ML Engineer

This is not an API-wrapper role. You'll deploy, fine-tune, and run your own LLMs (self-hosted, including on-prem and air-gapped environments) on live cybersecurity data and own the system end-to-end.

Responsibilities:

• Deploy and operate a self-hosted LLM stack. This covers model selection, fine-tuning, quantization, serving (vLLM / TGI / SGLang / Triton), and GPU/CPU capacity planning.
• Build the feedback loop: turn analyst corrections into training data, run regression checks, retrain, and prove the model improved.
• Train, distill, and serve small task-specific models (classifiers, embedders, rerankers, and 1-8B SLMs) at high throughput and low cost per inference.
• Build anomaly detection, classification, and risk-scoring systems on security telemetry (logs, network events, and user behavior).
• Build RAG and agentic features: hybrid retrieval, reranking, tool use, structured outputs, guardrails.

Requirements:

• 4+ years of hands-on ML engineering, with models you've shipped and operated in production.
• At least one self-hosted open-weight LLM in production (Llama, Mistral, Qwen, Gemma, or similar) served via vLLM, TGI, SGLang, llama.cpp, or Triton.
• Production fine-tuning: LoRA/QLoRA, SFT, distillation, or DPO, using PEFT, Unsloth, TRL, or Axolotl.
• Strong Python and PyTorch, plus Hugging Face, scikit-learn, and Pandas.
• Production MLOps: Docker, CI/CD, MLflow or W& B, monitoring.

Strong plus:

• A human-feedback → training-data → retraining loop you've built in production.
• Anomaly detection on high-volume logs or events (security, fraud, network, observability).
• Quantization (AWQ, GPTQ, GGUF, INT8/FP8), continuous batching, cost/latency trade-offs.
• Security domain: SIEM, EDR, SOC, MITRE ATT& CK, network telemetry.
• Kubernetes GPU scheduling, Kafka, or Flink.