Lead Machine Learning Engineer

Salesforce•New York, NY

About The Position

About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. We’re Salesforce, the Customer Company, inspiring the future of business with AI+ Data +CRM. Leading with our core values, we help companies across every industry blaze new trails and connect with customers in a whole new way. And, we empower you to be a Trailblazer, too — driving your performance and career growth, charting new paths, and improving the state of the world. If you believe in business as the greatest platform for change and in companies doing well and doing good – you’ve come to the right place. We are a foundation machine learning platform team within the Trust Intelligence Platform organization with a main focus to build and accelerate scalable and resilient machine learning pipelines across the security engineering organization. We are looking for a highly motivated, hands-on lead machine learning engineer with a strong business understanding of cybersecurity problems, who acts as a force multiplier security data scientist for our security organization. The lead will not simply build models; they will architect the data-driven strategy for our threat detection capabilities. Your impact: Shape the Defense Strategy: You will own the decision-making process—translating vague security threats into concrete mathematical problems. By championing a rapid prototyping culture, you will validate hypotheses in days rather than months, ensuring our engineering resources are focused only on high-value detections while killing low-signal ideas early. Detect the "Unknown Unknowns": You will lead the evolution of our threat detection, introducing more advanced probabilistic modeling, graph analytics, supervised and unsupervised learing. Your work will expose sophisticated threats—such as active system intrusions, lateral movement, beaconing, and insider attacks—that evade traditional defenses, directly reducing the organization's risk surface. Elevate the Organization: You will act as a force multiplier, mentoring junior scientists and engineers, and building the internal tooling, feature stores, and libraries that make the whole team faster. You will influence the broader security engineering roadmap to ensure a closed loop security telemetry that is treated as a first-class citizen. Operationalize Intelligence: By prioritizing engineering rigor (CI/CD, scalable code) and adversarial resilience, you will deliver production-grade models that the SOC actually trusts—minimizing "alert fatigue" and maximizing analyst efficiency.

Requirements

Extensive experience (3-5+ years) in data science, with at least 2+ years dedicated to the cybersecurity domain designing, implementing and deploying systems of anomaly detection, clustering, and graph models in production.
Extended practical knowledge and familiarity with security frameworks such as MITRE ATT&CK and OCSF.
Hands-on comfort with high-volume logs and proficiency with Spark/Pyspark, Snowflake, Flink and streaming services such as Apache Kafka
Deep understanding and application of containerization (Docker) and workflow orchestration (Kubernetes, Apache Airflow) for automated ML pipelines.
Mastery of Python programming, including proficiency in leading ML frameworks (TensorFlow, PyTorch) and adherence to software engineering best practices.
Demonstrated success in implementing comprehensive MLOps methodologies, encompassing CI/CD pipelines, testing protocols, and model performance monitoring.
Solid foundation in feature engineering techniques and the implementation of feature stores.
Experience in formulating ML governance policies and ensuring adherence to data security regulations.
Ability to explain complex statistical concepts to non-technical stakeholders and executive leadership.
Proven ability to manage scope, timelines, and stakeholder expectations across multiple organizations.
High degree of autonomy with the ability to look at a vague business problem and structure a data-driven solution without needing a predefined roadmap.
A related technical degree is required.

Nice To Haves

Masters or PhD in a quantitative field
Expertise in advanced Natural Language Processing (NLP) methodologies.
Experience contributing to open-source security data science tools.
Presentations at major security conferences (Black Hat, DEF CON, BSides) or data conferences.
Background in offensive security (Penetration Testing/Red Teaming) with an "attacker's mindset."
Demonstrated experience conducting research or working collaboratively with Machine Learning (ML) research teams.
Previous experience in a mentoring role for junior engineers.
Track record of publications and/or patents in quantitative disciplines.

Responsibilities

Shape the Defense Strategy: You will own the decision-making process—translating vague security threats into concrete mathematical problems.
By championing a rapid prototyping culture, you will validate hypotheses in days rather than months, ensuring our engineering resources are focused only on high-value detections while killing low-signal ideas early.
Detect the "Unknown Unknowns": You will lead the evolution of our threat detection, introducing more advanced probabilistic modeling, graph analytics, supervised and unsupervised learing.
Your work will expose sophisticated threats—such as active system intrusions, lateral movement, beaconing, and insider attacks—that evade traditional defenses, directly reducing the organization's risk surface.
Elevate the Organization: You will act as a force multiplier, mentoring junior scientists and engineers, and building the internal tooling, feature stores, and libraries that make the whole team faster.
You will influence the broader security engineering roadmap to ensure a closed loop security telemetry that is treated as a first-class citizen.
Operationalize Intelligence: By prioritizing engineering rigor (CI/CD, scalable code) and adversarial resilience, you will deliver production-grade models that the SOC actually trusts—minimizing "alert fatigue" and maximizing analyst efficiency.