Hiring nowCyber defence and security operations AI

Cybersecurity ML Scientist

Also called Security Data Scientist

A Cybersecurity ML Scientist builds and tests models that spot malicious activity in authorised security data. They keep detection useful as attackers change tactics, which protects the company and its customers from missed threats and alert fatigue.

What they do

They work with authorised security telemetry from SIEM and case systems to model malicious behaviour. They define what a detection should catch, build features, train and tune models, and test them against realistic attacks. They run adversarial evaluations, playing the attacker to find blind spots. They watch for drift as environments and attacker behaviour shift, and decide when to retrain, rework or retire a model. They sit with analysts, learn from closed cases, and set up controlled agent tools that help triage without acting beyond their remit.

What a strong hire delivers

A strong hire delivers a working detection model that analysts trust, with clear documentation of what it covers and what it misses. They set up an adversarial evaluation that can be rerun as models change. They put drift monitoring in place with agreed thresholds for action. They also improve how analyst feedback flows back into modelling, so quality does not decay quietly.

How you can tell they are good

Ask them to walk through a detection they built, from raw data to production. Good candidates explain the label problem, the false positive cost, and how they tested against an adaptive attacker. They can describe a time a model degraded and how they noticed. Be wary of anyone who quotes offline scores and cannot say how the model behaved in live operations.

Why it is hard to fill

Few people sit across both security operations and applied modelling. Security people often lack statistical depth, and data scientists often lack attacker thinking. Titles vary widely, so searching on the job title misses most good candidates. Many strong people are inside large security teams or vendors and are not looking. Authorised data access and trust requirements narrow the field further.

Where to find them

Look at detection engineers, threat hunters and incident responders who have moved into modelling, and at data scientists embedded in security teams. They come from security product companies, managed detection providers, large in-house security operations, financial services and cloud platforms. Some come from AI red teaming or fraud and abuse teams, where adversarial thinking is routine.

Indicative pay

Not enough published evidence yet to give a fair range for this role, which is common for work this new. We benchmark it for you as part of a search.

Interview questions for a Cybersecurity ML Scientist

  1. Describe a detection model you built from authorised security data. How did you get labels and judge quality?

    A strong answer covers data sources, noisy or missing labels, analyst input, and metrics tied to alert cost. Worry if they only cite offline accuracy, ignore base rates, or cannot explain how they validated against real incidents.

  2. How would you tell that a detection model has drifted, and what would you do next?

    Good answers separate data drift from attacker behaviour change, name monitoring signals, and set thresholds for retraining or rollback. Worry if the answer is simply retrain on a schedule without diagnosing cause.

4 more questions, with what a strong answer covers, are in the Role Kit.

Job description you can post

We are hiring a Cybersecurity ML Scientist to build and test models that detect malicious activity in authorised security data. You will work closely with our security operations and engineering teams to keep detection effective as attacker behaviour changes.

What you will do

  • Build and tune detection models using authorised security telemetry
  • Design and run adversarial evaluations against our detections
  • Monitor models for drift and decide when to retrain or retire them
  • Work with analysts to turn case outcomes into better labels and features
  • Help design controlled agent tools for triage with clear limits
  • Document model coverage, gaps and operating thresholds

What you will bring

  • Shipped a detection or anomaly model used in real security operations
  • Hands-on experience with SIEM data and case systems
  • Clear approach to noisy labels and false positive cost
  • Experience testing models against adaptive or adversarial behaviour
  • Ability to explain model limits to analysts and leaders
  • Background in security operations, detection engineering or incident response

Nice to have

  • Experience in AI red teaming
  • Experience with agent frameworks in a controlled setting
  • Incident response on live cases

Free to use and adapt. If it saves you time, a link back to this page is appreciated.

Skills that matter

  • Security engineeringAdvancedProtect systems, identities and sensitive assets
  • AI red teamingAdvancedTest systems adversarially under authorisation
  • Reliability and incident responseWorkingDetect failures, restore service and prevent recurrence
  • Agent orchestrationWorkingCoordinate tool-using agent execution

Other roles in cyber defence and security operations AI

Hiring nowAI Detection EngineerAn AI Detection Engineer builds the detections that turn AI-derived signals into alerts a security team can trust. They cut noise, catch real…EmergingAI Security Operations EngineerAn AI Security Operations Engineer builds constrained AI support for security triage and response. It lets a security team move faster on alerts and…EmergingDefensive AI Agent EvaluatorA Defensive AI Agent Evaluator tests how AI agents behave inside security detection and response work, and shows where they fail. It matters because…

Related roles in other families

Hiring nowAI Security EngineerAI application security and misuse defenceAn AI Security Engineer hardens the applications, interfaces and sensitive assets built around models. They find how attackers could misuse the…Hiring nowAI Red Team EngineerAI application security and misuse defenceAn AI Red Team Engineer runs authorised attacks against model-connected systems to find weaknesses before real adversaries do. They give the company…Hiring nowAI Abuse Detection AnalystAI application security and misuse defenceAn AI Abuse Detection Analyst spots unauthorised and harmful use of a company's models and products, then turns what they find into rules and cases…EmergingModel Supply Chain Security EngineerAI application security and misuse defenceA Model Supply Chain Security Engineer protects model files, datasets and dependencies from tampering. They give the company confidence that what it…

How we wrote this

Role definitions are our own editorial work, checked against occupational classifications, standards, research and employer pages. Titles vary by company, and this is a description of the work, not a job advert.

← Cyber defence and security operations AIAll new job families

Start a search

Hiring a Cybersecurity ML Scientist?

Tell us the work. We find the people already doing it, whatever their job title says, and you meet them already interviewed for your role.