Staff Security Detection Engineer, SoFi

• 7+ years hands-on experience building and operating machine learning models for detection or anomaly detection in production (e.g., security, fraud, or abuse), across both supervised and unsupervised approaches
• Hands-on experience with data lake and big-data technologies (e.g., Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS) for storing, transforming, and querying large-scale security telemetry
• Strong programming and query skills in Python and SQL, with hands-on use of the ML and data stack (e.g., pandas, scikit-learn, PyTorch or TensorFlow) for feature engineering, model training, and automation
• Solid understanding of security telemetry sources; identity and access (SSO, IGA, PAM), endpoint/EDR, network/proxy, cloud (AWS/GCP/Azure), and SaaS audit logs, and how to shape them into model features
• Working knowledge of anomaly detection techniques (statistical baselining, clustering, isolation forests, autoencoders, time-series methods) and the end-to-end model lifecycle
• Familiarity with security frameworks and adversary tradecraft (MITRE ATT&CK, kill chain) and how they map to detectable behaviors and model features
• Experience collaborating with SOC/DFIR and fraud/risk teams; excellent written communication for models, detections, runbooks, and stakeholder updates
• Ability to balance detection coverage, model precision, and operational load; metrics-driven mindset (precision/recall, false-positive rate, MTTD, alert fatigue)
• Bachelor’s degree in computer science, data science, statistics, a related field, or equivalent practical experience

Desirable

• We’re seeking a Staff Security Detection Engineer to build and mature SoFi’s machine learning–driven detection and anomaly detection program
• You will own the detection and model lifecycle end to end; feature engineering, model training, tuning, and validation, operating over large-scale security data lakes and streaming pipelines
• You’ll partner closely with our Security Operations Center (SOC), Security Operations Engineering, and Fraud programs to turn high-volume telemetry into high-confidence, low-noise detections at scale
• Design, build, and maintain machine learning models for anomaly detection (unsupervised clustering, time-series and seasonality baselines, isolation forests, autoencoders, risk scoring) with measurable precision/recall targets
• Operationalize models and detections from notebook to production, including enrichment, correlation, and response playbook hooks (detection-as-code, CI/CD, model versioning, and rollback)
• Engineer and tune features from identity, endpoint, network, cloud, SaaS, and application telemetry stored in the security data lake to improve model signal quality
• Partner with the SOC to triage, tune, and close detection feedback loops; use analyst dispositions as labels to retrain and improve models, reduce noise, and document runbooks
• Collaborate with Threat Intelligence, Security Architecture, and Fraud stakeholders to translate threat hypotheses and scenarios into repeatable, model-backed analytics with clear success metrics
• Establish model governance: offline and online evaluation, drift and data-quality monitoring, periodic retraining and re-baselining, explainability/traceability, and privacy-by-design controls
• Participate in root-cause and post-incident reviews to identify new signals, features, and coverage gaps; backlog and deliver the resulting models and detections
• Contribute to reference architectures, standards, and documentation for the ML detection platform, data lake, and pipelines across the security organization
• Mentor engineers and analysts on applied ML, anomaly detection, detection tuning, data quality, and pipeline reliability