Senior Machine Learning Engineer (Security)
Proton is hiring a Senior Machine Learning Engineer for its Security team to transform the Security Operations Center (SOC) from reactive to proactive. The role integrates machine learning and data-driven approaches into detection and response workflows, automatically identifying emerging threats, anomalous behaviour, and new attack patterns at scale. A secondary focus is leveraging LLMs and AI engineering to automate analyst workflows and reduce operational toil, working closely with the internal Machine Learning team.
Responsibilities
- ▹Design, develop, and deploy ML models to enhance security detection, anomaly identification, and incident response
- ▹Integrate ML outputs into the SOC workflow for smarter and faster triage
- ▹Continuously evaluate and tune models to reduce false positives and improve precision
- ▹Build and maintain data pipelines to transform security data (logs, network traffic, endpoint events) into ML-ready datasets
- ▹Explore and build LLM-powered tools to automate repetitive SOC tasks such as alert triage, evidence gathering, and report generation
- ▹Apply guardrails and evaluation to keep outputs accurate, auditable, and safe
- ▹Prototype and test new ML and AI techniques such as unsupervised anomaly detection and graph-based threat correlation
- ▹Deploy models into production securely, with monitoring, alerting, and retraining mechanisms
Requirements
- ▹Proven experience in machine learning engineering or data science, ideally in a cybersecurity or operations context
- ▹Proficiency in Python with strong knowledge of ML frameworks
- ▹Experience with data manipulation and analysis using Pandas, NumPy or similar tools
- ▹Familiarity with security data sources (SIEM logs, EDR telemetry, network flow, authentication logs)
- ▹Solid understanding of the ML lifecycle: data preparation, training, evaluation, deployment, and monitoring
- ▹Experience with data pipelines and storage technologies (Airflow, Kafka, Redis, Elasticsearch, Clickhouse)
- ▹Ability to work independently and collaborate with both ML and security specialists
Nice to have
- ▹Prior experience in threat detection, SOC operations, or security automation
- ▹Knowledge of adversarial ML, graph analytics, or behavioral modeling in security contexts
- ▹Experience integrating ML models into SIEM pipelines or automated detection frameworks
- ▹Exposure to LLMs and AI engineering (prompt engineering, RAG, agent design) and awareness of LLM-specific risks like prompt injection and data leakage
Soft skills
What we offer
- ▹Stock options from day one
- ▹Hardware and software needed to do your best work
- ▹Learning and development support
- ▹Strong health coverage, retirement options, generous leave, and wellness support
- ▹In-person collaboration in offices across Geneva, Zurich, Barcelona, London and more
- ▹Lunch and snacks provided in the offices
- ▹Transport coverage
- ▹Flexible working hours
About the company
Proton was founded in 2014 by CERN scientists and provides free, open-source privacy technology (Proton Mail, VPN, Calendar, Drive, Pass) to over 100 million accounts. It is profitable, does not rely on VC funding, and employs over 500 people across 50+ countries. Hiring is highly selective, with less than 1% of candidates hired.