Principal Detection Research Scientist, Cybersecurity

Quantum Sky•Reston, VA

2d•$160,000 - $225,000•Hybrid

About The Position

Quantum Sky is seeking a mission-oriented Principal Detection Research Scientist to join its CTO shop and lead the data science behind preemptive-cyber detection products. This is a research role focused on turning raw network activity into labeled ground truth that models can learn from and defining the learning targets, rather than platform engineering. The role addresses the unsolved challenge of labeling real network captures that lack established ground truth. The scientist will work with offensive-operations staff who provide attack ground truth and model engineers who build and train models, developing rigorous and scalable methods to label traffic and define well-posed learning targets. The position also leads research on packet-window prediction, feature and representation strategy, detection evaluation, and validation methodology. The work includes establishing reproducible, auditable labeling and research practices. The role is hybrid remote in the DC–Maryland–Virginia area, with headquarters in Reston, Virginia, and client sites.

Requirements

Active Top Secret clearance and eligibility for TS/SCI.
Advanced degree in a quantitative field such as Computer Science, Statistics, or Machine Learning, or equivalent research experience.
Demonstrated experience building supervised or weakly supervised machine learning on real-world found data and personally addressing ground-truth or labeling challenges, rather than working solely with pre-labeled benchmark datasets.
Hands-on expertise in data-labeling methodology, including label-taxonomy design, weak supervision or programmatic labeling, active learning, and label-quality measurement such as inter-annotator agreement and auditing.
Applied machine-learning experience with sequence, signal, image, or network/packet data, or comparable inputs composed of raw values that must be labeled and featurized.
Strong foundation in detection and classification modeling, including feature engineering, representation choices, evaluation design, and confound control.
Proficiency in Python and PyTorch.
Excellent communication skills and ability to translate between offensive-operations domain experts and model engineers.

Nice To Haves

Direct experience labeling or modeling network traffic, PCAP, or security telemetry for detection.
Familiarity with the cyber kill chain and how adversary activity manifests on the wire.
Reinforcement-learning and/or simulation experience, such as multi-agent systems or custom environments.
Computer-vision or image-recognition background.
Experience establishing labeling pipelines and tooling in partnership with engineers.
Familiarity with on-premises GPU training environments and reproducible machine-learning workflows.
Prior work in a Department of War or Intelligence Community mission context.

Responsibilities

Design and own the labeling scheme for packet-window data, including label taxonomy, annotation guidelines, and definitions of attacks, actors, and on-wire behaviors.
Develop labeling approaches for found data without given ground truth, including weak supervision, programmatic or heuristic labeling, active learning, and labeling-by-construction for controlled collections.
Establish label-quality processes, including inter-annotator agreement, audit sampling, purity rules, and versioned label definitions.
Partner with offensive-operations staff to map observed traffic to adversary activity, such as kill-chain stages, and translate domain knowledge into scalable labels.
Define the unit of prediction and model target, including model inputs and packet-window features or representations.
Shape feature and representation strategies for sequence and packet data, identifying discriminative signals and confounds.
Work with model engineers to connect labeling and target definitions to trainable models and design evaluations that demonstrate detection on unseen data.
Set the experimental agenda for the detection data problem and ensure rigorous validation using holdouts, confound controls, and reliable ground truth.
Document methodology so the team can reproduce, audit, and extend it.