Senior Machine Learning Engineer (SOC)

Proton builds privacy‑first internet services such as secure email, VPN, calendar, drive and password management, serving more than a hundred‑million users worldwide. The company, founded by CERN researchers in 2014, operates as a profitable, venture‑free business with a diverse team of over 500 staff drawn from top universities and corporations. The Senior Machine Learning Engineer (SOC) will join the security group to help shift its operations from a reactive stance to a proactive, data‑driven posture. Day‑to‑day duties involve creating, testing and launching machine‑learning solutions that improve threat detection, anomaly spotting and incident handling. The engineer will weave model outputs into the SOC’s triage process, keep false alarms low, and ensure results are clear for analysts. Building and sustaining pipelines that turn logs, network traffic and endpoint events into model‑ready data is also key, as is collaborating with security engineers to guarantee robust, scalable data flows. A secondary focus is prototyping large‑language‑model utilities that automate repetitive analyst tasks, with careful safeguards to maintain accuracy and auditability. Ongoing responsibilities include monitoring deployed models, retraining as needed, and documenting performance for future reference. The position requires a solid track record in machine‑learning engineering or data science, ideally applied to security or operational settings. Mastery of Python and familiar ML frameworks is essential, together with strong data‑manipulation skills using tools such as Pandas or NumPy. Candidates must understand the full ML lifecycle—from data preparation through deployment and monitoring—and be comfortable with pipeline and storage technologies like Airflow, Kafka, Redis, Elasticsearch or Clickhouse. Ability to work autonomously while partnering closely with both ML and security specialists is a must. Desirable experience includes prior work in threat detection, SOC environments or security automation, as well as knowledge of adversarial ML, graph analytics or behavior‑based modeling. Exposure to LLM engineering, prompt design and an awareness of associated risks such as prompt injection or data leakage will be viewed favorably. The role sits within