SoFi
Staff Security Detection Engineer, Machine Learning
WA - Seattle; CA - San Francisco · Staff+
Sponsorship not specifiedDetected 1 day ago
PythonSQLSnowflakeDatabricksAWSGCPAzureCI/CDKafkaMachine LearningDeep LearningTensorFlowPyTorchscikit-learnPandasSparkData EngineeringData ScienceLLMsMLOpsStatisticsCybersecuritySOC OperationsCommunication
> stay_score
odds of building a lasting career here
16Unrated
Cap-exempt (no lottery)0
Sponsors this role0
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70
No strong sponsorship signal in the public record yet. In the full product we resolve the exact legal entity and show its filing history with a confidence score — treat as unverified until then.
Lottery odds assume a STEM candidate.
Personalize to your clock →> community_outcomes
No reports yet — be the first to help the next applicant.
About the role
- We're seeking a Staff Security Detection Engineer to build and mature SoFi's machine learning-driven detection and anomaly detection program.
- You will own the detection and model lifecycle end to end; feature engineering, model training, tuning, and validation, operating over large-scale security data lakes and streaming pipelines.
- You'll partner closely with our Security Operations Center (SOC), Security Operations Engineering, and Fraud programs to turn high-volume telemetry into high-confidence, low-noise detections at scale.
Responsibilities
- Partner with the SOC to triage, tune, and close detection feedback loops
- use analyst dispositions as labels to retrain and improve models, reduce noise, and document runbooks.
- Collaborate with Threat Intelligence, Security Architecture, and Fraud stakeholders to translate threat hypotheses and scenarios into repeatable, model-backed analytics with clear success metrics.
- Establish model governance: offline and online evaluation, drift and data-quality monitoring, periodic retraining and re-baselining, explainability/traceability, and privacy-by-design controls.
- backlog and deliver the resulting models and detections.
Requirements
- Hands-on experience with data lake and big-data technologies (e.g., Snowflake, Databricks, Spark, Delta/Iceberg, S3/GCS) for storing, transforming, and querying large-scale security telemetry.
- Working knowledge of anomaly detection techniques (statistical baselining, clustering, isolation forests, autoencoders, time-series methods) and the end-to-end model lifecycle.
- Familiarity with security frameworks and adversary tradecraft (MITRE ATT&CK, kill chain) and how they map to detectable behaviors and model features.
- Experience collaborating with SOC/DFIR and fraud/risk teams
- Bachelor's degree in computer science, data science, statistics, a related field, or equivalent practical experience.
Nice to have
- Experience with streaming and real-time data engineering (e.g., Kafka, Kinesis, Pub/Sub, Flink, Spark Streaming) for near-real-time model scoring.
- MLOps practices - feature stores, model registries, experiment tracking, canary and shadow releases for reliable model deployment and retraining.
- Graph-based ML and analytics for entity relationships, risk propagation, and community detection.
- The Company hires the best qualified candidate for the job, without regard to protected characteristics.
- Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
- New York applicants: Notice of Employee Rights
- SoFi is committed to an inclusive culture.
- Internal Employees
Compensation
- The base pay range for this role is listed below.
- Final base pay offer will be determined based on individual factors such as the candidate's experience, skills, and location.
Benefits
- Participate in root-cause and post-incident reviews to identify new signals, features, and coverage gaps
- 7+ years hands-on experience building and operating machine learning models for detection or anomaly detection in production (e.g., security, fraud, or abuse), across both supervised and unsupervised approaches.
- To view all of our comprehensive and competitive benefits, visit our Benefits at SoFi page!
Company info
- Shape a brighter financial future with us.
- Together with our members, we're changing the way people think about and interact with personal finance.
- We're a next-generation financial services company and national bank using innovative, mobile-first technology to help our millions of members reach their goals.
- The industry is going through an unprecedented transformation, and we're at the forefront.
- We're proud to come to work every day knowing that what we do has a direct impact on people's lives, with our core values guiding us every step of the way.
- Join us to invest in yourself, your career, and the financial world.
- Design, build, and maintain machine learning models for anomaly detection (unsupervised clustering, time-series and seasonality baselines, isolation forests, autoencoders, risk scoring) with measurable precision/recall targets.
- Operationalize models and detections from notebook to production, including enrichment, correlation, and response playbook hooks (detection-as-code, CI/CD, model versioning, and rollback).
- Engineer and tune features from identity, endpoint, network, cloud, SaaS, and application telemetry stored in the security data lake to improve model signal quality.
- Partner with the SOC to triage, tune, and close detection feedback loops; use analyst dispositions as labels to retrain and improve models, reduce noise, and document runbooks.
This listing is sourced directly from SoFi's careers page and normalized into a canonical job model.