Quantum Sky is searching for a mission-oriented Principal Detection Research Scientist, Cybersecurity to join our CTO shop and anchor the data science behind our preemptive-cyber detection products. This is a research role, not a platform-engineering role: you will own the hardest problem in applied detection, turning raw network activity into labeled ground truth a model can learn from, and defining what the model should learn in the first place.

Our detection work learns to recognize adversary behavior directly from network traffic. The unit of analysis is a window of packets, in effect, a field of packet bytes, much as an image is a field of pixels, and the central research problem is labeling the contents of that field: given a span of traffic, what is happening, is it an attack, and whose activity is it? Today our team can label data we generate under controlled conditions, but labeling found traffic, real captures with no given ground truth, is unsolved, and it is the work that gates everything downstream. You will solve it.

You will work alongside our offensive-operations staff, who supply attack ground truth, and our model engineers, who build and train the models. You are the missing middle: the person who turns "this is an attack" into a rigorous, scalable labeling methodology and a well-posed learning target.

Responsibilities:

Labeling methodology & ground truth

• Design and own the labeling scheme for packet-window data: label taxonomy, annotation guidelines, and the definition of what constitutes an attack, an actor, or a behavior on the wire.
• Build labeling approaches for found data where ground truth is not given — weak supervision, programmatic/heuristic labeling, active learning, and labeling-by-construction where controlled collection allows it.
• Establish label-quality process: inter-annotator agreement, audit sampling, purity rules, and versioned label definitions that evolve as the team learns.
• Partner with offensive-operations staff to map observed traffic to adversary activity (e.g., kill-chain stage), and translate their domain truth into labels at scale.

Detection modeling theory

• Define the unit of prediction and the model's target: what goes into the model (features, representation of a packet window) and what it predicts.
• Shape the feature and representation strategy for sequence/packet data; identify what carries discriminative signal and what is confound.
• Work with model engineers to connect the labeling and target definitions to trainable models, and to design the evaluation that proves detection works on unseen data.

Research leadership

• Set the experimental agenda for the detection data problem and bring rigor to how results are validated (holdouts, confound controls, honest ground truth).
• Document methodology so the team can reproduce, audit, and extend it.

Required

• Active Top Secret clearance (TS/SCI eligible).
• Advanced degree in a quantitative field (Computer Science, Statistics, ML, or related), or equivalent research experience.
• Demonstrated experience building supervised or weakly-supervised machine learning on real-world ("found") data, where you personally confronted the ground-truth/ labeling problem, not solely work on pre-labeled benchmark datasets.
• Hands-on expertise with data labeling methodology: label taxonomy design, weak supervision/ programmatic labeling, active learning, and label-quality measurement (inter-annotator agreement, auditing).
• Applied ML on sequence, signal, image, or network/packet data, any domain where the input is a field of raw values that must be labeled and featurized (network traffic, imagery, sensor/robotics, or comparable).
• Strong foundation in detection/classification modeling: feature engineering, representation choices, evaluation design, and confound control.
• Proficiency in Python and PyTorch.
• Excellent communication; able to translate between offensive-operations domain experts and model engineers.

Desired

• Direct experience labeling or modeling network traffic, PCAP, or security telemetry for detection.
• Familiarity with the cyber kill chain and how adversary activity manifests on the wire.
• Reinforcement learning and/or simulation experience (e.g., multi-agent, custom environments).
• Computer vision/ image-recognition background, the labeling and representation problems transfer directly.
• Experience standing up labeling pipelines and tooling in partnership with engineers.
• Familiarity with on-prem GPU training environments and reproducible ML workflows.
• Prior work in a DoW/ IC mission context.

Location: Hybrid remote in the DC–Maryland–Virginia (DMV) area, HQ in Reston, VA & client site(s)

Compensation:

• Compensation is unique to each candidate and relative to the skills and experience they bring to the position. The salary range for this position is typically between $160,000 - $225,000. This does not guarantee a specific salary as compensation is based upon multiple factors such as education, experience, certifications, and other requirements, and may fall outside of the above-stated range.

Benefits:

• Highlights of our benefits include Health/Dental/Vision, 401(k) match, Paid Time Off, STD/LTD/Life Insurance, Referral Bonuses, professional development reimbursement, and parental leave.