Staff ML Application Engineer

Dragos

5d•Remote

About The Position

Dragos is seeking a Machine Learning Application Engineer to join their Engineering team. This role focuses on applying existing ML models within product and data pipelines, rather than training models from scratch or managing ML infrastructure. The engineer will be responsible for selecting appropriate ML techniques for specific problems, integrating them into workflows, and ensuring the reliability and usefulness of their outputs. This position involves close collaboration with AI Engineers, Data Engineers, and product teams to implement ML-driven capabilities such as clustering network behaviors, classifying assets, and identifying anomalies relevant to ICS/OT security analysts.

Requirements

4+ years of software engineering experience, with meaningful time spent working with ML outputs or data pipelines in a production context.
Strong Python skills; SQL proficiency; comfort reading and reasoning about data at scale.
Hands-on experience applying ML techniques including clustering (k-means, DBSCAN, hierarchical), classification, and anomaly detection.
Familiarity with scikit-learn and the surrounding Python ML ecosystem; you don't need to have implemented a neural net, but you should know how to use one responsibly.
Solid understanding of data pipeline concepts: how data flows, where it gets transformed, what can go wrong, and how to make failures visible.
Ability to evaluate whether a model's outputs are actually trustworthy for a given use case — not just whether accuracy metrics look good.
Strong written and verbal communication; comfortable explaining tradeoffs to both technical and non-technical stakeholders.

Nice To Haves

Cybersecurity domain knowledge — especially around threat detection, network behavior, or ICS/OT operations is a meaningful plus, but not a prerequisite.
Experience working with graph-based representations of network topology or asset relationships.
Familiarity with stream processing or event-driven architectures.
Exposure to containerized environments (Docker, Kubernetes) as a consumer/deployer, not necessarily an operator.

Responsibilities

Apply clustering, classification, anomaly detection, and other established ML techniques to cybersecurity data problems in the ICS/OT domain.
Integrate ML model outputs into existing data pipelines and product workflows, supporting both batch and near-real-time processing patterns.
Understand model behavior and translate research outputs into reliable pipeline components.
Work with Data Engineers to ensure ML-driven stages of the pipeline have clear data contracts, appropriate observability, and sane failure modes.
Evaluate open-source and third-party models for fit against specific use cases, knowing when to apply an existing tool versus when to escalate to a model-building effort.
Write clean, maintainable Python or Rust that other engineers can reason about, test, and extend.
Troubleshoot ML component behavior in production to diagnose issues with output quality, data drift, or unexpected edge cases.
Communicate clearly about what a model is doing, where it's uncertain, and how its outputs should (and shouldn't) be used downstream.