AI Ransomware Behavior Detection Engineer

Delven Labs

Remote · $130k – $160k / year · Full-time · Posted 4 months ago

This role is no longer accepting applications

Don't miss the next role like this

Create a free profile with your skills. We match you to new AI roles as they open, and companies hiring can contact you directly.

Create free profile, 2 minutes

Similar open roles you can apply to now:

See all open AI jobs

This role is no longer accepting applications

Don't miss the next role like this

Create a free profile with your skills. We match you to new AI roles as they open, and companies hiring can contact you directly.

Create free profile, 2 minutes

Similar open roles you can apply to now:

See all open AI jobs

About the role

Signature-based ransomware detection is a cat-and-mouse game that defenders consistently lose: a new variant bypasses known signatures within hours of deployment. Behavioral detection — identifying the characteristic activity patterns of ransomware execution regardless of the specific malware family — is the approach that detects novel variants before they complete encryption. We provide endpoint and network behavioral analytics to 65 enterprise security teams. Ransomware behavioral detection is our highest-priority gap: the behavioral signatures of ransomware are identifiable (rapid file enumeration, shadow copy deletion, bulk file encryption with entropy increase) but current detection models generate too many false positives on legitimate backup and archiving operations to be operationally useful. You'll redesign the ransomware behavioral detection models: building features that distinguish ransomware from legitimate high-volume file operations, implementing sequential behavioral analysis that identifies the execution chain rather than isolated events, and reducing false positive rates to operational thresholds while maintaining detection speed. The stakes are concrete — late detection costs clients millions per incident.

Fully remote.

Responsibilities

Design behavioral features distinguishing ransomware execution from legitimate high-volume file operations
Build sequential behavioral models detecting the multi-stage ransomware execution chain
Implement false positive reduction approaches maintaining high detection rate at operational FPR thresholds
Develop near-real-time detection pipeline meeting 30-second detection latency targets
Create adversarial robustness against known evasion techniques targeting behavioral detection
Validate detection against new ransomware variant samples before production deployment

Requirements

6+ years in ML engineering with cybersecurity, malware analysis, or endpoint detection experience
Deep understanding of ransomware behavior patterns, file system activity, and evasion techniques
Strong Python and ML skills with behavioral sequence modeling experience
Experience with EDR telemetry data and endpoint behavioral analytics
Track record reducing false positive rates in production security detection systems