PUNCH Cyber Analytics Group

Data Scientist

• Develop and evaluate machine-learning analytics for cyber defense use cases using network, sensor, alert, asset, and other operational telemetry
• Build unsupervised and statistical models for clustering, anomaly/outlier detection, behavioral baselining, novelty detection, and pattern discovery
• Apply graph analytics/embeddings, nearest-neighbor methods, time-series or periodicity analysis, clustering, dimensionality reduction, and anomaly scoring to large cyber datasets
• Design models and features accounting for concept drift, noisy data, incomplete ground truth, and high false-positive rates in operational cyber environments
• Support asset discovery and entity resolution, including probabilistic asset graphs associating IPs, hostnames, MAC addresses, services, certificates, device attributes, and other observations across data sources
• Develop contextual features from security alerts and network telemetry to identify meaningful alert clusters and outliers
• Work with cyber analysts and detection engineers to translate operational questions and adversary behaviors into measurable features, experiments, and analytics
• Evaluate model effectiveness using quantitative metrics and operational validation; benchmark accuracy, false-positive behavior, computational performance, and usefulness to analysts
• Develop production-quality Python code and work with engineers to integrate models into sensor-side CPU environments and GPU-enabled enterprise analytics platforms
• Determine when to use LLMs, conventional ML/statistics, or deterministic rules and queries
• Build evaluation harnesses with test datasets, expected behaviors, regression tests, failure cases, and quantitative measures

Explore Data Scientist at PUNCH Cyber Analytics Group. Review requirements and application details.