Machine Learning Engineer

AI Security Incubation & Innovation 

Security and Risk Engineering 

About the team 

The Security and Risk Engineering organization builds scalable, AI-powered security solutions that reduce risk and protect ServiceNow and its customers. We value AI-first thinking, clean architecture, intuitive experiences, and a culture of continuous learning. 

This is a zero-to-one incubation. We're building a new class of exposure analysis that ranks security work by exploitability (where an attacker could realistically get in) rather than raw severity. The architecture is evolving, and you'll help build it. 

The role 

As an ML Engineer, you'll build and ship LLM-powered features for a new exploitability engine. That means the services, retrieval pipelines and agent workflows that turn raw security signal into ranked, reachable attack paths. You'll work on well-scoped problems with senior engineers, learn how production AI systems are built and run, and take on more ownership as you grow. 

What you'll own 

• Well-scoped features and components, from design to production, with guidance from senior engineers. 
• The quality of what you ship: tests, evals and monitoring that show your work does what it should. 
• Pieces of the AI plumbing, such as prompts, retrieval, tool integrations and data connectors, and keeping them reliable. 
• LLMs/Agentic AI and MLOps are relevant, let's include those
What you'll do 

• Build backend services and APIs in Python that connect LLMs to enterprise security data. 
• Build LLM features using prompt engineering, structured outputs, tool/function calling, and retrieval (RAG, embeddings, vector search). 
• Help build and extend agent workflows that retrieve information, call tools, and recover from failures. 
• Write evals and automated tests that measure accuracy, latency and cost. 
• Build connectors that bring security evidence (vulnerability scanners, identity systems, asset inventories) into the platform. 
• Use AI coding agents such as Claude Code, Codex or Devin every day, and review their output carefully. 
• Prototype quickly to test new AI capabilities against real security problems. 
• Take part in code and design reviews, and learn the security domain from security R&D; and SecOps partners. 
•  
• What you bring 
• Strong Python. This is a must. 
• Solid software engineering fundamentals: data structures, APIs, testing, debugging. 
• Hands-on experience building something with LLMs, at work or in a substantial project: RAG, embeddings, tool calling or agents. 
• Experience calling at least one frontier model API or SDK (OpenAI, Anthropic, Google or equivalent). 
• Curiosity about security and a willingness to learn the domain on the job. 
• Clear communication, and comfort asking questions in a fast-moving, ambiguous environment. 
• You don't need a background in classical ML, statistics or data science. 
• Nice to have 

• Experience with AWS, Azure or GCP, containers, or CI/CD. 
• Exposure to AI evaluation, observability or guardrails. 
• Experience with vector databases or search. 
• Any exposure to security: vulnerability management, identity, threat detection, CTFs or coursework. 
• Open-source contributions.

Department: Engineering, Infrastructure and Operations
Function: Engineering
Experience Level: Not Applicable