Data Scientist

About Us:

PUNCH Cyber Analytics Group (PUNCH) is a Virginia-based small business founded in 2012 operating as a cohesive team that incorporates the sum of our groups diverse skills talents and resources toward our collective passion: advancing data analytics to impact cyber operations. PUNCH is a two-time Inc. Magazine Best Workplaces awardee offering unique benefits and personal touches to provide a positive work-life experience for our team. PUNCH brings unique qualifications resources and past-performance that make us suitable to address the goals of our diverse customer-base. Further we have past and current experience supporting cyber operations and cyber ML-based research with well over 100 years of collective experience from our collaborative multi-disciplinary team.

Responsibilities

• Develop and evaluate machine-learning analytics for cyber defense use cases using network sensor alert asset and other operational telemetry.
• Build unsupervised and statistical models for clustering anomaly/outlier detection behavioral baselining novelty detection and pattern discovery.
• Apply techniques such as graph analytics/embeddings nearest-neighbor methods time-series or periodicity analysis clustering dimensionality reduction and anomaly scoring to large cyber datasets.
• Design models and features that account for concept drift noisy data incomplete ground truth and high false-positive rates common in operational cyber environments.
• Support asset discovery and entity resolution including development of probabilistic asset graphs that associate IPs hostnames MAC addresses services certificates device attributes and other observations across data sources.
• Develop contextual features from security alerts and network telemetry including temporal patterns rarity/frequency communication behavior entity context and related activity and use those features to identify meaningful alert clusters and outliers.
• Work with cyber analysts and detection engineers to turn operational questions and adversary behaviors into measurable features experiments and analytics.
• Evaluate model effectiveness using appropriate quantitative metrics and operational validation; benchmark accuracy false-positive behavior computational performance and usefulness to analysts.
• Develop production-quality Python code and work with engineers to integrate models into sensor-side CPU environments as well as larger GPU-enabled enterprise analytics platforms.
• Understand the practical strengths and limitations of LLMs: know when to use an LLM when to use conventional ML/statistics and when a deterministic rule or query is the better answer.
• Ability to build evaluation harnesses rather than judge AI output by vibestest datasets expected behaviors regression tests failure cases and quantitative measures.

Qualifications

• BS or MS in Data Science Computer Science Statistics Applied Mathematics Engineering Cybersecurity or a related quantitative discipline.
• Strong Python skills and hands-on experience with common scientific/ML tooling such as pandas NumPy scikit-learn SciPy and related libraries.
• Strong understanding of unsupervised machine learning including clustering anomaly/outlier detection similarity/distance methods feature engineering and statistical baselining.
• Experience with at least some of the following: graph analytics or graph ML entity resolution/record linkage probabilistic modeling time-series analysis change-point/concept-drift detection nearest-neighbor methods or dimensionality reduction.
• Experience working with large noisy heterogeneous datasets where labels or authoritative ground truth are limited.
• Familiarity with scalable data processing and efficient model implementation; comfortable thinking about CPU/memory constraints as well as GPU acceleration for larger workloads.
• Working knowledge of networking and cybersecurity concepts such as IP addressing DNS TLS network flows ports/services routing network devices and security alerts.
• Experience with cyber/network telemetry such as Zeek PCAP-derived data SIEM data IDS/IPS alerts device configuration data or vulnerability/asset data is highly desirable.
• Experience with graph/network-analysis libraries SQL/data stores Elasticsearch/Splunk or similar analytic platforms is a plus.
• Experience developing analytics for cybersecurity threat hunting detection engineering or defensive cyber operations is strongly preferred.