Principal Detection Research Scientist, Cybersecurity

Quantum Sky is searching for a mission-oriented Principal Detection Research Scientist, Cybersecurity to join our CTO shop and anchor the data science behind our preemptive-cyber detection products. This is a research role, not a platform-engineering role: you will own the hardest problem in applied detection, turning raw network activity into labeled ground truth a model can learn from, and defining what the model should learn in the first place.

Our detection work learns to recognize adversary behavior directly from network traffic. The unit of analysis is a window of packets, in effect, a field of packet bytes, much as an image is a field of pixels, and the central research problem is labeling the contents of that field: given a span of traffic, what is happening, is it an attack, and whose activity is it?

Today our team can label data we generate under controlled conditions, but labeling found traffic, real captures with no given ground truth, is unsolved, and it is the work that gates everything downstream. You will solve it.

You will work alongside our offensive-operations staff, who supply attack ground truth, and our model engineers, who build and train the models. You are the missing middle: the person who turns  this is an attack  into a rigorous, scalable labeling methodology and a well-posed learning target.

Responsibilities:

Labeling methodology & ground truth

• Design and own the labeling scheme for packet-window data: label taxonomy, annotation guidelines, and the definition of what constitutes an attack, an actor, or a behavior on the wire.
• Build labeling approaches for found data where ground truth is not given — weak supervision, programmatic/heuristic labeling, active learning, and labeling-by-construction where controlled collection allows it.
• Establish label-quality process: inter-annotator agreement, audit sampling, purity rules, and versioned label definitions that evolve as the team learns.
• Partner with offensive-operations staff to map observed traffic to adversary activity (e.g., kill-chain stage), and translate their domain truth into labels at scale.

Detection modeling theory

• Define the unit of prediction and the model's target: what goes into the model (features, representation of a packet window) and what it predicts.
• Shape the feature and representation strategy for sequence/packet data; identify what carries discriminative signal and what is confound.
• Work with model engineers to connect the labeling and target definitions to trainable models, and to design the evaluation that proves detection works on unseen data.

Research leadership

• Set the experimental agenda for the detection data problem and bring rigor to how results are validated (holdouts, confound controls, honest ground truth).
• Document methodology so the team can reproduce, audit, and extend it.

Required

• Active Top Secret clearance (TS/SCI eligible).
• Advanced degree in a quantitative field (Computer Science, Statistics, ML, or related), or equivalent research experience.
• Demonstrated experience building supervised or weakly-supervised machine learning on real-world ( found ) data, where you personally confronted the ground-truth/ labeling problem, not solely work on pre-labeled benchmark datasets.
• Hands-on expertise with data labeling methodology: label taxonomy design, weak supervision/ programmatic labeling, active learning, and label-quality measurement (inter-annotator agreement, auditing).
• Applied ML on sequence, signal, image, or network/packet data,any domain where the input is a field of raw values that must be labeled and featurized (network traffic, imagery, sensor/robotics, or comparable).
• Strong foundation in detection/classification modeling: feature engineering,…