Senior Data Scientist
- Role
- Data Science
- Employment
- Full-time
The listing doesn't say where it hires from. Check the description or the employer's site before applying.
No BS summary
A senior-level data scientist role building security-focused machine learning models in production for vulnerability prediction, with required experience in applied ML/statistics and work on class-imbalanced classification. Must be fluent in Python and SQL, and able to handle calibration, uncertainty, drift monitoring, and production model risk. The role is remote.
Core skills
Empirical Security is seeking an experienced Security Data Scientist focused on building the next generation of cybersecurity vulnerability models. Our unique approach leverages ground-truth telemetry to develop predictive, actionable insights that transform the way organizations identify, prioritize, and remediate vulnerabilities in cloud, appsec and traditional environments. We build models specific to individual customers, and maintain many of them side by side.
THE ROLE
You own models and data end to end: problem framing, features, training, evaluation, deployment, and the uncomfortable part where you explain to a customer why the vulnerability their board is worried about ranked 400th on the remediation list.
WHAT YOU'LL DO
- Design, train, and ship exploit prediction models against ground-truth exploitation telemetry, in cloud, appsec, and traditional infrastructure.
- Build evaluation that survives contact with reality. Precision, recall, coverage, efficiency, calibration, and how all four decay over time. Accuracy is not a number you report once at launch.
- Solve for extreme class imbalance. A fraction of a percent of published CVEs are ever exploited in the wild, and most of the industry's modeling failures start with pretending that isn't true.
- Work the hard part of the dual-model architecture: partial pooling, hierarchical priors, and cold-start behavior for customers whose local telemetry is thin in month one and rich in month twelve.
- Engineer features across scanner output, EDR, asset inventory, identity, cloud posture, and exploitation telemetry, and be honest about which ones are leakage.
- Own monitoring and drift detection.
- Publish. Papers, methodology write-ups, open benchmarks, conference talks. Our positioning is that we show our work.
- Partner with engineering and our forward deployed team to move models out of notebooks and into production systems that customers depend on.
WHAT YOU'LL NEED
- Several years of applied machine learning or statistics with models that ran in production and had consequences when they were wrong.
- Fluency in Python and SQL, and the discipline that comes with version control, reproducible pipelines, and secure handling of customer data.
- Real depth in classification under heavy imbalance, plus at least one of: survival and time-to-event analysis, Bayesian hierarchical modeling, or causal inference.
- Calibration instincts. You should be visibly uncomfortable when a model outputs 0.9 and is right 60% of the time.
- The ability to explain a model to a security executive, and to quantify uncertainty out loud rather than burying it in an appendix.
- Enough curiosity about attacker behavior to ask why a feature works, not just whether it does.
A FINAL WORD
Don't check off every box in the requirements listed above? Please apply anyway! Studies have shown that marginalized communities - such as women, LGBTQ+ and people of color - are less likely to apply to jobs unless they meet every single qualification. Empirical Security is dedicated to building an inclusive, diverse, equitable, and accessible workplace that fosters a sense of belonging – so if you're excited about this role but your past experience doesn't align perfectly with every qualification in the job description, we encourage you to still consider submitting an application. You may be just the right candidate for this role or another one of our openings!
What you'll do
- Own models and data end to end: problem framing, features, training, evaluation, deployment, and communication of risk ranking outcomes.
- Design, train, and ship exploit prediction models against exploitation telemetry across cloud, appsec, and traditional infrastructure.
- Build evaluations that track precision, recall, coverage, efficiency, and calibration over time.
- Address extreme class imbalance in vulnerability exploitation modeling.
- Work dual-model architecture topics including partial pooling, hierarchical priors, and cold-start behavior.
- Engineer features from scanner output, EDR, asset inventory, identity, cloud posture, and exploitation telemetry while assessing leakage.
- Own model monitoring and drift detection.
- Publish papers, methodology write-ups, open benchmarks, and conference talks.
- Partner with engineering and forward deployed teams to move models into production systems customers use.
What they require
- Several years of applied machine learning or statistics with models that ran in production.
- Fluency in Python and SQL, along with version control, reproducible pipelines, and secure handling of customer data.
- Real depth in classification under heavy imbalance.
- At least one of the following: survival and time-to-event analysis, Bayesian hierarchical modeling, or causal inference.
- Strong calibration instincts and ability to reason about probabilistic outputs versus observed outcomes.
- Ability to explain a model to a security executive and quantify uncertainty clearly.
- Curiosity about attacker behavior and why features work.
Empirical Security is a quantum leap forward in exposure management, building custom models at scale to help organizations predict and prioritize the threats most likely to endanger them. Enterprises can no longer keep up with the flood of potential exploits caused by the AI era; only Empirical gives resource-strapped security teams the predictive capabilities to punch way above their weight class.