Senior/ Principal Data Scientist, Security AI & ML

RADICL is a fully managed cybersecurity and compliance service for small and mid-sized organizations, many of them defense contractors facing nation-state threats and CMMC requirements. Our autonomous virtual SOC (vSOC) pairs AI agents that handle high-volume triage with expert analysts who handle judgment and response.

AI is already in production across our platform. Your job is to make it measurably better and add ML where rules fall short. This is a hands-on role: you'll write the code, run the experiments, and ship the models. We're hiring at the Senior or Principal level.

• AI-driven intrusions. Agentic attack frameworks like ARTEX have gone from first contact to privileged cloud access in under three hours.
• Hijacked AI agents and apps. Stolen OAuth tokens and compromised app identities are used to quietly pull data and change privileges.
• Copilots turned against users. Hidden prompt injections make AI assistants leak tokens and data.
• AI-built insiders. North Korean IT workers use AI personas and deepfake interviews to get hired at defense contractors.
• LLM-driven malware. Malware like LAMEHUG asks an LLM for its next command, so no two runs look alike.
• Phishing at scale. AI-written lures and MFA-bypassing token theft target exactly the organizations we protect.

• →Evaluate our agents. Define how we know our AI is right, measure it against analyst verdicts, and gate every change on the results.
• →Make our AI better. Improve the quality, speed, and cost of our triage, investigation, and search agents.
• →Adapt models to security. Decide when to customize or train models on our analyst-labeled data, and do it.
• →Detect behavior, not signatures. Build models that catch threats rules miss across endpoint, identity, email, cloud and SaaS audit, network, and vulnerability data.
• →Protect our own AI. Keep attacker-controlled data from manipulating our agents.
• →Prove it in production. Show whether AI is helping, using measures like time to triage, analyst override rate, and false-positive load.
• →Run it like software. Own versioning, monitoring, and strict per-customer data isolation, with outputs traceable enough for CMMC audits.Your skillset/experience should include:

• 6+ years in data science or applied ML (Senior), or 8+ (Principal), with models you shipped and maintained in production.
• Strong Python and SQL, and large-scale data processing on a major cloud platform.
• Experience evaluating and improving LLM or agent systems in production.
• Hands-on experience adapting or training models for a specialized domain.
• Anomaly detection or classification with rare events and noisy labels.
• Solid statistics and experimental design, and the judgment to ship a simple baseline when it's good enough.
• Comfort in an engineering team: reading production code, writing tests, and writing clear RFCs.
• Principal: you've owned ML problems end to end and can defend architecture decisions for the ML stack.

• Security data and detection experience; MITRE ATT&CK.
• LLM security: prompt injection, guardrails, red-teaming agents.
• Vulnerability data (CVSS, EPSS) or CMMC / NIST 800-171.

• You'll choose the methods and tools, and build it yourself.
• Real data: security telemetry at scale, analyst-labeled cases, and AI agents already in production.
• The mission: defending defense suppliers and other high-risk small organizations from nation-state threats.