Terralogic
Website:
terralogic.com
Company:
https://www.linkedin.com/company/terralogic
Industries: Information Technology & Services
Job details:
🚀 We’re Hiring | AI/ML Engineer – Correlation Engine | Terralogic
Terralogic is looking for an experienced AI/ML engineer to join our team and work on an exciting cybersecurity-focused correlation engine.
This is not a pure ML research role. You’ll be building and shipping production AI/ML systems that analyse security events, detect behavioural anomalies, correlate multi-stage attack chains, and help SOC teams make better decisions.
YOE: 3+ Years
Job location: Bangalore
Notice period: Immediate to 30 days
Required Qualifications
• 3–5 years of experience in applied ML / data science, with at least one production system involving anomaly
detection, behavioral baselining, or time-series / event-sequence modeling.
• Strong Python and TypeScript/Node.js skills, and comfort working in a backend service — this role ships production code inside a Kafka/Redis/MongoDB microservice, not just models.
• Solid grasp of statistics relevant to anomaly detection: rolling baselines, peer-group / cohort comparison, confidence intervals, false-positive rate management.
• Working knowledge of graph data structures and graph algorithms (path finding, community detection, or similar) — or strong motivation to apply that to a live entity relationship graph.
• Experience with event-driven or streaming architectures (Kafka, Redis Streams/sorted sets, or comparable) and an understanding of sliding-window / windowed aggregation patterns.
• Comfort reading and reasoning about security telemetry (authentication logs, endpoint events, network flow, cloud audit logs).
• Experience serving open-source LLMs locally/on-prem (e.g., Qwen, Llama) with tools such as vLLM, Ollama, or TGI — all AI inference in this stack runs on self-hosted open-source models, not cloud AI APIs.
Preferred / Nice to Have
• Prior exposure to SIEM, XDR, UEBA, or fraud-detection systems, or familiarity with MITRE ATT&CK-style
attack chain modeling.
• Hands-on experience with Wazuh or a similar open-source SIEM/XDR platform — its decoders, rules, and correlation engine are a useful reference point for this role.
• Experience with SIGMA detection rules or other vendor-neutral detection rule formats.
• Familiarity with NestJS, MongoDB, and Redis in a microservice environment.
• Experience fine-tuning or prompt-engineering open-source models (Qwen or similar) for classification,
summarisation, or reasoning tasks in a security context.
• Exposure to graph databases or graph-analytics libraries (e.g., Neo4j, NetworkX, or similar) applied to security or fraud use cases.
Tech Stack :
• Backend: NestJS / TypeScript microservices, MongoDB (entity graph + event collections), Redis (sliding windows, caching), Kafka (enriched event streams).
• ML / analytics: Python for model development and offline evaluation; statistical and graph libraries as needed; self-hosted open-source LLMs (Qwen family) served locally for classification and reasoning tasks — no cloud AI APIs in this stack.
• Open-source security tooling: Wazuh (or similar open-source SIEM/XDR) as a reference implementation for decoders, rules, and correlation patterns.
What Success Looks Like
• The correlation rule library and entity graph reliably catch multi-stage attack chains (credential theft → lateral movement → exfiltration) that no single-event rule would flag, with an explainable reasoning trail for each verdict.
• False-positive rate on correlated incidents stays low enough that SOC analysts trust and act on them without alert fatigue.
• The behavioral/statistical layer (peer-group and individual baselines) is tightly integrated with UEBA scoring, so correlation and behavioral anomaly detection reinforce rather than duplicate each other.
• New correlation rules—including SIGMA imports — can be added or tuned by the security team without engineering involvement, thanks to the hot-reloadable rule registry you help maintain.
🤝 Commitment: Candidates should be comfortable with a minimum 18-month commitment
Click on Apply to know more.
