Data Scientist

Description

The team supports mission-focused cyber analytics and defensive cyber operations.

The role combines threat hunting, operational research, statistical analysis, and stakeholder work to help cyber teams turn complex data into actionable insights and make mission tools more effective.

Responsibilities

• Run defensive threat hunts on mission Big Data Platforms, assess suspicious activity, and turn the results into operational recommendations.
• Apply statistical methods, hypothesis tests, and model building and testing to surface meaningful patterns in cyber and network data.
• Write data queries and build dashboards and visualizations for customer analytic requests, then present findings in live, interactive briefings.
• Support cyber teams using the Threat Awareness Sharing Capability (TASC) applications and platforms such as JCRS-D.
• Work with customers to define cyber-operations requirements, operational gaps, use cases, and ways to enrich data.
• Evaluate existing and proposed cyber data feeds for relevance, usability, completeness, and quality, and document your findings and deliverables.
• Use hunt methods, detection content, and emerging threat intelligence to identify threats and raise awareness.
• Help customer users with hunting workflows, platform demonstrations, hands-on training, and prompt operational support.
• Convert repeatable hunting methods and analytic processes into automated mission capabilities.

Requirements

• U.S. citizenship and a current, active U.S. Government TS/SCI security clearance, plus the ability to maintain it.
• 9 years of relevant cyber-security operations experience with a bachelor's degree in information technology, cybersecurity, or a related field; 7 years with a related master's degree; or 13 years with a high-school diploma or equivalent.
• Background working with defense cyber-mission clients in the U.S. and explaining analysis to audiences with mixed technical knowledge.
• Proficiency in SQL and Kusto Query Language (KQL), along with Python for analysis.
• Experience with dashboard and visualization tools such as Power BI or Superset, and familiarity with Azure, AWS, or Google Cloud.
• Knowledge of cyber-hunt methodologies, SIEM tools such as Splunk, QRadar, or ELK, and SOAR tools such as Sentinel, Cortex, or XSOAR.
• Hands-on work writing detection signatures for threats, drawing on sources like CVE and OSINT, and reading rules in SNORT, SIGMA, YARA, or YAML.
• Experience with network-traffic tools such as tcpdump, Wireshark, or Zeek, plus MITRE ATT&CK, incident response, and IDS/IPS technologies.
• Strong skills in customer communication, public presentation, writing, documentation, and user training, and the ability to work both independently and in a team.
• Ability to work the required five-day onsite schedule at the Fort Meade customer site and to travel up to 40% of the time, domestically and internationally.
• Nice to have: certifications such as Data+, Security+, CySA+, GCIH, GNFA, or GCFA.
• Nice to have: experience in a defense cyber security operations center (SOC).
• Nice to have: familiarity with mission Big Data Platforms, data lakes, or related architectures.
• Nice to have: experience using Jupyter notebooks in cyber-data analysis.

Conditions

Onsite at a customer site in Fort Meade, MD, five days (40 hours) per week.

Travel may be required within the United States and internationally.

Pay range for the Maryland location: $105,000 - $180,765 USD, set by factors such as location, federal contract labor category, wage rates, experience, skillsets, education, and certifications.

Benefits

• Comprehensive healthcare coverage: medical, dental, and vision.
• Health Savings Account with a company contribution.
• Annual paid time off and paid holidays.
• Paid parental leave.
• 401k with a generous company match.
• Support in financial wellness, retirement planning, family assistance, and continued education.
• Training and development opportunities, award programs, and company-sponsored events.