Machine Learning Engineer

AI Security Incubation & Innovation Security and Risk Engineering About the team The Security and Risk Engineering organization builds scalable, AI-powered security solutions that reduce risk and protect ServiceNow and its customers. We value AI-first thinking, clean architecture, intuitive experiences, and a culture of continuous learning. This is a zero-to-one incubation. We're building a new class of exposure analysis that ranks security work by exploitability (where an attacker could realistically get in) rather than raw severity. The architecture is evolving, and you'll help build it. The role As an ML Engineer, you'll build and ship LLM-powered features for a new exploitability engine. That means the services, retrieval pipelines and agent workflows that turn raw security signal into ranked, reachable attack paths. You'll work on well-scoped problems with senior engineers, learn how production AI systems are built and run, and take on more ownership as you grow. What you'll own Well-scoped features and components, from design to production, with guidance from senior engineers. The quality of what you ship: tests, evals and monitoring that show your work does what it should. Pieces of the AI plumbing, such as prompts, retrieval, tool integrations and data connectors, and keeping them reliable. LLMs/Agentic AI and MLOps are relevant, let's include those What you'll do Build backend services and APIs in Python that connect LLMs to enterprise security data. Build LLM features using prompt engineering, structured outputs, tool/function calling, and retrieval (RAG, embeddings, vector search). Help build and extend agent workflows that retrieve information, call tools, and recover from failures. Write evals and automated tests that measure accuracy, latency and cost. Build connectors that bring security evidence (vulnerability scanners, identity systems, asset inventories) into the platform. Use AI coding agents such as Claude Code, Codex or Devin every day, and review their output carefully. Prototype quickly to test new AI capabilities against real security problems. Take part in code and design reviews, and learn the security domain from security R&D and SecOps partners. What you bring Strong Python. This is a must. Solid software engineering fundamentals: data structures, APIs, testing, debugging. Hands-on experience building something with LLMs, at work or in a substantial project: RAG, embeddings, tool calling or agents. Experience calling at least one frontier model API or SDK (OpenAI, Anthropic, Google or equivalent). Curiosity about security and a willingness to learn the domain on the job. Clear communication, and comfort asking questions in a fast-moving, ambiguous environment. You don't need a background in classical ML, statistics or data science. Nice to have Experience with AWS, Azure or GCP, containers, or CI/CD. Exposure to AI evaluation, observability or guardrails. Experience with vector databases or search. Any exposure to security: vulnerability management, identity, threat detection, CTFs or coursework. Open-source contributions. Qualifications 2+ years of software engineering experience, or equivalent practical experience. Strong programming experience in Python. Experience building or integrating LLM-powered applications, in production or in substantial projects. Working knowledge of APIs, databases and cloud-native development. Bachelor's degree in Computer Science or a related field, or equivalent practical experience. What success looks like Ship: Take a scoped feature from ticket to production with tests and evals in place. Build AI-native: Choose the right LLM technique for a problem, and know when not to use one. Learn fast: Get productive in the codebase and the security domain quickly. Grow: Need less guidance over time and take on bigger parts of the system. For positions in this location, we offer a base pay of $139,700 - $216,500 , plus equity (when applicable), variable/incentive compensation and benefits. Sales positions generally offer a competitive On Target Earnings (OTE) incentive compensation structure. Please note that the base pay shown is a guideline, and individual total compensation will vary based on factors such as qualifications, skill level, competencies, and work location. We also offer health plans, including flexible spending accounts, a 401(k) Plan with company match, ESPP, matching donations, a flexible time away plan and family leave programs. Compensation is based on the geographic location in which the role is located and is subject to change based on work location. Work Personas We approach our distributed world of work with flexibility and trust. Work personas (flexible, remote, or required in office) are categories that are assigned to ServiceNow employees depending on the nature of their work and their assigned work location. Learn more here . To determine eligibility for a work persona, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service. Equal Opportunity Employer ServiceNow is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, national origin, age, disability, gender identity, veteran status, or any other category protected by law. In addition, all qualified applicants with arrest or conviction records will be considered for employment in accordance with legal requirements. Accommodations We strive to create an accessible and inclusive experience for all candidates. If you require a reasonable accommodation to complete any part of the application process, or are unable to use this online application and need an alternative method to apply, please contact globaltalentss@servicenow.com for assistance. Export Control Regulations For positions requiring access to controlled technology subject to export control regulations, including the U.S. Export Administration Regulations (EAR), ServiceNow may be required to obtain export control approval from government authorities for certain individuals. All employment is contingent upon ServiceNow obtaining any export license or other approval that may be required by relevant export control authorities. From Fortune. ©2026 Fortune Media IP Limited. All rights reserved. Used under license.