statistics, a related field, or equivalent practical experience
• Hands-on experience with data lake and big-data technologies (e.g., Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS) for storing, transforming, and querying large-scale security telemetry
• Graph-based ML and analytics for entity relationships, risk propagation, and community detection
• MLOps practices – feature stores, model registries, experiment tracking, canary and shadow releases for reliable model deployment and retraining
• Experience building and deploying ML models on AWS (e.g., SageMaker, S3, Glue, Athena, Lambda) for training, feature pipelines, and inference
• Experience with streaming and real-time data engineering (e.g., Kafka, Kinesis, Pub/Sub, Flink, Spark Streaming) for near-real-time model scoring
• Experience applying deep learning or LLM-based approaches to security, log, or sequence data
• Experience leveraging LLMs to design, analyze, and test detections
• Relevant certifications (e.g., AWS/GCP machine learning or data engineering, Databricks, or equivalent)