Data Scientist

About Us: PUNCH Cyber Analytics Group (PUNCH) is a Virginia-based, small business founded in 2012 operating as a cohesive team that incorporates the sum of our group’s diverse skills, talents, and resources toward our collective passion: advancing data analytics to impact cyber operations. PUNCH is a two-time Inc. Magazine ‘Best Workplaces’ awardee offering unique benefits and personal touches to provide a positive work-life experience for our team. PUNCH brings unique qualifications, resources, and past-performance that make us suitable to address the goals of our diverse customer-base. Further, we have past and current experience supporting cyber operations and cyber ML-based research, with well over 100 years of collective experience from our collaborative, multi-disciplinary team. Responsibilities • Develop and evaluate machine-learning analytics for cyber defense use cases using network, sensor, alert, asset, and other operational telemetry. • Build unsupervised and statistical models for clustering, anomaly/outlier detection, behavioral baselining, novelty detection, and pattern discovery. • Apply techniques such as graph analytics/embeddings, nearest-neighbor methods, time-series or periodicity analysis, clustering, dimensionality reduction, and anomaly scoring to large cyber datasets. • Design models and features that account for concept drift, noisy data, incomplete ground truth, and high false-positive rates common in operational cyber environments. • Support asset discovery and entity resolution, including development of probabilistic asset graphs that associate IPs, hostnames, MAC addresses, services, certificates, device attributes, and other observations across data sources. • Develop contextual features from security alerts and network telemetry, including temporal patterns, rarity/frequency, communication behavior, entity context, and related activity, and use those features to identify meaningful alert clusters and outliers. • Work with cyber analysts and detection engineers to turn operational questions and adversary behaviors into measurable features, experiments, and analytics. • Evaluate model effectiveness using appropriate quantitative metrics and operational validation; benchmark accuracy, false-positive behavior, computational performance, and usefulness to analysts. • Develop production-quality Python code and work with engineers to integrate models into sensor-side CPU environments as well as larger GPU-enabled enterprise analytics platforms. • Understand the practical strengths and limitations of LLMs: know when to use an LLM, when to use conventional ML/statistics, and when a deterministic rule or query is the better answer. • Ability to build evaluation harnesses rather than judge AI output by vibes—test datasets, expected behaviors, regression tests, failure cases, and quantitative measures. Qualifications • BS or MS in Data Science, Computer Science, Statistics, Applied Mathematics, Engineering, Cybersecurity, or a related quantitative discipline. • Strong Python skills and hands-on experience with common scientific/ML tooling such as pandas, NumPy, scikit-learn, SciPy, and related libraries. • Strong understanding of unsupervised machine learning, including clustering, anomaly/outlier detection, similarity/distance methods, feature engineering, and statistical baselining. • Experience with at least some of the following: graph analytics or graph ML, entity resolution/record linkage, probabilistic modeling, time-series analysis, change-point/concept-drift detection, nearest-neighbor methods, or dimensionality reduction. • Experience working with large, noisy, heterogeneous datasets where labels or authoritative ground truth are limited. • Familiarity with scalable data processing and efficient model implementation; comfortable thinking about CPU/memory constraints as well as GPU acceleration for larger workloads. • Working knowledge of networking and cybersecurity concepts such as IP addressing, DNS, TLS, network flows, ports/services, routing, network devices, and security alerts. • Experience with cyber/network telemetry such as Zeek, PCAP-derived data, SIEM data, IDS/IPS alerts, device configuration data, or vulnerability/asset data is highly desirable. • Experience with graph/network-analysis libraries, SQL/data stores, Elasticsearch/Splunk, or similar analytic platforms is a plus. • Experience developing analytics for cybersecurity, threat hunting, detection engineering, or defensive cyber operations is strongly preferred. Originally posted on Himalayas