Staff Security Engineer, Data Science Engineering

Nscale•Houston, NY

2d•Hybrid

About The Position

We're hiring a Staff Security Engineer to make the data behind Cyber Defense's detections and investigations trustworthy and to uncover threats the team might otherwise miss. This is a hands-on individual contributor role reporting to the Director, Cyber Defense. You'll work across endpoint, identity, cloud, network, vulnerability, SaaS and internal platform telemetry, partnering with the teams that generate the data and with Security Operations, which uses it and provides feedback on alert quality. The work starts with engineering: collecting data completely and making gaps visible. From there, you'll build behavioral baselines and cross-source analyses that become usable detections, not just models or notebooks. Defenders need to know when a feed is late, partial or unreliable before they make a decision from it. Your work will make that trust measurable and help them find threats that predefined rules alone may miss.

Requirements

8+ years in data engineering, data science, detection engineering, security analytics or a related technical field, including significant work with security data.
Built and operated security data pipelines, including collection from APIs and event sources, idempotent loads, partitioning, backfill, replay and schema evolution.
Can diagnose the difference between a complete dataset and one that only looks complete.
Can work with a cloud warehouse and a streaming system, such as BigQuery and Kafka or equivalents.
Have made data quality measurable and actionable for the people who depend on it.
Understand security telemetry across areas such as identity, endpoint, cloud control planes, networks, vulnerabilities and SaaS audit logs, including how attackers can appear in that data.
Can apply statistical or machine-learning methods to security analysis, evaluate them against real outcomes and translate the result into a detection that analysts can use.
Can work with teams that own the source systems to agree access, schemas and collection cadences, and explain coverage gaps and uncertain findings clearly to analysts, engineers and leaders.
Stay hands-on with pipelines, schemas and analysis while building repeatable methods that make the wider team less dependent on one person.

Nice To Haves

Experience with multi-tenant cloud or AI infrastructure
Graph-based entity resolution
Privacy-sensitive data governance
Building data foundations for AI-assisted analysis

Responsibilities

Own the inventory of security-relevant sources, including their owners, collection methods, freshness, coverage limits and known gaps.
Build and operate idempotent batch and streaming collection from APIs, event streams, object stores and internal systems.
Make partial drains, late feeds and schema changes detectable; support backfill and replay.
Define consistent identity, asset, time and severity conventions while preserving raw payloads.
Document lineage, retention and the limits of what each dataset can support, and handle personal data and secrets deliberately.
Monitor freshness, volume, completeness, duplicates, schema drift and cross-source consistency.
Route quality failures to an owner so analysts know when the data cannot be trusted.
Make pipeline failures visible, with routine backfill and replay and measured cost per source.
Distinguish exact figures from lower bounds and unknowns wherever the data is used.
Build and evaluate behavioral baselines, anomaly detection and cross-source correlations against investigation outcomes and real alert volume.
Work with Security Operations to tune or retire signals that do not earn their place.
Support major incidents with defensible scoping, timelines and pattern analysis, turning useful one-off work into repeatable queries or detections.
Partner with Security Operations to turn analytical findings into signals responders can use and assess against labelled outcomes.
Prepare curated, documented datasets for AI-assisted analysis, with scoped and audited access, provenance, freshness signals and safe failure when data is missing or stale.
Help detection engineers, analysts and security engineers ask better questions of the data and understand the uncertainty in the answers.
Negotiate access, schemas and collection cadences with the teams that own source systems, and report coverage gaps back to them.