Principal Machine Learning Engineer (Advanced Threat Protection)

Sourced from paloaltonetworks.wd5.myworkdayjobs.com

Palo Alto Networks is hiring a Principal Machine Learning Engineer to lead the architecture and delivery of AI-driven cloud security solutions. The role combines hands-on system design with technical leadership across agentic systems, LLM/SLM fine-tuning, GPU optimization, and large-scale data pipelines. You will drive products from prototype to enterprise-grade production and shape long-term technical strategy for Security-as-a-Service offerings.

• Architect ML/GenAI-powered agentic systems with multi-step execution and human-in-the-loop collaboration
• Build, evaluate, and fine-tune LLMs, SLMs, and multimodal architectures
• Diagnose model regressions and apply targeted fine-tuning such as SFT, DPO/RLHF, and PEFT/LoRA
• Profile and optimize model training and inference on GPU clusters
• Design scalable data preprocessing and feature extraction pipelines for real-time telemetry
• Establish production best practices for prompt architecture, agent memory, and safety guardrails
• Evaluate state-of-the-art agent frameworks and model serving engines to inform technical roadmaps

• 7+ years of professional software engineering experience deploying production ML, GenAI, or agentic systems at enterprise scale
• Advanced Python proficiency plus production-level Go or Java for distributed microservices
• Hands-on experience with Apache Spark, SQL, BigQuery, and Google Cloud (Dataproc, GKE, GCP SDKs)
• Operational experience with LLMs and SLMs, including fine-tuning and evaluation benchmarks
• GPU profiling and debugging experience (CUDA memory optimization, multi-GPU synchronization)
• Solid understanding of RAG, vector storage, prompt optimization, and applied statistical modeling
• BS or MS in Computer Science, Data Science, Software Engineering, or a related field

• Background in cybersecurity, threat detection, or cloud security
• Knowledge of L3–L7 networking protocols and packet inspection
• Experience with high-volume cybersecurity telemetry or real-time threat intelligence feeds