{"id":96817,"url":"https://alion.io/job/proton-vpn-senior-machine-learning-engineer-soc","title":"Senior Machine Learning Engineer (SOC)","company":{"id":36577,"name":"Proton VPN","domain":"protonvpn.com","url":"https://alion.io/company/proton-vpn","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":55,"ghost_share":0.127,"stale_share":0,"repost_share":0.018,"time_to_fill_p50_days":110,"computed_at":"2026-10-17T05:46:00Z"}},"role":"AI/ML","role_family":"AI/ML","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Paris, France","Geneva, Switzerland"],"countries":["FR","CH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":112000,"max_usd":287000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2102},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"Apache Kafka","optional":false},{"name":"ClickHouse","optional":false},{"name":"ElasticSearch","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Machine Learning","optional":false},{"name":"NumPy","optional":false},{"name":"Pandas","optional":false},{"name":"Prompt Engineering","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Redis","optional":false},{"name":"SIEM","optional":false},{"name":"VPN","optional":false}],"status":"live","first_seen_at":"2026-05-19T06:52:31Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-17T16:44:27Z","board_verified":true,"closed_at":null,"days_open":151,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":150},"description":"Join Proton and build a better internet where privacy is the default\nAt Proton, we believe that privacy is a fundamental human right and the cornerstone of democracy. Since our inception in 2014, founded by a team of scientists from CERN, we have dedicated ourselves to providing free and open-source technology to millions worldwide, ensuring access to privacy, security, and freedom online.\nOur journey began with Proton Mail, the largest secure email service globally, and has since expanded to include Proton VPN, Proton Calendar, Proton Drive, and Proton Pass. These tools empower individuals and organizations to take control of their personal data, break away from Big Tech’s invasive practices, and defeat censorship. Our work impacts hundreds of millions of lives, from activists on the front lines defending freedom to leaders in governments protecting sensitive information. In some cases, Proton’s services have even been instrumental in saving lives by enabling secure and private communications in high-risk situations.\nProton is a profitable company that does not rely upon VC funding, supporting over 100 million user accounts with a growing team of over 500 people from over 50 different countries, from the world's top companies and universities. We value intelligence, learning potential, and ambition in our hiring process. Adaptability is key as we navigate uncharted territories and redefine how business is conducted online.\nHiring at Proton is highly selective, with less than 1% of candidates hired. We believe smaller teams of exceptional talent will always prevail over larger teams with lower talent density. You will have the opportunity work with many of the world's top minds in their fields, ranging from former international math and science olympiad winners to chess champions.\nWe have a global mindset and big ambitions but remain a start-up at heart. We value empowerment and flexibility and keep our structure flat to keep moving fast and avoid unnecessary politics. Tired of blending into the crowd? Join us and do work you can truly be proud of. Check our open-source projects here!\nThe Team\nThe Security Machine Learning Engineer will play a key role in transforming our Security Operations Center (SOC) from reactive to proactive by integrating advanced machine learning and data-driven approaches into our detection and response workflows.\nThis role bridges traditional cybersecurity operations and modern ML-driven analytics, enabling our team to automatically identify emerging threats, anomalous behaviour, and new attack patterns at scale. As a secondary focus, the role could also leverage LLMs and AI engineering to automate analyst workflows and reduce operational toil.\nThe engineer will sit directly within the security team, ensuring that the solutions built are operationally relevant, and aligned with our security priorities, while also working closely with the internal Machine Learning team (MSA) to leverage their expertise and best practices.\nWhat you will do:\nML-Driven Detection & Automation\nDesign, develop, and deploy machine learning models to enhance security detection, anomaly identification, and incident response.\nIntegrate ML outputs into the SOC workflow to enable smarter and faster triage.\nContinuously evaluate and tune models to reduce false positives and improve detection precision.\nEnsure model outputs are interpretable and actionable for SOC analysts.\nData Engineering for Security\nBuild and maintain data pipelines to collect, process, and transform security-relevant data (e.g., logs, network traffic, endpoint events) into ML-ready datasets.\nCollaborate with security engineering team to ensure scalable and secure data handling (eg. parsing, processing, storage).\nAI Engineering & LLM-Powered Automation\nExplore and build LLM-powered tools to automate repetitive SOC tasks (e.g., alert triage, evidence gathering, incident summarisation, report generation).\nApply appropriate guardrails and evaluation to ensure outputs are accurate, auditable, and safe to act on in operational contexts.\nResearch & Innovation\nStay current on advancements in security data science, adversarial ML, and automated threat detection.\nPrototype and test new ML and AI techniques (e.g., unsupervised anomaly detection, graph-based threat correlation).\nContribute to improving detection content through statistical analysis and clustering.\nOperations & Maintenance\nDeploy models into production securely and responsibly, ensuring reliability and scalability.\nImplement monitoring, alerting, and retraining mechanisms for deployed ML models.\nDocument methodologies and performance metrics for auditability and knowledge sharing.\n\nWhat we are looking for:\nRequired\nProven experience in machine learning engineering or data science, ideally in a cybersecurity or operations context.\nProficiency in Python, with strong knowledge of ML frameworks.\nExperience with data manipulation and analysis using Pandas, NumPy or similar tools.