Were Hiring | AI/ML Engineer Correlation Engine | Terralogic

Terralogic is looking for an experienced AI/ML engineer to join our team and work on an exciting cybersecurity-focused correlation engine.

This is not a pure ML research role. Youll be building and shipping production AI/ML systems that analyse security events, detect behavioural anomalies, correlate multi-stage attack chains, and help SOC teams make better decisions.

Job location: Bangalore

Notice period: Immediate to 30 days

Required Qualifications:

- 35 years of experience in applied ML / data science, with at least one production system involving anomaly detection, behavioral baselining, or time-series / event-sequence modeling.

- Strong Python and TypeScript/Node.js skills, and comfort working in a backend service this role ships production code inside a Kafka/Redis/MongoDB microservice, not just models.

- Solid grasp of statistics relevant to anomaly detection: rolling baselines, peer-group / cohort comparison, confidence intervals, false-positive rate management.

- Working knowledge of graph data structures and graph algorithms (path finding, community detection, or similar) or strong motivation to apply that to a live entity relationship graph.

- Experience with event-driven or streaming architectures (Kafka, Redis Streams/sorted sets, or comparable) and an understanding of sliding-window / windowed aggregation patterns.

- Comfort reading and reasoning about security telemetry (authentication logs, endpoint events, network flow, cloud audit logs).

- Experience serving open-source LLMs locally/on-prem (e.g., Qwen, Llama) with tools such as vLLM, Ollama, or TGI all AI inference in this stack runs on self-hosted open-source models, not cloud AI APIs.

Preferred / Nice to Have:

- Prior exposure to SIEM, XDR, UEBA, or fraud-detection systems, or familiarity with MITRE ATT&CK-style attack chain modeling.

- Hands-on experience with Wazuh or a similar open-source SIEM/XDR platform its decoders, rules, and correlation engine are a useful reference point for this role.

- Experience with SIGMA detection rules or other vendor-neutral detection rule formats.

- Familiarity with NestJS, MongoDB, and Redis in a microservice environment.

- Experience fine-tuning or prompt-engineering open-source models (Qwen or similar) for classification, summarisation, or reasoning tasks in a security context.

- Exposure to graph databases or graph-analytics libraries (e.g., Neo4j, NetworkX, or similar) applied to security or fraud use cases.

Tech Stack:

- Backend: NestJS / TypeScript microservices, MongoDB (entity graph + event collections), Redis (sliding windows, caching), Kafka (enriched event streams).

- ML / analytics: Python for model development and offline evaluation; statistical and graph libraries as needed; self-hosted open-source LLMs (Qwen family) served locally for classification and reasoning tasks no cloud AI APIs in this stack.

- Open-source security tooling: Wazuh (or similar open-source SIEM/XDR) as a reference implementation for decoders, rules, and correlation patterns.

What Success Looks Like:

- The correlation rule library and entity graph reliably catch multi-stage attack chains (credential theft ? lateral movement ? exfiltration) that no single-event rule would flag, with an explainable reasoning trail for each verdict.

- False-positive rate on correlated incidents stays low enough that SOC analysts trust and act on them without alert fatigue.

- The behavioral/statistical layer (peer-group and individual baselines) is tightly integrated with UEBA scoring, so correlation and behavioral anomaly detection reinforce rather than duplicate each other.

- New correlation rules including SIGMA imports can be added or tuned by the security team without engineering involvement, thanks to the hot-reloadable rule registry you help maintain.

Commitment:

- Candidates should be comfortable with a minimum 18-month commitment.