Data Scientist

PUNCH Cyber Analytics Group

. Develop and evaluate machine-learning analytics for cyber defense use cases using network, sensor, alert, asset, and other operational telemetry .

Posted 10/8/2026full-timeRemote • Virginia • United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in developing machine-learning models for cyber defense, utilizing strong Python programming skills and experience with data analytics libraries. Proficient in handling large, noisy datasets and applying advanced techniques such as clustering, anomaly detection, and graph analytics.

Highest-signal resume keywords

Python ProgrammingUnsupervised Machine LearningGraph AnalyticsCybersecurity ConceptsData Processing

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Machine LearningClusteringAnomaly DetectionFeature EngineeringStatistical BaseliningTime-Series AnalysisDimensionality ReductionProbabilistic ModelingEntity ResolutionChange-Point Detection

Tools & Technologies

PandasNumPyScikit-LearnSciPySQLElasticsearchSplunkZeekPCAPSIEM

Industry Keywords

Cyber DefenseThreat HuntingDetection EngineeringOperational TelemetryNetwork Flows

Tech Stack

Tools & technologies

Cyber SecurityDNSElasticSearchNumpyPandasPythonScikit-LearnSplunkSQL

About the role

Key responsibilities & impact

Develop and evaluate machine-learning analytics for cyber defense use cases using network, sensor, alert, asset, and other operational telemetry
Build unsupervised and statistical models for clustering, anomaly/outlier detection, behavioral baselining, novelty detection, and pattern discovery
Apply graph analytics/embeddings, nearest-neighbor methods, time-series or periodicity analysis, clustering, dimensionality reduction, and anomaly scoring to large cyber datasets
Design models and features accounting for concept drift, noisy data, incomplete ground truth, and high false-positive rates in operational cyber environments
Support asset discovery and entity resolution, including probabilistic asset graphs associating IPs, hostnames, MAC addresses, services, certificates, device attributes, and other observations across data sources
Develop contextual features from security alerts and network telemetry to identify meaningful alert clusters and outliers
Work with cyber analysts and detection engineers to translate operational questions and adversary behaviors into measurable features, experiments, and analytics
Evaluate model effectiveness using quantitative metrics and operational validation; benchmark accuracy, false-positive behavior, computational performance, and usefulness to analysts
Develop production-quality Python code and work with engineers to integrate models into sensor-side CPU environments and GPU-enabled enterprise analytics platforms
Determine when to use LLMs, conventional ML/statistics, or deterministic rules and queries
Build evaluation harnesses with test datasets, expected behaviors, regression tests, failure cases, and quantitative measures

Requirements

What you’ll need

BS or MS in Data Science, Computer Science, Statistics, Applied Mathematics, Engineering, Cybersecurity, or a related quantitative discipline
Strong Python skills
Hands-on experience with pandas, NumPy, scikit-learn, SciPy, and related libraries
Strong understanding of unsupervised machine learning, including clustering, anomaly/outlier detection, similarity/distance methods, feature engineering, and statistical baselining
Experience with graph analytics or graph ML, entity resolution/record linkage, probabilistic modeling, time-series analysis, change-point/concept-drift detection, nearest-neighbor methods, or dimensionality reduction
Experience working with large, noisy, heterogeneous datasets where labels or authoritative ground truth are limited
Familiarity with scalable data processing and efficient model implementation
Comfortable thinking about CPU/memory constraints and GPU acceleration for larger workloads
Working knowledge of networking and cybersecurity concepts such as IP addressing, DNS, TLS, network flows, ports/services, routing, network devices, and security alerts
Experience with cyber/network telemetry such as Zeek, PCAP-derived data, SIEM data, IDS/IPS alerts, device configuration data, or vulnerability/asset data is highly desirable
Experience with graph/network-analysis libraries, SQL/data stores, Elasticsearch/Splunk, or similar analytic platforms is a plus
Experience developing analytics for cybersecurity, threat hunting, detection engineering, or defensive cyber operations is strongly preferred

Benefits

Comp & perks

Unique benefits and personal touches to provide a positive work-life experience
Inc. Magazine ‘Best Workplaces’ awardee employer