At Proton, privacy is considered a fundamental human right and the cornerstone of democracy. Since 2014, Proton has provided free and open-source technology to millions worldwide, ensuring access to privacy, security, and freedom online. The company began with Proton Mail and has expanded to include Proton VPN, Proton Calendar, Proton Drive, and Proton Pass, empowering individuals and organizations to control their personal data and defeat censorship. Proton supports over 100 million user accounts with a growing team of over 500 people from more than 50 countries. The company values intelligence, learning potential, ambition, and adaptability, maintaining a flat structure to move fast and avoid unnecessary politics.
Tasks
- Design, develop, and deploy machine learning models to enhance security detection, anomaly identification, and incident response.
- Integrate ML outputs into the SOC workflow to enable smarter and faster triage.
- Continuously evaluate and tune models to reduce false positives and improve detection precision.
- Ensure model outputs are interpretable and actionable for SOC analysts.
- Build and maintain data pipelines to collect, process, and transform security-relevant data into ML-ready datasets.
- Collaborate with the security engineering team to ensure scalable and secure data handling.
- Explore and build LLM-powered tools to automate repetitive SOC tasks such as alert triage, evidence gathering, incident summarisation, and report generation.
- Apply appropriate guardrails and evaluation to ensure outputs are accurate, auditable, and safe to act on in operational contexts.
- Stay current on advancements in security data science, adversarial ML, and automated threat detection.
- Prototype and test new ML and AI techniques, such as unsupervised anomaly detection and graph-based threat correlation.
- Contribute to improving detection content through statistical analysis and clustering.
- Deploy models into production securely and responsibly, ensuring reliability and scalability.
- Implement monitoring, alerting, and retraining mechanisms for deployed ML models.
- Document methodologies and performance metrics for auditability and knowledge sharing.
Requirements
- Proven experience in machine learning engineering or data science, ideally in a cybersecurity or operations context.
- Proficiency in Python, with strong knowledge of ML frameworks.
- Experience with data manipulation and analysis using Pandas, NumPy or similar tools.
- Familiarity with security data sources such as SIEM logs, EDR telemetry, network flow, and authentication logs.
- Solid understanding of the ML lifecycle: data preparation, model training, evaluation, deployment, and monitoring.
- Experience with data pipelines and storage technologies such as Airflow, Kafka, Redis, Elasticsearch, Clickhouse, etc.
- Ability to work independently and collaborate effectively with both ML and security specialists.
- Prior experience in threat detection, SOC operations, or security automation is preferred.
- Knowledge of adversarial ML, graph analytics, or behavioral modeling in security contexts is preferred.
- Experience integrating ML models into SIEM pipelines or automated detection frameworks is preferred.
- Exposure to LLMs and AI engineering, such as prompt engineering, RAG, agent design, and awareness of LLM-specific risks like prompt injection and data leakage, is preferred.
Benefits
- Work that impacts millions of people who trust Proton with their privacy.
- Access to the right hardware and software to do your best work.
- Investment in learning and development, with real challenges and ownership from day one.
- Strong health coverage, solid retirement options, generous leave, and wellness support.
- Stock options, providing a real stake in the company from day one.
- Lunch and snacks provided daily in the office.
- Coverage for public transport, bike allowances, or parking.
- Flexible working hours to suit you and your team.
Bist du Teil dieses Unternehmens?
Dieses Unternehmensprofil wurde automatisch erstellt. Wenn du für Proton AG arbeitest, kannst du das Profil jetzt beanspruchen und verifizieren – kostenlos und in wenigen Minuten.
Über uns
Das Team
The Security Machine Learning Engineer will be part of the security team, working closely with the internal Machine Learning team (MSA) to ensure solutions are operationally relevant and aligned with security priorities. The role bridges traditional cybersecurity operations and modern ML-driven analytics, enabling proactive threat detection and automation within the SOC.