Senior AI/ML Engineer, Security Log Intelligence
RedMimicry GmbH · Berlin
What this role requires
4 requirements, read out of the advert rather than guessed from the job title:
Also mentioned, not required: Semantic retrieval, Ranking, Classification, Information extraction, Approximate nearest-neighbour search, Vector indices, Recall@K, MRR, F1, Exact match, Calibration, Ablation studies, Dataset construction, APIs, Distributed services, Containerised environments, Security logs, SIEM, EDR, NDR. Worth having, but their absence is not what gets a CV filtered out.
See how often each of these is required across open data roles in Europe.
Free, no card. Tells you which of them your CV evidences and which it only implies.
Job description
We are building a new capability that turns fragmented, noisy security logs into explainable, AI-powered threat analysis, delivered inside the RedMimicry platform.
As Senior AI/ML Engineer at RedMimicry, you will lead the applied AI/ML work behind new analysis capabilities for our breach and attack emulation platform. The core challenge is extracting useful structure from heterogeneous, partially unstructured security telemetry and relating it to known attacker activity.
The problem is broader than prompt engineering. You will determine where LLMs, embeddings, retrieval, learned ranking, and deterministic heuristics are justified. The standard is measurable improvement against reproducible baselines, not architectural fashion. Everything you build must operate under realistic latency, reliability, and deployment constraints.
This is a fixed-term position running until 31 October 2027.
Tasks
Develop Security-Log Parsing Methods: Design and implement methods for extracting typed events from heterogeneous SIEM, EDR, NDR, operating-system, and network telemetry.
Read the full description (43 more sections)Show less
Design Embeddings and Retrieval: Select, evaluate, and tune representations and retrieval methods for security events.
Handle Ambiguity Explicitly: Implement confidence scoring, calibration, and controlled treatment of ambiguous evidence.
Ground Results in Evidence: Ensure that results are supported by traceable evidence from the original telemetry.
Build Rigorous Evaluations: Define datasets, baselines, ablations, and metrics, and analyse failure modes systematically.
Optimise Inference: Make the pipeline practical for cloud operation and on-premises deployment.
Productise the Research: Work with backend, integration, and offensive-security engineers to turn experimental methods into maintainable services.
Document the Work: Produce clear experiment records, architecture decisions, and technical reports.
Contribute to Academic Research: Contribute, at minimum as a co-author, to an academic research paper published in the context of the project.
Requirements
You do not need to meet every requirement to apply. We care more about demonstrated depth, sound experimental judgement, and the ability to ship reliable systems than about a specific academic title.
Machine Learning and LLM Systems
Strong Python programming skills
Practical experience with PyTorch or a comparable framework
Experience with open-weight language models, structured outputs, embeddings, or retrieval systems
Experience with fine-tuning, PEFT, quantisation, model serving, or inference optimisation
Understanding of hallucination, calibration, distribution shift, and model failure analysis
Information Retrieval and Evaluation
Semantic retrieval, ranking, classification, or information extraction
Approximate nearest-neighbour search and vector indices
Evaluation using metrics such as Recall@K, MRR, F1, exact match, calibration, and ablation studies
Dataset construction, partitioning, and reproducible benchmarking
Software Engineering
Ability to turn experimental code into maintainable production components
Testing, profiling, observability, and performance analysis
Experience working with APIs, distributed services, and containerised environments
Cybersecurity Knowledge
Security logs, SIEM, EDR, NDR, detection engineering, incident response, or threat hunting are strong advantages
Understanding of endpoint, process, identity, and network telemetry is a plus
Research Background
MSc, PhD, or equivalent practical research experience in computer science, machine learning, data science, mathematics, or a related field
Ability to read, reproduce, and critically evaluate current research
Languages
English (required)
German (a plus)
Benefits
Work from anywhere in Germany, and use our Berlin office as often as you like
30 days of paid time off, and a quiet inbox while you are away
Company-paid Deutschlandticket
Annual budget for the courses and certifications you pick yourself
Modern tooling and extensive use of AI
Light process, clear communication, focus on what really matters
A close match is enough. If the role speaks to you, apply with your CV and anything else you would like us to see. What follows is short and transparent, a few conversations with the team and then your first week in Berlin. We are an equal opportunity employer and welcome applications from all backgrounds and genders. Questions about the role or the process are welcome at any point.
Find Jobs in Germany on Arbeitnow
You will apply. Then you will hear nothing.
And no one will tell you what was wrong. See it before you send: your ATS score, every weak line, and the fix for each.
- 1
Drop in your CV
One PDF, thirty seconds. No card.
- 2
See what is wrong with it
Every weak passage, quoted from your own CV, with the line to replace it.
- 3
Apply where you fit
Every European role ranked against what your CV actually says.
What's actually stopping you?
- I apply and hear nothing backStart with the ATS scan — see what a filter does to your CV before a human sees it.Start here →
- I can't tell which roles I'd getStart with the match scores — every listing here ranked against what your CV actually says.Start here →
- Just browsing for nowKeep looking. Nothing to sign up for.
- Free, no card
- Your CV file is deleted after parsing
- Refreshed every 6 hours