\nFamiliarity with security data sources (e.g., SIEM logs, EDR telemetry, network flow, authentication logs).\nSolid understanding of ML lifecycle: data preparation, model training, evaluation, deployment, and monitoring.\nExperience with data pipelines and storage technologies (e.g., Airflow, Kafka, Redis, Elasticsearch, Clickhouse, etc.).\nAbility to work independently and collaborate effectively with both ML and security specialists.\nProton is an office-first company. We expect you to spend most of your time in the office, and while we do offer some flexibility to work from home, we believe in-person collaboration helps us build the best products.\nPreferred\nPrior experience in threat detection, SOC operations, or security automation.\nKnowledge of adversarial ML, graph analytics, or behavioral modeling in security contexts.\nExperience integrating ML models into SIEM pipelines or automated detection frameworks.\nExposure to LLMs and AI engineering (e.g., prompt engineering, RAG, agent design), and awareness of LLM-specific risks like prompt injection and data leakage.\nSuccess in This Role\nSOC analysts leverage ML-powered detections to identify threats faster.\nReduction in alert fatigue and false positives through adaptive and data-driven models.\nStrong collaboration established between the security and MSA ML teams, sharing expertise and best practices.\nSecurity data becomes more accessible, structured, and usable for analytical and predictive use cases.\nNew, intelligent detections, enrichment, and incident response automations become part of the SOC’s standard toolkit.\n\nEven if you don’t meet all the requirements listed above, but feel you could still be a great fit, please still apply.\nWhat We Offer:\nWork that Matters: millions of people trust Proton with their privacy. We answer only to our users - not advertisers, not investors with conflicting agendas, not governments. The work you do here is real, and the impact is measurable. (read more about our impact here)\nTechnology: you'll get the right hardware and the right software you need to do your best work.\nLearning & Development: we invest in your growth because sharp people make us better. Proton is one of the fastest ways to accelerate your career because you'll be thrown into real challenges, with real ownership, from day one.\nEmployee Benefits: your wellbeing isn't an afterthought. We offer strong health coverage, solid retirement options, generous leave, and wellness support so you can bring your best self to work every day\nStock Options: at Proton, we all have the opportunity to be owners of the company. From day one, you have a real stake in what we're building. When Proton wins, you win.\nFood: Lunch and snacks are on us every day in our offices so you can focus on the work and not on what's for lunch.\nTransport: getting to the office shouldn't cost you. We cover public transport, bike allowances, or parking, whichever works for you.\nFlexible Working: you own your schedule. Set hours that work for you and your team - because outcomes matter more than when the clock says you started.\nOur Commitment to Diversity and Inclusion\nAt Proton, we believe diversity drives innovation and strengthens our mission to provide privacy as a default for all. We are committed to fostering an inclusive environment where all individuals, regardless of race, ethnicity, gender, age, sexual orientation, physical ability, or socio-economic background, feel valued and empowered. We strive to create equal opportunities, promote open dialogue, and support continuous learning to ensure every voice is heard and respected.\nIf you need any extra support or reasonable adjustments during the hiring process, please let your talent partner know.\nCandidate Privacy Notice\nWhen you apply for a position, refer a candidate, or are considered for a role at Proton Technologies AG (Proton, we, us, or our), your information is stored in Greenhouse, in accordance with their Service Privacy Policy. This information is used to evaluate your suitability for the posted position. We also retain this information for consideration for future roles that you may apply for or that we believe may align with your background and skills.\nIf we no longer have a legitimate business need to process your information, we will either delete or anonymize it. Should you have any inquiries about how we use or manage your information, or if you wish to access, correct, or delete your data, please contact our privacy team at .\nProton does not accept unsolicited resumes from any sources other than directly from candidates. We will not pay a fee for any placement resulting from an unsolicited offer, even if the candidate is subsequently hired by Proton.\nTo learn more about our privacy policy, please visit our privacy policy page.\n Compensation range\nParis: 46.000 - 74.000 gross annually*\nOther locations: Compensation will be discussed during the interview process\n*Final compensation will be determined based on the candidate's qualifications, skills, and previous experience","description_format":"text","description_chars":10057,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Flexible schedule","Stock options"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","VPN & Proxy Services"],"lifecycle":[{"event":"open","at":"2026-05-19T06:52:31Z"}],"visa":[],"liveness":{"score":35,"band":"fade","label":"Fading","p_open":1,"p_active":0.793,"p_room":0.44,"age_days":150,"expected_fill_days":110,"reasons":["conf:1","velocity","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/proton-vpn-senior-machine-learning-engineer-soc","json_url":"https://alion.io/job/proton-vpn-senior-machine-learning-engineer-soc.json","meta":{"generated_at":"2026-10-17T18:21:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1049,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":36577},"rest":"https://alion.io/mcp/rest/get_company?id=36577"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fproton-vpn-senior-machine-learning-engineer-soc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fproton-vpn-senior-machine-learning-engineer-soc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fproton-vpn-senior-machine-learning-engineer-soc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/proton-vpn-senior-machine-learning-engineer-soc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fproton-vpn-senior-machine-learning-engineer-soc"}]}