Machine Learning Engineer — Cybercrime Detection in Production

Spectrum Equity; Manchester; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

33 days annual leave

Enhanced family leave

Private health cover

Hybrid and flexible working

Learning & Development days

Job summary

Netcraft is the global leader in cybercrime detection and disruption, tackling phishing and other online scams. We’re based in the UK and operate from London and Manchester, with flexible hybrid options.

You’ll join a team applying ML to real adversarial problems, deploying models to production and driving automated blocking and takedowns at scale. You’ll work across the full lifecycle: training models, serving on GPU-backed Kubernetes clusters, and evolving classifiers with live attack data.

Qualifications

• Strong web fundamentals and understanding of how websites work from request to rendered page.
• Working understanding of machine learning fundamentals: training, evaluation, overfitting, precision/recall.

Responsibilities

• Building, evaluating and tuning classifiers to decide what gets blocked and taken down.
• Deploying and operating model serving infrastructure on Kubernetes, including LLM inference.
• Optimising models for high-volume, low-cost serving.
• Running experiments against live data and measuring precision, recall, and false positives.

Skills

Web fundamentals

ML fundamentals

Communication skills

Empirical mindset

Go programming

Perl (asynchronous)

Attention to detail

Tools

Kubernetes

vLLM / LLM inference

Job description

Netcraft is the global leader in cybercrime detection and disruption, tackling phishing and other online scams. We’re based in the UK and operate from London and Manchester, with flexible hybrid options.

You’ll join a team applying ML to real adversarial problems, deploying models to production and driving automated blocking and takedowns at scale. You’ll work across the full lifecycle: training models, serving on GPU-backed Kubernetes clusters, and evolving classifiers with live attack data.