AI
Machine Learning Engineer (Security LLM)
Train, fine-tune and evaluate the security LLM that powers the Prava AI assistant and analysis features. You will build the evaluation sets and serving paths that keep the model accurate, safe and useful to security teams.
About the role
Why this role exists
Prava AI is built around SwiftSafe's own LLM and detection models. The assistant answers analysts' questions, and the model also supports analysis across modules such as threat intelligence, malware analysis and forensics. Security is a domain where a confident wrong answer is worse than no answer, so the model has to be measured carefully.
This role owns a large part of that model lifecycle. You will prepare training data, run fine-tuning experiments, and build the evaluation sets that show whether a change made the model better or worse at real security tasks. You will also work on the serving path so that improvements reach customers reliably, in their own region.
You will work closely with security researchers, detection engineers and analysts, who supply domain knowledge and judge the outputs. Part of the job is turning their expertise into data and evaluations a model can learn from and be tested against. How we handle data for AI features is described on our AI and data use page, and that page governs this work.
Responsibilities
What you will do
- Prepare and curate training and fine-tuning datasets for security tasks, with clear provenance and documented licensing.
- Run fine-tuning and alignment experiments, track results, and write up what worked, what did not and why.
- Build evaluation sets with domain experts that cover accuracy, refusal behaviour, hallucination and resistance to prompt injection.
- Measure model behaviour on tasks such as explaining alerts, summarising incidents and reasoning about attack paths, and report regressions before release.
- Work on inference and serving: latency, cost, batching and safe rollout across regional deployments.
- Add guardrails and monitoring so that the assistant behaves predictably and its failure modes are visible.
- Keep experiments reproducible, with versioned data, configuration and model artefacts.
Requirements
What you will bring
We care about what you can do, not where or how you learned it. If you meet most of these, we would like to hear from you.
- Experience training or fine-tuning language models and shipping the results to production.
- Strong Python and practical experience with a deep learning framework such as PyTorch.
- Experience designing evaluations: choosing metrics, building test sets and noticing when a benchmark no longer reflects reality.
- Familiarity with parameter-efficient fine-tuning, preference-based alignment methods or retrieval-augmented generation.
- An understanding of how LLM applications fail, including hallucination, prompt injection and data leakage.
- Care with data: provenance, licensing, privacy and the difference between data you may use and data you merely have.
- The ability to explain results honestly to people who are not machine learning specialists.
Nice to have
Helpful, not required
Domain
Security background
Experience in security operations, research or analysis, or a strong interest in learning it.
Serving
Inference engineering
Experience with model serving frameworks, quantisation or GPU scheduling.
Safety
Red teaming models
Experience adversarially testing LLMs or building safety evaluations.
Data
Synthetic data
Experience generating and validating synthetic training data without degrading quality.
Your first months
What progress looks like
These are typical outcomes, not fixed targets. Your manager will agree goals with you when you join.
First month
Settle in
You have reproduced a recent training or evaluation run, learned the current data pipeline and evaluation suite, and met the domain experts you will work with.
First three months
Contribute
You have shipped an improvement to the evaluation suite or a fine-tuning experiment with a clear, written result, whether or not it moved the model forward.
First six months
Own
You own a part of the model lifecycle, such as a task area's evaluations or the serving path for a region, and your measurements inform release decisions.
Tools and environment
How you will work
You will work with tools such as PyTorch, the Hugging Face ecosystem, experiment tracking tools, distributed training libraries and inference servers such as vLLM, running on GPU infrastructure orchestrated with Kubernetes. Evaluation work uses Python, notebooks and purpose-built test harnesses.
Training and evaluation data are handled under documented rules, and customer data stays in its region. Specific internal tooling is covered during onboarding.
Hiring process
How we hire for this role
This follows our usual hiring process, adapted to the role. We reply to every application and tell you in advance what each stage involves.
- Application. Your CV and a short note. Links to code, papers or model work are welcome.
- Introductory call. Your experience, the problems you enjoy and what you want next.
- Technical conversation. A discussion of a model you trained or evaluated, and how you knew it was working.
- Practical exercise. A scoped evaluation-design exercise on a small, synthetic security task. We do not use your work in our product.
- Final conversations and offer. Time with leadership, then a written offer from an @prava.dev address.
Security and ethics
Working responsibly
Note. This role works with training data and model outputs that may relate to security incidents. Data handling follows our AI and data use commitments and keeps customer data in its region. Offers may be subject to background checks where the law allows.
We never ask candidates for payment, bank details or fees, and interviews and offers come only from @prava.dev addresses. Read more about recruitment fraud and how we handle your application data under our Privacy Policy.
Benefits
What we offer
Benefits vary by country and employing entity, and the specifics are set out in each offer. They include pay set for the role and location, health cover, paid leave, support for learning, the equipment you need and working arrangements that suit the role. See benefits on the careers page. We are an equal opportunity employer; if you need an adjustment at any stage, tell us at careers@prava.dev.
Other open roles
Explore the team
- Security Researcher (Offensive) · Research
- DFIR Analyst · Detection and response
- Threat Intelligence Analyst (Dark Web) · Intelligence
- Backend Engineer (Platform) · Engineering
- Detection Engineer · Detection and response
- Solutions Engineer · Customers
- Compliance and GRC Specialist · Customers
Do not see the right fit? Send a general application.
Next step
Apply for this role
Send your CV and a short note about a model you trained or evaluated and what you learned. Code samples, papers or repositories are welcome; tell us which parts were yours. The Apply button opens an email to careers@prava.dev with the role in the subject line.