Staff Security Detection Engineer, Machine Learning

SoFi; San Francisco (CA); On-site; USD 180,000 - 250,000; Full time

Job summary

SoFi is seeking a Staff Security Detection Engineer to design and mature our ML-driven detection program. You will own the model lifecycle, from feature engineering to production rollout, working with SOC, Fraud, and security teams to deliver high-confidence detections at scale.

In this role you will influence data lake telemetry, develop novel anomaly detection techniques, and ensure governance, explainability, and privacy-by-design in every deployment, while mentoring engineers across the

Qualifications

• 7+ years hands-on experience building and operating ML models for detection or anomaly detection in production (security, fraud, or abuse).
• Experience with data lake / big-data tech (Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS).
• Strong programming and query skills in Python and SQL with ML stack (pandas, scikit-learn, PyTorch or TensorFlow).
• Understanding of security telemetry sources (SSO, IGA, PAM, EDR, cloud logs) and how to shape them into features.
• Knowledge of anomaly detection techniques and model lifecycle from development to deployment.
• Familiarity with MITRE ATT&CK and related threat frameworks.
• Experience collaborating with SOC/DFIR and fraud teams; strong written communication.

Responsibilities

• Design, build, and maintain ML models for anomaly detection with measurable targets.
• Operationalize models from notebook to production with CI/CD and model versioning.
• Engineer features from identity, endpoint, network, cloud telemetry for signal quality.
• Collaborate with SOC to tune detections and retrain models using feedback.
• Translate threat hypotheses into model-backed analytics with clear metrics.
• Establish model governance including drift monitoring and explainability.

Skills

Anomaly detection

ML model development

Python

SQL

Big data / data lake

Model governance / drift monitoring

Problem solving

Communication

Security telemetry

MITRE ATT&CK knowledge

Education

Bachelor’s degree in computer science, data science, statistics, a related field, or equivalent practical experience

Tools

Snowflake

Databricks

Spark

Delta/Iceberg

S3

GCS

AWS/GCP/Azure

SageMaker

Job description

Who we are:

Shape a brighter financial future with us.

Employee Applicant Privacy Notice

Who we are: Shape a brighter financial future with us. Together with our members, we’re changing the way people think about and interact with personal finance. We’re a next-generation financial services company and national bank using innovative, mobile-first technology to help our millions of members reach their goals. The industry is going through an unprecedented transformation, and we’re at the forefront. We’re proud to come to work every day knowing that what we do has a direct impact on people’s lives, with our core values guiding us every step of the way. Join us to invest in yourself, your career, and the financial world.

The role:

We’re seeking a Staff Security Detection Engineer to build and mature SoFi’s machine learning–driven detection and anomaly detection program. You will own the detection and model lifecycle end to end; feature engineering, model training, tuning, and validation, operating over large-scale security data lakes and streaming pipelines. You’ll partner closely with our Security Operations Center (SOC), Security Operations Engineering, and Fraud programs to turn high-volume telemetry into high-confidence, low-noise detections at scale.

What you’ll do:

• Design, build, and maintain machine learning models for anomaly detection (unsupervised clustering, time-series and seasonality baselines, isolation forests, autoencoders, risk scoring) with measurable precision/recall targets.
• Operationalize models and detections from notebook to production, including enrichment, correlation, and response playbook hooks (detection-as-code, CI/CD, model versioning, and rollback).
• Engineer and tune features from identity, endpoint, network, cloud, SaaS, and application telemetry stored in the security data lake to improve model signal quality.
• Partner with the SOC to triage, tune, and close detection feedback loops; use analyst dispositions as labels to retrain and improve models, reduce noise, and document runbooks.
• Collaborate with Threat Intelligence, Security Architecture, and Fraud stakeholders to translate threat hypotheses and scenarios into repeatable, model-backed analytics with clear success metrics.
• Establish model governance: offline and online evaluation, drift and data-quality monitoring, periodic retraining and re-baselining, explainability/traceability, and privacy-by-design controls.
• Participate in root-cause and post-incident reviews to identify new signals, features, and coverage gaps; backlog and deliver the resulting models and detections.
• Contribute to reference architectures, standards, and documentation for the ML detection platform, data lake, and pipelines across the security organization.
• Mentor engineers and analysts on applied ML, anomaly detection, detection tuning, data quality, and pipeline reliability.

What you’ll need:

• 7+ years hands-on experience building and operating machine learning models for detection or anomaly detection in production (e.g., security, fraud, or abuse), across both supervised and unsupervised approaches.
• Hands-on experience with data lake and big-data technologies (e.g., Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS) for storing, transforming, and querying large-scale security telemetry.
• Strong programming and query skills in Python and SQL, with hands-on use of the ML and data stack (e.g., pandas, scikit-learn, PyTorch or TensorFlow) for feature engineering, model training, and automation.
• Solid understanding of security telemetry sources; identity and access (SSO, IGA, PAM), endpoint/EDR, network/proxy, cloud (AWS/GCP/Azure), and SaaS audit logs, and how to shape them into model features.
• Working knowledge of anomaly detection techniques (statistical baselining, clustering, isolation forests, autoencoders, time-series methods) and the end-to-end model lifecycle.
• Familiarity with security frameworks and adversary tradecraft (MITRE ATT&CK, kill chain) and how they map to detectable behaviors and model features.
• Experience collaborating with SOC/DFIR and fraud/risk teams; excellent written communication for models, detections, runbooks, and stakeholder updates.
• Ability to balance detection coverage, model precision, and operational load; metrics-driven mindset (precision/recall, false-positive rate, MTTD, alert fatigue).
• Bachelor’s degree in computer science, data science, statistics, a related field, or equivalent practical experience.

Nice to have:

• Experience with streaming and real-time data engineering (e.g., Kafka, Kinesis, Pub/Sub, Flink, Spark Streaming) for near-real-time model scoring.
• Experience building and deploying ML models on AWS (e.g., SageMaker, S3, Glue, Athena, Lambda) for training, feature pipelines, and inference.
• MLOps practices – feature stores, model registries, experiment tracking, canary and shadow releases for reliable model deployment and retraining.
• Graph-based ML and analytics for entity relationships, risk propagation, and community detection.
• Experience applying deep learning or LLM-based approaches to security, log, or sequence data.
• Experience leveraging LLMs to design, analyze, and test detections.
• Relevant certifications (e.g., AWS/GCP machine learning or data engineering, Databricks, or equivalent).

Compensation And Benefits

The base pay range for this role is listed below. Final base pay offer will be determined based on individual factors such as the candidate’s experience, skills, and location. To view all of our comprehensive and competitive benefits, visit our Benefits at SoFi page!

SoFi provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion (including religious dress and grooming practices), sex (including pregnancy, childbirth and related medical conditions, breastfeeding, and conditions related to breastfeeding), gender, gender identity, gender expression, national origin, ancestry, age (40 or over), physical or medical disability, medical condition, marital status, registered domestic partner status, sexual orientation, genetic information, military and/or veteran status, or any other basis prohibited by applicable state or federal law.

The Company hires the best qualified candidate for the job, without regard to protected characteristics.

Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

New York applicants: Notice of Employee Rights.

SoFi is committed to an inclusive culture. As part of this commitment, SoFi offers reasonable accommodations to candidates with physical or mental disabilities. If you need accommodations to participate in the job application or interview process, please let your recruiter know or email [e-mail].

Due to insurance coverage issues, we are unable to accommodate remote work from Hawaii or Alaska at this time.