Senior/Staff/Principal AI/ML Engineer - Threat Detection Engineering
AppGate Cybersecurity, Inc. • New York, NY2d
Architect Jobs
10,000 jobs found — updated daily
DFx Methodology Architect
Advanced Micro Devices, Inc • San Jose, CA2d • OnsiteSenior Technical Implementation Specialist
Paperless Parts • Boston, MA2d • $100,000 - $130,000 • HybridField Chief Technology Officer (Field CTO) – Americas
Commvault • New York, NY2d • RemoteField Chief Technology Officer (Field CTO) – Americas
Commvault • United States, CA2d • RemoteSenior/Staff/Principal SWE- Observability Engineering
AppGate Cybersecurity, Inc. • New York, NY2dSenior Data Engineer
Ingram Content Group • La Vergne, TN2d • HybridInterior Architect/Designer
Woodhull • Portland, ME2d • OnsiteConstruction Project Architect
HDR • Arlington, VA2d • OnsiteCloudflare Partner Architect
Optiv • Overland Park, KS2d • RemoteDirector, AI Solutions Architect
Inspira Financial • Oak Brook, IL2d • Hybrid- 🔥 New Job
Designer II
LandDesign • Alexandria, VA2d • Onsite Software Engineer, Front-End
Otter.ai • Mountain View, CA2d • HybridImplementation Consultant
Orion Health • Dallas, TX2dImplementation Consultant
Orion Health • Des Moines, IA2dSenior Plumbing Designer
Haag, a Salas O'Brien Company • Bethesda, MD2d • HybridSenior Staff AI Engineer
SoFi • San Francisco, CA2dSystems Support Specialist
SmithRx • Lehi, UT2d • OnsiteSr. Consultant/Resident Engineer
Zscaler2d • RemoteSenior Software Engineer
Pinterest Job Advertisements • New York, NY2d • Remote
Senior/Staff/Principal AI/ML Engineer - Threat Detection Engineering
AppGate Cybersecurity, Inc.•New York, NY
About The Position
AppGate is seeking a Senior/Staff/Principal AI/ML Engineer specializing in Threat Detection to design, build, and operationalize detection algorithms, ML inference pipelines, and risk aggregation systems for their autonomous threat detection platform. This role operates at the intersection of identity security, behavioral analytics, and applied machine learning, focusing on production systems that analyze ZTNA audit logs in near real-time to identify high-fidelity threat signals and feed into the Risk Sentinel enforcement engine for continuous access hardening. The engineer will contribute to next-generation capabilities including a Threat Detection Engine (rule-based, behavioral, and ML-based), ML Anomaly Detection, Risk Aggregation & Enforcement, a Real-Time Detection Pipeline, AI Agent Security, and Autonomous Remediation (roadmap). Responsibilities include designing detection algorithms, training and deploying ML models, architecting and operating the detection pipeline, defining the detection taxonomy, instrumenting and improving signal quality, and collaborating with cross-functional teams. This is an opportunity to build AI systems that detect, prevent, and auto-remediate threats across networks, users, and autonomous AI agents.
Requirements
- 7+ years of production AI/ML engineering experience, with a strong preference for candidates who have built threat detection, UEBA, ITDR, or identity security platforms at leading security or cloud companies.
- Detection algorithm expertise: Hands-on experience designing detections for identity-based threats — credential compromise, privilege escalation, insider activity, behavioral anomalies, and data exfiltration.
- ML proficiency: Anomaly detection (Isolation Forest, One-Class SVM, Autoencoders), statistical methods, and supervised classification using PyTorch or TensorFlow.
- Data & streaming engineering: Real-time or near-real-time pipeline experience (Kafka, Flink, Spark Streaming, or equivalent); familiarity with lakehouse formats (Apache Iceberg, Parquet).
- Security domain knowledge: MITRE ATT&CK, identity threat kill chains, ZTNA or network access control systems, and audit log analysis.
- Mindset: Mission-driven, production-focused, signal-obsessed. You measure precision and recall, you eliminate alert fatigue, and you care that your work protects real systems.
Nice To Haves
- Experience with detection-as-code frameworks (Sigma, YARA)
- Experience with ZTNA platforms
- Experience with LLMs or GNNs applied to security
- Publications at USENIX, CCS, NeurIPS, or ICML
Responsibilities
- Design and implement detection algorithms spanning authentication, authorization, network/location, data access, session management, and temporal behavioral domains.
- Train, evaluate, and deploy ML models on real-world identity and network telemetry; tune for production precision and recall targets.
- Architect and operate the detection pipeline — from audit log ingestion through risk aggregation and Risk Sentinel integration.
- Define the detection taxonomy — categorizing, prioritizing, and lifecycle-managing the full detection library using a scalable detection family model.
- Instrument and improve signal quality — measuring MTTD, false positive rates, and MITRE ATT&CK coverage; partnering with red teams to validate detections against real attack scenarios.
- Collaborate cross-functionally with security, product, and platform engineering to align detection coverage with customer threat models and roadmap priorities.
Benefits
- Equal Opportunity/Affirmative Action Employer status
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
Upload and Match Resume
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
Job Search Resources
Career Resources
Build a Resume for Architect
The resume builder that gets results.
- Get clear feedback so you look as qualified as you are
- Align your resume with the job to get further in the process, faster
- Take the guesswork out of resume writing
