Data Scientist – Cyber Analytics

About the role

The team at PUNCH Cyber Analytics Group is seeking a Data Scientist to develop machine‑learning analytics that protect cyber operations. The role requires living in the Continental United States and eligibility for a SECRET clearance.

Key responsibilities

• Develop and evaluate unsupervised ML models for clustering, anomaly detection, behavioral baselining, novelty detection, and pattern discovery on large cyber datasets.
• Design features and models that handle concept drift, noisy data, limited ground truth, and high false‑positive rates in operational environments.
• Support asset discovery and entity resolution by building probabilistic asset graphs linking IPs, hostnames, MAC addresses, services, certificates, and device attributes.
• Collaborate with cyber analysts and detection engineers to translate operational questions into measurable features, experiments, and analytics.
• Implement production‑quality Python code and work with engineers to integrate models into sensor‑side CPU environments and GPU‑enabled enterprise platforms.

Required profile

• BS or MS in Data Science, Computer Science, Statistics, Applied Mathematics, Engineering, Cybersecurity, or a related quantitative discipline.
• Must reside in the Continental United States and be eligible for a SECRET level clearance.
• Strong understanding of unsupervised machine learning, clustering, anomaly detection, similarity methods, and statistical baselining.

Required skills

• Python programming with pandas, NumPy, scikit‑learn, SciPy.
• Experience with graph analytics/graph ML, entity resolution, probabilistic modeling, time‑series analysis, nearest‑neighbor methods, dimensionality reduction.
• Familiarity with networking and cybersecurity concepts (IP addressing, DNS, TLS, network flows, ports/services, routing, security alerts).
• Knowledge of cyber telemetry sources such as Zeek, PCAP‑derived data, SIEM, IDS/IPS alerts, and vulnerability/asset data.
• Experience with SQL, Elasticsearch, Splunk or similar analytic platforms.