Profile cover
E

AI Ransomware Behavior Detection Engineer

Eliana Magnusson

Full-time · Job · New_York

About the role

Signature-based ransomware detection is a cat-and-mouse game that defenders consistently lose: a new variant bypasses known signatures within hours of deployment. Behavioral detection — identifying the characteristic activity patterns of ransomware execution regardless of the specific malware family — is the approach that detects novel variants before they complete encryption. We provide endpoint and network behavioral analytics to 65 enterprise security teams. Ransomware behavioral detection is our highest-priority gap: the behavioral signatures of ransomware are identifiable (rapid file enumeration, shadow copy deletion, bulk file encryption with entropy increase) but current detection models generate too many false positives on legitimate backup and archiving operations to be operationally useful. You'll redesign the ransomware behavioral detection models: building features that distinguish ransomware from legitimate high-volume file operations, implementing sequential behavioral analysis that identifies the execution chain rather than isolated events, and reducing false positive rates to operational thresholds while maintaining detection speed. The stakes are concrete — late detection costs clients millions per incident.

Responsibilities

  • Design behavioral features distinguishing ransomware execution from legitimate high-volume file operations
  • Build sequential behavioral models detecting the multi-stage ransomware execution chain
  • Implement false positive reduction approaches maintaining high detection rate at operational FPR thresholds
  • Develop near-real-time detection pipeline meeting 30-second detection latency targets
  • Create adversarial robustness against known evasion techniques targeting behavioral detection
  • Validate detection against new ransomware variant samples before production deployment

Requirements

  • 6+ years in ML engineering with cybersecurity, malware analysis, or endpoint detection experience
  • Deep understanding of ransomware behavior patterns, file system activity, and evasion techniques
  • Strong Python and ML skills with behavioral sequence modeling experience
  • Experience with EDR telemetry data and endpoint behavioral analytics
  • Track record reducing false positive rates in production security detection systems

Benefits

  • Fully remote with flexible schedule
  • Comprehensive health benefits
  • $4,000 annual professional development budget
  • Equity participation
  • Security conference budget

Keep exploring related roles

Use these topic pages to discover more roles in the same hiring cluster.

Job Type

Full-time

Level

Senior

Language

English

Salary Range

$130k – $160k / year

AI Expertise

MLOps & AI Infrastructure AI & Machine Learning Engineers

Skills

python pytorch scikit-learn docker spark sql

Ready to apply for this role?

Create a free talent account in under 2 minutes.

  • Apply to verified AI companies
  • Get AI-matched job recommendations
  • Message hiring managers directly
  • Build your public AI talent profile

Interested in this role? Create your free profile to apply.

Apply — create free profile