Senior Cybersecurity Data Scientist - Predictive Security

Empirical Security; Chicago (IL); On-site; USD 120,000 - 180,000; Full time

Job summary

Empirical Security is seeking a Security Data Scientist to own end-to-end modeling for vulnerability predictions. You will design, train, and deploy models using ground-truth telemetry across cloud, appsec, and traditional environments.

Expect to tackle extreme class imbalance and to explain results to executives with clear uncertainty quantification. The role involves building features from scanner output, EDR, asset inventory, identity, and cloud posture while ensuring robust monitoring and

Qualifications

• Proven ML models in production with real impact.
• Fluency in Python and SQL with version control discipline.
• Experience handling extreme class imbalance and advanced methods (survival/Bayesian/causal).
• Ability to explain uncertainty and model results to executives.

Responsibilities

• Design, train, and deploy exploit-prediction models.
• Evaluate models for precision, recall, coverage, calibration.
• Address extreme class imbalance in CVE exploitation data.
• Develop hierarchical, partial-pooling models for cold-starts.
• Engineer features from scanner output, EDR, assets, identity, cloud posture.
• Monitor drift and maintain models in production.
• Publish methodology, benchmarks, and open results.
• Collaborate with engineering to move models into production systems.

Skills

Applied ML

Python

SQL

Version control

Reproducible pipelines

Explainability

Uncertainty quantification

Model deployment

Tools

Git

Jupyter

Python libraries

Job description

Empirical Security is seeking a Security Data Scientist to own end-to-end modeling for vulnerability predictions. You will design, train, and deploy models using ground-truth telemetry across cloud, appsec, and traditional environments.

Expect to tackle extreme class imbalance and to explain results to executives with clear uncertainty quantification. The role involves building features from scanner output, EDR, asset inventory, identity, and cloud posture while ensuring robust monitoring and