Software Development Engineer (Machine Learning)

Fortinet•Sunnyvale, CA

10d•$150,000 - $183,000•Onsite

About The Position

FortiAIGate is Fortinet's AI security and governance gateway. It sits inline between enterprise users, AI agents, and LLM providers, inspecting prompts and responses in real time to detect prompt injection, jailbreaks, sensitive data exposure, and policy violations — under a strict latency budget. We are hiring a Machine Learning Engineer to own the detection models behind that product: training, evaluation, optimization, and the serving stack that runs them in production.

Requirements

Strong Python and production PyTorch experience; comfort with Go/Rust/C/C++ for performance-critical paths is valuable.
Demonstrated experience training, fine-tuning, and evaluating transformer models — encoder classifiers, decoder language models, or both — with Hugging Face Transformers or equivalent.
Production experience with a modern inference serving system (Triton, vLLM, TensorRT-LLM, TGI), including the batching and memory tuning real throughput requires.
Practical model optimization: quantization, distillation, pruning, or graph compilation, with a record of holding accuracy while cutting latency or memory.
Sound evaluation instincts — able to design test sets that reflect deployment reality and reason about precision/recall where false positives block legitimate user traffic.
Working knowledge of tokenization, text normalization, and Unicode handling, and how these become an attack surface in a security product.
Familiarity with containerized deployment (Docker, Kubernetes) and standard MLOps practice: experiment tracking, model versioning, reproducible training pipelines.
Ability to deliver on schedule in an Agile environment and communicate effectively across technical and non-technical teams.
Must be authorized to work in the U.S. without sponsorship.

Nice To Haves

Modeling experience in a security or abuse-detection domain, where adversaries adapt to your defenses.
Familiarity with the LLM threat landscape — prompt injection, indirect injection, exfiltration through model output — and with the OWASP Top 10 for LLM Applications.
Gradient-boosted tree models (LightGBM, XGBoost) and hybrid classical/neural architectures.
NER, PII detection, or data classification models, particularly multilingual.
CUDA familiarity, GPU profiling, or deploying models under fixed hardware and memory constraints.
Synthetic data generation, active learning, or human-in-the-loop labeling where labeled data is scarce.
Publications, open-source work, or CTF/red-team experience in adversarial ML or LLM security.

Responsibilities

Build and train guardrail models. Develop classifiers that detect prompt injection, jailbreak attempts, unsafe content, and sensitive data exposure across prompts, responses, and tool-call payloads — dataset construction through to release.
Design and tune the tiered detection cascade. Balance a low-cost first-stage screen against a higher-fidelity semantic stage, tuning thresholds to hit accuracy targets inside a fixed per-request latency budget.
Work across encoder and decoder model families. Fine-tune encoder-based classifiers and token-level taggers for detection and extraction; adapt small decoder models for semantic judgment. Use distillation to move capability into models small enough to deploy.
Optimize and serve models inline. Quantize, distill, and compile models (ONNX Runtime, TensorRT, INT8/FP8) for GPU appliances. Deploy and tune them on Triton Inference Server and vLLM — batching, concurrent model execution, KV-cache and memory configuration, multi-stage pipelines — and profile out the bottlenecks.
Harden models against evasion. Threat research on obfuscation and encoding bypass, dilution attacks, indirect injection, and multi-turn attacks visible only across conversational context. Turn each new bypass into training data and a regression test.
Own evaluation and governance detectors. Build benchmark and suites measuring detection rate at production-realistic false positive rates; monitor deployed models for drift. Maintain detection models for personal and regulated data and for natural-language policy, including multilingual coverage.