Python Developer – AI-Assisted Security Detection Fine-Tuning Engine (PoC)

We are looking for an experienced Python developer to build a Proof of Concept (PoC) for an **AI-Assisted Security Detection Fine-Tuning Engine**, focused on Microsoft Sentinel and Microsoft Defender XDR. **Project Objective** Develop a Python-based application that analyses historical security events, alerts, detection rules and investigation outcomes to identify noisy detections and recommend safe, evidence-backed tuning improvements. The engine must distinguish legitimate recurring activity from potentially malicious behaviour, estimate the impact of proposed tuning changes and flag recommendations that could weaken detection coverage. **Technical Requirements** - Python-based data ingestion and analysis using CSV/Parquet datasets. - Data validation, normalisation and source provenance. - Detection-rule performance analysis and noisy-rule ranking. - Recurring pattern analysis across users, IP addresses, devices, processes and resources. - Deterministic historical impact calculations. - Detection of known malicious activity affected by proposed exclusions. - Evidence-grounded AI explanations using an optional OpenAI or Anthropic integration. - Support for curated Microsoft Learn, MITRE ATT&CK and Sigma references. - Streamlit dashboard for reviewing findings and recommendations. - Human approval workflow with Accept / Reject / Investigate options. - JSON/CSV export. - Automated tests and technical documentation. **Milestones** **Milestone 1 — $350 (4–5 working days)** Data ingestion, normalisation, validation, provenance tracking and noisy-rule analysis. **Milestone 2 — $400 (5–6 working days)** Recurring-pattern identification, tuning recommendations, historical impact estimation and safety validation. **Milestone 3 — $350 (approximately 5 working days)** Streamlit dashboard, optional grounded AI integration, human review workflow, export, testing and documentation. **Total Fixed Budget: $1,100 USD** **Important Constraints** The PoC will use offline synthetic datasets. Live Microsoft Sentinel/Defender XDR integration, automatic production rule changes and automated alert suppression are outside the scope. All recommendations must be supported by traceable evidence. AI-generated explanations must not invent measurements, investigation outcomes or supporting references. The application must remain functional without an AI API key. **Deliverables and Acceptance** Each milestone has defined deliverables and measurable acceptance criteria. Source code, test datasets, automated tests and documentation must be provided. The attached requirements document contains the complete technical specification, acceptance criteria and milestone sign-off conditions. Please review the attached document and confirm that the scope, deliverables, budget and estimated timeline are achievable before starting development.