Description
Enterprises of all sizes trust Abnormal's AI-native security products to stop cybercrime and protect critical communications, identities, and infrastructure in the cloud.
As a Software Engineer II on the ADEX Team, you are a highly capable detection feature owner: you take a detection problem, come up with an idea, design a technical approach, and drive it end-to-end, from design and implementation through launch, operation, and continuous improvement.
The Advanced Detection of EXtended threats (ADEX) is an attack-detection team inside Abnormal's Detection org. We own several of the highest-visibility detection surfaces at the company, spanning attachment-based attacks, fraud, and impersonation.
Responsibilities
- Design, build, and operate detection that is core to Abnormal's products, from initial design through rollout, monitoring, and ongoing maintenance.
- Own detection projects end-to-end, including those that begin with a degree of ambiguity: scope loosely defined problems, identify risks, define milestones, and deliver reliably.
- Analyze attacks that get through. Pull and study missed-attack data, read the messages the way an attacker and an analyst would, identify the underlying pattern, and translate it into detection enhancements or entirely new detection systems.
- Write and tune detection logic using scored signals and attributes, add new signals across the pipeline, and drive changes to launch with a strong focus on minimizing false positives.
- Build and evaluate LLM-based detection agents, and measure precision and recall rigorously with our evaluation tooling.
- Surface your detections as reusable intelligence that other products and teams across the platform can consume.
- Participate in the on-call rotation for your detection surfaces, debug and resolve customer escalations, and feed learnings back into design, observability, and runbooks across regions.
- Leverage AI as a core part of your development loop for code, tests, data analysis, experiments, and documentation, while maintaining strong engineering judgment and validation practices.
- Contribute to team health and culture by documenting heavily, sharing learnings, and giving thoughtful feedback in code and design reviews.
Requirements
- 3+ years of professional software engineering experience, with a track record of shipping and operating production systems.
- Strong software engineering fundamentals: data structures, algorithms, system design basics, testing, debugging, and clean, maintainable code.
- Strong Python proficiency and comfort learning new languages and frameworks as needed.
- Solid data-analysis instincts. You are comfortable with SQL and reasoning over large datasets to find signals in noise.
- A detection or adversarial mindset. You enjoy thinking like an attacker, reading real attack samples, and asking, "How would I get past this?"
- Genuine fluency with AI-native development. You already use AI coding agents in your daily work and are excited to build LLM-powered detection, not just consume AI tools.
- Demonstrated ability to own projects that carry some initial ambiguity: clarify and scope loosely defined requirements, make tradeoffs explicit, deliver on time, and communicate status clearly.
- Excellent written and verbal communication, especially in remote, distributed teams.
- A strong growth mindset and sense of ownership.
Nice to Have
- Experience with distributed systems, high-throughput pipelines, or large-scale data stores (e.g., PostgreSQL, DynamoDB, Redis, RocksDB, Kafka, Spark, OpenSearch/Elasticsearch).
- Background in security, threat detection, anti-abuse, fraud detection, or trust and safety, particularly systems processing high volumes of email or communication data.
- Experience with ML or LLM evaluation: precision/recall tradeoffs, eval harnesses, prompt iteration.
- Familiarity with domain and DNS concepts (such as typosquatting and homoglyphs) or with identity and impersonation signals.
- Experience with large-scale data tooling (e.g., Databricks, Spark, Airflow) and distributed pipelines.
- Experience with containerization and orchestration (Docker, Kubernetes) and infrastructure-as-code tooling.
- Familiarity with modern frontend frameworks (e.g., React) for full-stack roles, or with ML/ML Ops for Detection/MLE-focused roles.
- Prior experience in a fast-paced, high-growth startup environment where you've had to balance speed, quality, and ambiguity.