Staff ML Application Engineer

Dragos; United States; On-site; USD 100,000 - 130,000; Full time

Benefits offered by this job

Competitive equity package

Job summary

Dragos is seeking a Machine Learning Application Engineer to enhance product pipelines with ML-driven capabilities in ICS/OT cybersecurity. The role requires strong Python skills and experience with ML techniques, focusing on delivering reliable and useful data outputs.

The ideal candidate will work alongside AI Engineers and Data Engineers to apply established ML methods for analyzing network behaviors and classifying assets effectively. Experience in the cybersecurity domain is a plus but not mandatory.

Qualifications

• 4+ years of software engineering experience with ML outputs or data pipelines.
• Strong Python skills with SQL proficiency and reason about data at scale.
• Hands-on experience applying clustering, classification, and anomaly detection.

Responsibilities

• Apply clustering, classification, and anomaly detection to ICS/OT cybersecurity data.
• Integrate ML model outputs into existing data pipelines.
• Communicate clearly about model outputs and uncertainties.

Skills

Python

SQL

Machine Learning Techniques

Data Pipeline Concepts

Cybersecurity Knowledge

Tools

scikit-learn

Docker

Kubernetes

Job description

Dragos is on a relentless mission to defend industrial organizations that provide the necessities of modern civilization—running water, functioning electricity, and safe industrial working environments. As the market leader in ICS/OT cybersecurity, we arm our customers with best‑in‑class technology, threat intelligence, and services to protect their systems effectively and efficiently.

About the Role

We are looking for a Machine Learning Application Engineer to join our Engineering team. The role sits between data engineering and applied ML. You will take existing model types and integrate them into our product and data pipelines. You won’t train models from scratch or manage ML infrastructure, but you will decide which techniques fit which problems and make the outputs reliable and useful.

You’ll work closely with AI Engineers, Data Engineers, and product teams to bring ML‑driven capabilities—such as clustering network behaviors, classifying assets, and surfacing anomalies—into the Dragos platform.

Responsibilities

• Apply clustering, classification, anomaly detection, and other established ML techniques to cybersecurity data problems in the ICS/OT domain.
• Integrate ML model outputs into existing data pipelines and product workflows, supporting batch and near‑real‑time processing patterns.
• Understand model behavior and translate research outputs into reliable pipeline components.
• Work with Data Engineers to ensure ML‑driven stages of the pipeline have clear data contracts, appropriate observability, and sane failure modes.
• Evaluate open‑source and third‑party models for fit against specific use cases, knowing when to apply an existing tool versus when to move to a model‑building effort.
• Write clean, maintainable Python or Rust that other engineers can reason about, test, and extend.
• Troubleshoot ML component behavior in production to diagnose issues with output quality, data drift, or unexpected edge cases.
• Communicate clearly about what a model is doing, where it is uncertain, and how its outputs should (and shouldn’t) be used downstream.

Qualifications

• 4+ years of software engineering experience, with meaningful time spent working with ML outputs or data pipelines in a production context.
• Strong Python skills; SQL proficiency; comfort reading and reasoning about data at scale.
• Hands‑on experience applying ML techniques including clustering (k‑means, DBSCAN, hierarchical), classification, and anomaly detection.
• Familiarity with scikit‑learn and the surrounding Python ML ecosystem; you don’t need to have implemented a neural net, but you should know how to use one responsibly.
• Solid understanding of data pipeline concepts: how data flows, where it gets transformed, what can go wrong, and how to make failures visible.
• Ability to evaluate whether a model’s outputs are actually trustworthy for a given use case—not just whether accuracy metrics look good.
• Strong written and verbal communication; comfortable explaining trade‑offs to both technical and non‑technical stakeholders.
• Cybersecurity domain knowledge—especially around threat detection, network behavior, or ICS/OT operations—is a meaningful plus, but not a prerequisite.

Nice to Have

• Experience working with graph‑based representations of network topology or asset relationships.
• Familiarity with stream‑processing or event‑driven architectures.
• Exposure to containerized environments (Docker, Kubernetes) as a consumer/deployer, not necessarily an operator.

Compensation

• Competitive equity package.

Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis prohibited under federal, state, or local laws. All new hires must pass a background check as a condition of employment.