Data Scientist

Punch Cyber Corp; Reston, Northern (VA, KY); Híbrido; USD 120 000 - 170 000; Tempo integral

Resumo da oferta

Punch Cyber Corp in Reston, VA seeks a data science/ML engineer to develop and evaluate machine-learning analytics for cyber defense using network telemetry, alerts, and asset data.

You will build unsupervised models for clustering, anomaly detection, and baselining, and apply graph analytics and time-series methods to large cyber datasets, balancing false positives with actionable insights.

Qualificações

• BS or MS in Data Science, CS, statistics, or related quantitative field.
• Strong Python skills with scientific/ML tooling (pandas, NumPy, scikit-learn, SciPy).
• Solid understanding of unsupervised ML and feature engineering.
• Experience with graph analytics, time-series, and anomaly detection.
• Experience with large, noisy heterogeneous datasets and limited ground truth.

Responsabilidades

• Develop and evaluate ML analytics for cyber defense using telemetry and alerts.
• Build unsupervised models for clustering, anomaly detection, and baselining.
• Apply graph analytics, embeddings, and nearest-neighbor methods to large datasets.
• Design features for concept drift, noisy data, and high false positives.
• Support asset discovery and entity resolution across data sources.
• Develop contextual features from security alerts and network telemetry.
• Turn analyst questions into measurable features and experiments.
• Evaluate model effectiveness with quantitative metrics and validation.
• Develop production-quality Python code for sensor-side and enterprise platforms.
• Understand LLMs vs conventional ML and deterministic rules where needed.

Conhecimentos

Python

Unsupervised ML

Feature engineering

Time-series analysis

Anomaly detection

Graph analytics

Statistical baselining

Data processing

NASA networking?

Formação académica

BS or MS in Data Science/CS/Statistics/Engineering

Ferramentas

Pandas

NumPy

scikit-learn

SciPy

Graph libraries

SQL/Data stores

Elasticsearch/Splunk

Descrição da oferta de emprego

About Us:

PUNCH Cyber Analytics Group (PUNCH) is a Virginia-based, small business founded in 2012 operating as a cohesive team that incorporates the sum of our group's diverse skills, talents, and resources toward our collective passion: advancing data analytics to impact cyber operations. PUNCH is a two-time Inc. Magazine 'Best Workplaces' awardee offering unique benefits and personal touches to provide a positive work-life experience for our team. PUNCH brings unique qualifications, resources, and past-performance that make us suitable to address the goals of our diverse customer-base. Further, we have past and current experience supporting cyber operations and cyber ML-based research, with well over 100 years of collective experience from our collaborative, multi-disciplinary team.

Responsibilities

• Develop and evaluate machine-learning analytics for cyber defense use cases using network, sensor, alert, asset, and other operational telemetry.
• Build unsupervised and statistical models for clustering, anomaly/outlier detection, behavioral baselining, novelty detection, and pattern discovery.
• Apply techniques such as graph analytics/embeddings, nearest-neighbor methods, time-series or periodicity analysis, clustering, dimensionality reduction, and anomaly scoring to large cyber datasets.
• Design models and features that account for concept drift, noisy data, incomplete ground truth, and high false-positive rates common in operational cyber environments.
• Support asset discovery and entity resolution, including development of probabilistic asset graphs that associate IPs, hostnames, MAC addresses, services, certificates, device attributes, and other observations across data sources.
• Develop contextual features from security alerts and network telemetry, including temporal patterns, rarity/frequency, communication behavior, entity context, and related activity, and use those features to identify meaningful alert clusters and outliers.
• Work with cyber analysts and detection engineers to turn operational questions and adversary behaviors into measurable features, experiments, and analytics.
• Evaluate model effectiveness using appropriate quantitative metrics and operational validation; benchmark accuracy, false-positive behavior, computational performance, and usefulness to analysts.
• Develop production-quality Python code and work with engineers to integrate models into sensor-side CPU environments as well as larger GPU-enabled enterprise analytics platforms.
• Understand the practical strengths and limitations of LLMs: know when to use an LLM, when to use conventional ML/statistics, and when a deterministic rule or query is the better answer.
• Ability to build evaluation harnesses rather than judge AI output by vibes - test datasets, expected behaviors, regression tests, failure cases, and quantitative measures.

Qualifications

• BS or MS in Data Science, Computer Science, Statistics, Applied Mathematics, Engineering, Cybersecurity, or a related quantitative discipline.
• Strong Python skills and hands-on experience with common scientific/ML tooling such as pandas, NumPy, scikit-learn, SciPy, and related libraries.
• Strong understanding of unsupervised machine learning, including clustering, anomaly/outlier detection, similarity/distance methods, feature engineering, and statistical baselining.
• Experience with at least some of the following: graph analytics or graph ML, entity resolution/record linkage, probabilistic modeling, time-series analysis, change-point/concept-drift detection, nearest-neighbor methods, or dimensionality reduction.
• Experience working with large, noisy, heterogeneous datasets where labels or authoritative ground truth are limited.
• Familiarity with scalable data processing and efficient model implementation; comfortable thinking about CPU/memory constraints as well as GPU acceleration for larger workloads.
• Working knowledge of networking and cybersecurity concepts such as IP addressing, DNS, TLS, network flows, ports/services, routing, network devices, and security alerts.
• Experience with cyber/network telemetry such as Zeek, PCAP-derived data, SIEM data, IDS/IPS alerts, device configuration data, or vulnerability/asset data is highly desirable.
• Experience with graph/network-analysis libraries, SQL/data stores, Elasticsearch/Splunk, or similar analytic platforms is a plus.
• Experience developing analytics for cybersecurity, threat hunting, detection engineering, or defensive cyber operations is strongly preferred.