The Role

We are building a real-time threat intelligence platform from the ground up. This is a zero-to-one initiative focused on streaming critical security data to enterprise teams at scale. As an SWE-2 on this team, you won't just be executing on a roadmap, you'll be helping us find the problems that aren't on it yet. We are looking for a backend engineer with a builder mindset who thrives in an environment where they can take ownership and help define the technical path forward.

What You Will Do

• Build & Scale: Develop and maintain high-performance backend services using Python or Golang.
• Stream Real-Time Data: Build and optimize streaming architectures to handle live threat intelligence with low latency.
• Search & Indexing: Implement and tune OpenSearch/Elasticsearch layers to ensure massive datasets are searchable and actionable.
• Define the "How": Take high-level goals and translate them into technical specs and clean, maintainable code.
• Cloud Ownership: Manage your own deployments and infrastructure within AWS/EKS.
• AI-Augmented Development: Use AI tools to speed up development cycles and automate routine backend tasks.
• Collaborative Innovation: Work closely with the team to identify architectural gaps and proactively suggest improvements.

Must Haves

Nice to Have

• Frontend Basics: Familiarity with React/TypeScript for building internal tools or data visualizations.
• Security Context: An interest in cybersecurity or experience working with security data.
• Tooling: Experience using modern AI productivity tools to increase engineering velocity.

Education

Bachelor of Science degree in Computer Science, Applied Sciences, Information Systems, or a closely related engineering field.

About The Role

Abnormal AI is looking for a Machine Learning Engineer to join the Message Detection - Attack Detection team.  At Abnormal, we protect our customers against nefarious adversaries who are constantly evolving their techniques and tactics to outwit and undermine the traditional approaches to Security. That’s what makes our novel behavioral-based approach so…Abnormal. Abnormal has constantly been named as one of the top cybersecurity startups and our behavioral AI system has helped us win various cybersecurity accolades resulting in being trusted to protect more than 25% of the Fortune 500 ( and ever growing ).

In a landscape where a single successful attack can lead to financial losses of millions of dollars, the Attack Detection team plays the central role of building an extremely high recall Detection Engine that can operate on hundreds of millions of messages at milliseconds latency. The Attack Detection team’s mission statement is to provide world-class detector efficacy to tackle changing attack landscape using a combination of generalizable and auto trained models as well as specific detectors for high value attack categories.

This team is solving a multi-layered detection problem, which involves modeling communication patterns to establish enterprise-wide baselines, incorporating these patterns as robust signals, and combining these signals with contextual information to create extremely precise systems. The team builds discriminative signals at various levels including message level (eg. presence of particular phrases), sender-level (eg.frequency of sender) and recipient level (eg.likelihood of receiving a safe message). These signals are then combined and utilized to train highly accurate model based as well as heuristic detectors. Additionally,  to continuously adapt to new unseen attacks, the team builds out different stages in our automated model retraining pipelines including data analytics and generation stages, modeling stages, production evaluation stages as well as automated deployment stages.

This role would also have an opportunity to have a significant impact on the overall charter, direction and roadmap of the team. The Machine Learning Engineer would be involved in understanding the domain of false negatives i.e. the current and future attacks which can cause significant customer workflow disruption. They would help define the technical roadmap required to address the most pressing customer problems and simultaneously operate our detection decisioning system at an extremely high recall.

What You Will Do 

• Design and implement systems that combine rules, models, feature engineering, and business and product inputs into an email detection product, with senior engineer guidance.
• Understand features that distinguish safe emails from email attacks, and how our model stack enables us to catch them. 
• Identify and recommend new features groups or ML model approaches that can significantly improve detection efficacy for a product. Work with infrastructure & systems engineers to productionize  signals to feed into the detection system.
• Writes code with testability, readability, edge cases, and errors in mind.
• Train models on well-defined datasets to improve model efficacy on specialized attacks
• Actively monitor and improve FN rates and efficacy rates for our message detection product attack categories, through  feature engineering, rules and ML modeling.
• Analyze FN and FP datasets to categorize capability gaps and recommend short term feature and rule ideas to improve our detection efficacy.
• Contribute in other areas of the stack: building and debugging data pipelines, or presenting results back to customers in our tools when the occasion arises

Must Have

• 3+ years experience designing, building and deploying machine learning applications in one of the domains of text understanding, entity recognition, NLP experience, computer vision, recommendation systems, or search.
• 1+ years of experience with writing stable and production level pipelines for model training and evaluation leading to reproducible models and metrics.
• Experience with data analytics and wielding SQL+pandas+spark framework to both build data and metric generation pipelines, and answer critical questions about system efficacy or counterfactual treatments.
• Ability to understand business requirements thoroughly and bias toward designing a simplest yet generalizable ML model / system that can accomplish the goal.
• Uses a systematic approach to debug both data and system issues within ML / heuristics models.
• Fluent with Python and machine learning toolkits like numpy, sklearn, pytorch and tensorflow.
• Effective software engineering skills who can find answers quickly from code base and writes structured, readable, well tested and efficient code.
• BS degree in Computer Science, Applied Sciences, Information Systems or other related engineering field

Nice To Have 

• MS degree in Computer Science, Electrical Engineering or other related engineering field
• Experience with big data, statistics and Machine Learning
• Experience with algorithms and optimization

This position is not: 

• A role focused on optimizing existing machine learning models 
• A research-oriented role that's two-steps removed from the product or customer
• A statistics/data science meets ML role

#LI-RT1

What you will do

• Architect & Scale: Design and maintain high-throughput detection systems and backend services, ensuring low latency and high reliability.
• Data Orchestration: Lead the development of robust data pipelines using Spark and Airflow to supply detection teams with high-fidelity data for ML model training and evaluation.
• Technical Leadership: Partner with Engineering Managers to define technical roadmaps, mentor junior/mid-level engineers, and drive best practices in code quality and system design.
• AI-Driven Innovation: Lead the team in adopting AI productivity initiatives, leveraging tools like Claude, OpenAI, and GitHub Copilot to accelerate the development lifecycle and automate internal workflows.
• Cross-functional Collaboration: Work closely with TPMs, Product Managers, Data Scientists, and Security Researchers to translate complex business needs into scalable technical solutions.
• Operational Excellence: Manage and optimize cloud-native infrastructure on AWS/EKS, ensuring systems are cost-effective, secure, and performant.

Must Haves

• 8+ years of professional experience: Proven track record in production-level backend development with Python or Golang.
• Data Engineering Expertise: Expert-level proficiency in building and optimizing distributed data pipelines using Spark and Airflow (or equivalent orchestration tools).
• Cloud & Infrastructure: Extensive experience managing and scaling cloud-native applications on AWS (highly preferred), GCP, or Azure, with a proven track record of hands-on container orchestration using EKS.
• Leadership & Mentorship: Experience leading technical projects, mentoring engineers, and contributing to the long-term technical strategy of a team.
• System Design: Strong ability to design complex integrations and handle significant throughput/latency challenges.
• Problem Solving: A methodical approach to performance debugging, benchmarking, and resolving bottlenecks in large-scale systems.
• Database Proficiency: Strong experience with Postgres or similar relational databases at scale.
• Education: BS in Computer Science, Applied Sciences, or a related engineering field.

Nice to Haves

• Frontend Literacy: Familiarity with React and TypeScript to assist with internal tool visualizations.
• Data Ecosystems: Experience with Databricks, Snowflake, or similar data lakehouse architectures.
• Cybersecurity Domain: Background in threat detection, network security, or fraud prevention.
• Advanced Degrees: MS in Computer Science or Electrical Engineering.

#LI-AB2