AI/ML Engineer
First seen by Alion on Sep 4, 2026.
Were Hiring | AI/ML Engineer Correlation Engine | Terralogic
Terralogic is looking for an experienced AI/ML engineer to join our team and work on an exciting cybersecurity-focused correlation engine.
This is not a pure ML research role. Youll be building and shipping production AI/ML systems that analyse security events, detect behavioural anomalies, correlate multi-stage attack chains, and help SOC teams make better decisions.
Job location: Bangalore
Notice period: Immediate to 30 days
Required Qualifications:
- 35 years of experience in applied ML / data science, with at least one production system involving anomaly detection, behavioral baselining, or time-series / event-sequence modeling.
- Strong Python and TypeScript/Node.js skills, and comfort working in a backend service this role ships production code inside a Kafka/Redis/MongoDB microservice, not just models.
- Solid grasp of statistics relevant to anomaly detection: rolling baselines, peer-group / cohort comparison, confidence intervals, false-positive rate management.
- Working knowledge of graph data structures and graph algorithms (path finding, community detection, or similar) or strong motivation to apply that to a live entity relationship graph.
- Experience with event-driven or streaming architectures (Kafka, Redis Streams/sorted sets, or comparable) and an understanding of sliding-window / windowed aggregation patterns.
- Comfort reading and reasoning about security telemetry (authentication logs, endpoint events, network flow, cloud audit logs).
- Experience serving open-source LLMs locally/on-prem (e.g., Qwen, Llama) with tools such as vLLM, Ollama, or TGI all AI inference in this stack runs on self-hosted open-source models, not cloud AI APIs.
Preferred / Nice to Have:
- Prior exposure to SIEM, XDR, UEBA, or fraud-detection systems, or familiarity with MITRE ATT&CK-style attack chain modeling.
- Hands-on experience with Wazuh or a similar open-source SIEM/XDR platform its decoders, rules, and correlation engine are a useful reference point for this role.
- Experience with SIGMA detection rules or other vendor-neutral detection rule formats.
- Familiarity with NestJS, MongoDB, and Redis in a microservice environment.
- Experience fine-tuning or prompt-engineering open-source models (Qwen or similar) for classification, summarisation, or reasoning tasks in a security context.
- Exposure to graph databases or graph-analytics libraries (e.g., Neo4j, NetworkX, or similar) applied to security or fraud use cases.
Tech Stack:
- Backend: NestJS / TypeScript microservices, MongoDB (entity graph + event collections), Redis (sliding windows, caching), Kafka (enriched event streams).
- ML / analytics: Python for model development and offline evaluation; statistical and graph libraries as needed; self-hosted open-source LLMs (Qwen family) served locally for classification and reasoning tasks no cloud AI APIs in this stack.
- Open-source security tooling: Wazuh (or similar open-source SIEM/XDR) as a reference implementation for decoders, rules, and correlation patterns.
What Success Looks Like:
- The correlation rule library and entity graph reliably catch multi-stage attack chains (credential theft ? lateral movement ? exfiltration) that no single-event rule would flag, with an explainable reasoning trail for each verdict.
- False-positive rate on correlated incidents stays low enough that SOC analysts trust and act on them without alert fatigue.
- The behavioral/statistical layer (peer-group and individual baselines) is tightly integrated with UEBA scoring, so correlation and behavioral anomaly detection reinforce rather than duplicate each other.
- New correlation rules including SIGMA imports can be added or tuned by the security team without engineering involvement, thanks to the hot-reloadable rule registry you help maintain.
Commitment:
- Candidates should be comfortable with a minimum 18-month commitment.
Skills
Machine Learning, Python, Kafka, Artificial Intelligence, LLM, Data Science