BS or MS in Data Science, Computer Science, Statistics, Applied Mathematics, Engineering, Cybersecurity, or a related quantitative discipline.
Strong Python skills with experience in scientific/ML libraries like pandas, NumPy, and scikit-learn.
Deep understanding of unsupervised machine learning techniques such as clustering and anomaly detection.
Experience with graph analytics, entity resolution, and time-series analysis.
Familiarity with large, noisy datasets and limited authoritative ground truth.
Knowledge of networking and cybersecurity concepts, including IP addressing and security alerts.
Experience with cyber telemetry data like SIEM or IDS/IPS alerts is highly desirable.
Responsibilities
Develop machine-learning analytics for cyber defense using various operational telemetry.
Build models for clustering, anomaly detection, and pattern discovery.
Apply advanced techniques to analyze large cyber datasets.
Design models that handle noisy data and high false-positive rates.
Support asset discovery and create probabilistic asset graphs.
Develop contextual features from security alerts and network telemetry.
Collaborate with cyber analysts to translate operational questions into measurable features.
Evaluate model effectiveness using quantitative metrics and operational validation.
Write production-quality Python code and integrate models into analytics platforms.
Understand when to use LLMs versus conventional ML methods.
Benefits
Flexible work environment with remote options.
Opportunities for professional development and training.
Access to cutting-edge technology and tools.
Collaborative team culture focused on innovation.
Health and wellness programs to support employee well-being.
Full Job Description
Responsibilities
Develop and evaluate machine-learning analytics for cyber defense use cases using network, sensor, alert, asset, and other operational telemetry.
Build unsupervised and statistical models for clustering, anomaly/outlier detection, behavioral baselining, novelty detection, and pattern discovery.
Apply techniques such as graph analytics/embeddings, nearest-neighbor methods, time-series or periodicity analysis, clustering, dimensionality reduction, and anomaly scoring to large cyber datasets.
Design models and features that account for concept drift, noisy data, incomplete ground truth, and high false-positive rates common in operational cyber environments.
Support asset discovery and entity resolution, including development of probabilistic asset graphs that associate IPs, hostnames, MAC addresses, services, certificates, device attributes, and other observations across data sources.
Develop contextual features from security alerts and network telemetry, including temporal patterns, rarity/frequency, communication behavior, entity context, and related activity, and use those features to identify meaningful alert clusters and outliers.
Work with cyber analysts and detection engineers to turn operational questions and adversary behaviors into measurable features, experiments, and analytics.
Evaluate model effectiveness using appropriate quantitative metrics and operational validation; benchmark accuracy, false-positive behavior, computational performance, and usefulness to analysts.
Develop production-quality Python code and work with engineers to integrate models into sensor-side CPU environments as well as larger GPU-enabled enterprise analytics platforms.
Understand the practical strengths and limitations of LLMs: know when to use an LLM, when to use conventional ML/statistics, and when a deterministic rule or query is the better answer.
Ability to build evaluation harnesses rather than judge AI output by vibes-test datasets, expected behaviors, regression tests, failure cases, and quantitative measures.
Qualifications
BS or MS in Data Science, Computer Science, Statistics, Applied Mathematics, Engineering, Cybersecurity, or a related quantitative discipline.
Strong Python skills and hands-on experience with common scientific/ML tooling such as pandas, NumPy, scikit-learn, SciPy, and related libraries.
Strong understanding of unsupervised machine learning, including clustering, anomaly/outlier detection, similarity/distance methods, feature engineering, and statistical baselining.
Experience with at least some of the following: graph analytics or graph ML, entity resolution/record linkage, probabilistic modeling, time-series analysis, change-point/concept-drift detection, nearest-neighbor methods, or dimensionality reduction.
Experience working with large, noisy, heterogeneous datasets where labels or authoritative ground truth are limited.
Familiarity with scalable data processing and efficient model implementation; comfortable thinking about CPU/memory constraints as well as GPU acceleration for larger workloads.
Working knowledge of networking and cybersecurity concepts such as IP addressing, DNS, TLS, network flows, ports/services, routing, network devices, and security alerts.
Experience with cyber/network telemetry such as Zeek, PCAP-derived data, SIEM data, IDS/IPS alerts, device configuration data, or vulnerability/asset data is highly desirable.
Experience with graph/network-analysis libraries, SQL/data stores, Elasticsearch/Splunk, or similar analytic platforms is a plus.
Experience developing analytics for cybersecurity, threat hunting, detection engineering, or defensive cyber operations is strongly preferred.
