Get more replies from employers
Send a job-specific resume in minutes.
Forge is seeking an hands-on Machine Learning Engineer to own the classical ML powering the detection and triage layer for OT environments. You will build models that score alerts, classify assets, and separate real threats from noise, running locally on air‑gapped appliances.
You will design adaptive ML systems that learn on the edge, evolving over time based on traffic patterns and analyst feedback, and you’ll stand up a self‑hosted MLOps stack for experiment tracking and model management.
We are hiring a hands‑on Machine Learning Engineer to own the classical ML powering Forge’s detection and triage layer. Forge protects critical Operational Technology (OT) and industrial control environments.
In this individual contributor role, you will build and tune models that score and prioritize security alerts, classify OT assets, and separate real threats from noise—all running directly on local, air‑gapped appliances.
Because every deployment operates in a unique, isolated OT environment without access to cloud MLOps services, our models can't be static artifacts shipped once. You will build adaptive machine learning systems that learn on the edge, evolving over time based on local traffic patterns and analyst feedback.
Alert Triage & Scoring: Build and tune XGBoost and gradient boosting models to rank security alerts, drastically cutting false positives and surfacing genuine incidents for analysts.
Adaptive & Online Learning: Design models that adapt to individual site environments over time using incremental learning, concept drift detection, and human-in-the-loop feedback.
Asset & Device Classification: Expand our Equipment Type Inference capabilities using tree ensembles and clustering to profile industrial devices from raw network fingerprint data.
Custom Anomaly Detection: Implement Isolation Forests, one‑class methods, and autoencoders alongside our OpenSearch layer to catch threats that static rules miss.
Risk Scoring: Refine features and models to ensure Forge’s risk scoring accurately reflects real operational exposure.
Production Pipelines: Build reproducible, version‑controlled feature engineering, training, and evaluation pipelines that move beyond standard notebooks.
Self-Hosted MLOps: Stand up and run a self-hosted MLflow setup for experiment tracking, model registry, and promotion of vetted models to production.
On‑Device Model Lifecycle: Package models to run seamlessly within the appliance Docker stack, complete with evaluation gates, drift monitoring, and controlled on‑device retraining.
4+ years of hands‑on experience building and shipping machine learning systems in production.
Gradient Boosting Expertise: Strong Python fluency with deep experience in XGBoost, LightGBM, or CatBoost.
Classical ML & Anomaly Toolkit: Solid grounding in scikit‑learn, tree ensembles, clustering, anomaly detection (Isolation Forests, autoencoders), and selective deep learning.
Adaptive ML Experience: Practical experience with online/incremental learning, concept drift, and active learning/feedback loops.
ML Pipelines & MLOps: Proficiency with pipeline orchestrators (Airflow, Prefect, Dagster, or Kubeflow), data/model versioning (DVC), and model tracking (MLflow).
Imbalanced Data Expertise: Deep familiarity with rare‑event metrics (Precision, Recall, PR curves, calibration) rather than raw accuracy.
Telemetry Data: Comfort working with large volumes of structured logs and network telemetry.
Exposure to OT,ICS, or SCADA security, industrial protocols , or the Purdue model.
Experience with OpenSearch or ES machine learning capabilities.
Background deploying ...