ML Researcher, Autonomous Security

Apple • Austin, TX

1d

About The Position

The Information Security Machine Learning (ISML) team empowers information security by harnessing patterns and insights from vast amounts of data to predict, detect, and respond; transforming reactive security into autonomous protection. We are seeking a highly innovative and experienced ML Researcher specializing in streaming threat detection over provenance graphs to join our dynamic team. As an ML Researcher on Autonomous Security, you will be instrumental in advancing the state-of-the-art in ML for cybersecurity, focusing on developing dynamic, adaptive, and robust security solutions that can operate with near or full autonomy in low-resource, on-device, and real-time streaming environments. Your work will bridge cutting-edge academic research with practical, real-world deployment challenges, contributing to the next generation of Apple’s security capabilities by significantly reducing detection lag and memory consumption compared to traditional methods. The ML Researcher will conduct pioneering research in streaming provenance-based intrusion detection systems (Prov-IDS), leveraging advanced machine learning, deep learning, and related AI fields. This role will focus on designing and implementing novel approaches for fine-grained, process-level threat detection over real-time event streams, specifically utilizing provenance graphs. You will be responsible for developing and evaluating iterative embedding techniques using sequential neural networks (e.g., RNNs, GRUs) that can process entire provenance graphs while consuming a fraction of the computational and memory costs associated with traditional Graph Neural Networks (GNNs). Your research will address critical challenges such as memory overhead, detection lag, mimicry attacks, and concept drift, providing roadmaps, prototypes, and algorithms for autonomous agents in low-resource, on-device, and distributed environments. This position requires a deep understanding of the challenges and opportunities in applying advanced ML to real-world cybersecurity scenarios, including scalability, interpretability, robustness, privacy, and ethical considerations.

Requirements

• Master’s degree or PhD with a focus on Machine Learning, Artificial Intelligence, Computer Science, or a related field, with a strong emphasis on sequential modeling, graph neural networks, or provenance-based security. Equivalent practical experience also applicable.
• 5+ years of experience in machine learning research or a related field, with a significant focus on developing and applying cutting-edge ML algorithms for security or real-time data streams.
• Demonstrated experience in developing and evaluating sequential neural networks (RNNs, GRUs) or graph-based learning systems for complex problems.
• Proficient programming skills and hands-on experience with at least one major deep learning toolkit (e.g., PyTorch, TensorFlow).
• In-depth experience in relevant areas such as Provenance Graphs, Intrusion Detection Systems (IDS), Endpoint Detection and Response (EDR), Real-time Streaming Data Processing, or Adversarial Machine Learning.
• Sound intuition, adaptive mentality, and the courage to challenge established paradigms to drive innovation.
• Strong analytical and problem-solving skills, with the ability to translate complex research into actionable insights.

Nice To Haves

• PhD in a relevant field with a strong publication record in top-tier ML/AI/Security conferences (e.g., NeurIPS, ICML, ICLR, CVPR, ICCV, ECCV, KDD, ACL, ICASSP, InterSpeech, S&P, USENIX Security).
• Experience with versioned provenance graphs and their application in security contexts.
• Prior experience or strong interest in Cyber Security, Information Security, or Computer Networks.
• Proven track record of bringing research from concept to prototype and successfully delivering prototypes to applied ML teams, with a focus on robust, efficient, and deployable solutions.
• Experience addressing real-world deployment challenges such as memory optimization, low-latency processing, and concept drift in AI/ML systems.
• Familiarity with various simulation environments and platforms for ML research.
• Excellent communication and collaboration skills, with the ability to work effectively in a cross-functional team environment.

Responsibilities

• Conduct pioneering research in streaming provenance-based intrusion detection systems (Prov-IDS), leveraging advanced machine learning, deep learning, and related AI fields
• Design and implement novel approaches for fine-grained, process-level threat detection over real-time event streams, specifically utilizing provenance graphs
• Develop and evaluate iterative embedding techniques using sequential neural networks (e.g., RNNs, GRUs) that can process entire provenance graphs while consuming a fraction of the computational and memory costs associated with traditional Graph Neural Networks (GNNs)
• Address critical challenges such as memory overhead, detection lag, mimicry attacks, and concept drift, providing roadmaps, prototypes, and algorithms for autonomous agents in low-resource, on-device, and distributed environments

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Number of Employees: 5,001-10,000 employees