AI/ML Engineer

🚀 We’re Hiring | AI/ML Engineer – Correlation Engine | TerralogicTerralogic is looking for an experienced AI/ML engineer to join our team and work on an exciting cybersecurity-focused correlation engine.This is not a pure ML research role. You’ll be building and shipping production AI/ML systems that analyse security events, detect behavioural anomalies, correlate multi-stage attack chains, and help SOC teams make better decisions.YOE: 3+ YearsJob location: BangaloreNotice period: Immediate to 30 daysRequired Qualifications• 3–5 years of experience in applied ML / data science, with at least one production system involving anomalydetection, behavioral baselining, or time-series / event-sequence modeling.• Strong Python and TypeScript/Node.js skills, and comfort working in a backend service — this role ships production code inside a Kafka/Redis/MongoDB microservice, not just models.• Solid grasp of statistics relevant to anomaly detection: rolling baselines, peer-group / cohort comparison, confidence intervals, false-positive rate management.• Working knowledge of graph data structures and graph algorithms (path finding, community detection, or similar) — or strong motivation to apply that to a live entity relationship graph.• Experience with event-driven or streaming architectures (Kafka, Redis Streams/sorted sets, or comparable) and an understanding of sliding-window / windowed aggregation patterns.• Comfort reading and reasoning about security telemetry (authentication logs, endpoint events, network flow, cloud audit logs).• Experience serving open-source LLMs locally/on-prem (e.g., Qwen, Llama) with tools such as vLLM, Ollama, or TGI — all AI inference in this stack runs on self-hosted open-source models, not cloud AI APIs.Preferred / Nice to Have• Prior exposure to SIEM, XDR, UEBA, or fraud-detection systems, or familiarity with MITRE ATT&CK-styleattack chain modeling.• Hands-on experience with Wazuh or a similar open-source SIEM/XDR platform — its decoders, rules, and correlation engine are a useful reference point for this role.• Experience with SIGMA detection rules or other vendor-neutral detection rule formats.• Familiarity with NestJS, MongoDB, and Redis in a microservice environment.• Experience fine-tuning or prompt-engineering open-source models (Qwen or similar) for classification,summarisation, or reasoning tasks in a security context.• Exposure to graph databases or graph-analytics libraries (e.g., Neo4j, NetworkX, or similar) applied to security or fraud use cases.Tech Stack :• Backend: NestJS / TypeScript microservices, MongoDB (entity graph + event collections), Redis (sliding windows, caching), Kafka (enriched event streams).• ML / analytics: Python for model development and offline evaluation; statistical and graph libraries as needed; self-hosted open-source LLMs (Qwen family) served locally for classification and reasoning tasks — no cloud AI APIs in this stack.• Open-source security tooling: Wazuh (or similar open-source SIEM/XDR) as a reference implementation for decoders, rules, and correlation patterns.What Success Looks Like• The correlation rule library and entity graph reliably catch multi-stage attack chains (credential theft → lateral movement → exfiltration) that no single-event rule would flag, with an explainable reasoning trail for each verdict.• False-positive rate on correlated incidents stays low enough that SOC analysts trust and act on them without alert fatigue.• The behavioral/statistical layer (peer-group and individual baselines) is tightly integrated with UEBA scoring, so correlation and behavioral anomaly detection reinforce rather than duplicate each other.• New correlation rules—including SIGMA imports — can be added or tuned by the security team without engineering involvement, thanks to the hot-reloadable rule registry you help maintain.🤝 Commitment: Candidates should be comfortable with a minimum 18-month commitment