Staff ML Security Detection Engineer

SoFi; San Francisco (CA); On-site; USD 180,000 - 250,000; Full time

Job summary

SoFi is seeking a Staff Security Detection Engineer to design and mature our ML-driven detection program. You will own the model lifecycle, from feature engineering to production rollout, working with SOC, Fraud, and security teams to deliver high-confidence detections at scale.

In this role you will influence data lake telemetry, develop novel anomaly detection techniques, and ensure governance, explainability, and privacy-by-design in every deployment, while mentoring engineers across the

Qualifications

• 7+ years hands-on experience building and operating ML models for detection or anomaly detection in production (security, fraud, or abuse).
• Experience with data lake / big-data tech (Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS).
• Strong programming and query skills in Python and SQL with ML stack (pandas, scikit-learn, PyTorch or TensorFlow).
• Understanding of security telemetry sources (SSO, IGA, PAM, EDR, cloud logs) and how to shape them into features.
• Knowledge of anomaly detection techniques and model lifecycle from development to deployment.
• Familiarity with MITRE ATT&CK and related threat frameworks.
• Experience collaborating with SOC/DFIR and fraud teams; strong written communication.

Responsibilities

• Design, build, and maintain ML models for anomaly detection with measurable targets.
• Operationalize models from notebook to production with CI/CD and model versioning.
• Engineer features from identity, endpoint, network, cloud telemetry for signal quality.
• Collaborate with SOC to tune detections and retrain models using feedback.
• Translate threat hypotheses into model-backed analytics with clear metrics.
• Establish model governance including drift monitoring and explainability.

Skills

Anomaly detection

ML model development

Python

SQL

Big data / data lake

Model governance / drift monitoring

Problem solving

Communication

Security telemetry

MITRE ATT&CK knowledge

Education

Bachelor’s degree in computer science, data science, statistics, a related field, or equivalent practical experience

Tools

Snowflake

Databricks

Spark

Delta/Iceberg

S3

GCS

AWS/GCP/Azure

SageMaker

Job description

SoFi is seeking a Staff Security Detection Engineer to design and mature our ML-driven detection program. You will own the model lifecycle, from feature engineering to production rollout, working with SOC, Fraud, and security teams to deliver high-confidence detections at scale.

In this role you will influence data lake telemetry, develop novel anomaly detection techniques, and ensure governance, explainability, and privacy-by-design in every deployment, while mentoring engineers across the