? We’re Hiring | AI/ML Engineer – Correlation Engine | Terralogic

Terralogic is looking for an experienced AI/ML engineer to join our team and work on an exciting cybersecurity-focused correlation engine.

This is not a pure ML research role. You’ll be building and shipping production AI/ML systems that analyse security events, detect behavioural anomalies, correlate multi-stage attack chains, and help SOC teams make better decisions.

YOE: 3+ Years

Job location: Bangalore

Notice period: Immediate to 30 days

Required Qualifications

- 3–5 years of experience in applied ML / data science, with at least one production system involving anomaly detection, behavioral baselining, or time-series / event-sequence modeling.
- Strong Python and TypeScript/Node.js skills, and comfort working in a backend service — this role ships production code inside a Kafka/Redis/MongoDB microservice, not just models.
- Solid grasp of statistics relevant to anomaly detection: rolling baselines, peer-group / cohort comparison, confidence intervals, false-positive rate management.
- Working knowledge of graph data structures and graph algorithms (path finding, community detection, or similar) — or strong motivation to apply that to a live entity relationship graph.
- Experience with event-driven or streaming architectures (Kafka, Redis Streams/sorted sets, or comparable) and an understanding of sliding-window / windowed aggregation patterns.
- Comfort reading and reasoning about security telemetry (authentication logs, endpoint events, network flow, cloud audit logs).
- Experience serving open-source LLMs locally/on-prem (e.g., Qwen, Llama) with tools such as vLLM, Ollama, or TGI — all AI inference in this stack runs on self-hosted open-source models, not cloud AI APIs.

Preferred / Nice to Have

- Prior exposure to SIEM, XDR, UEBA, or fraud-detection systems, or familiarity with MITRE ATT&CK-style; attack chain modeling.




- Hands-on experience with Wazuh or a similar open-source SIEM/XDR platform — its decoders, rules, and correlation engine are a useful reference point for this role.
- Experience with SIGMA detection rules or other vendor-neutral detection rule formats.
- Familiarity with NestJS, MongoDB, and Redis in a microservice setting.
- Experience fine-tuning or prompt-engineering open-source models (Qwen or similar) for classification,

summarisation, or reasoning tasks in a security context.
- Exposure to graph databases or graph-analytics libraries (e.g., Neo4j, NetworkX, or similar) applied to security or fraud use cases.

Tech Stack :

- Backend: NestJS / TypeScript microservices, MongoDB (entity graph + event collections), Redis (sliding windows, caching), Kafka (enriched event streams).
- ML / analytics: Python for model development and offline evaluation; statistical and graph libraries as needed; self-hosted open-source LLMs (Qwen family) served locally for classification and reasoning tasks — no cloud AI APIs in this stack.
- Open-source security tooling: Wazuh (or similar open-source SIEM/XDR) as a reference implementation for decoders, rules, and correlation patterns.

What Success Looks Like

- The correlation rule library and entity graph reliably catch multi-stage attack chains (credential theft → lateral movement → exfiltration) that no single-event rule would flag, with an explainable reasoning trail for each verdict.
- False-positive rate on correlated incidents stays low enough that SOC analysts trust and act on them without alert fatigue.
- The behavioral/statistical layer (peer-group and individual baselines) is tightly integrated with UEBA scoring, so correlation and behavioral anomaly detection reinforce rather than duplicate each other.
- New correlation rules—including SIGMA imports — can be added or tuned by the security team without engineering involvement, thanks to the hot-reloadable rule registry you help maintain.

? Commitment: Candidates should be comfortable with a minimum 18-month commitment

📌 AI/ML Engineer (Bengaluru)
🏢 TERRALOGIC
📍 Bengaluru