Staff Security Engineer, Data Science Engineering

About the role

About Nscale

Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility.

We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future.

About the Role

We're hiring a Staff Security Engineer to make the data behind Cyber Defense's detections and investigations trustworthy and to uncover threats the team might otherwise miss. This is a hands-on individual contributor role reporting to the Director, Cyber Defense.

You'll work across endpoint, identity, cloud, network, vulnerability, SaaS and internal platform telemetry, partnering with the teams that generate the data and with Security Operations, which uses it and provides feedback on alert quality. The work starts with engineering: collecting data completely and making gaps visible. From there, you'll build behavioral baselines and cross-source analyses that become usable detections, not just models or notebooks.

Defenders need to know when a feed is late, partial or unreliable before they make a decision from it. Your work will make that trust measurable and help them find threats that predefined rules alone may miss.

What you'll be doing

Data inventory and collection

- Own the inventory of security-relevant sources, including their owners, collection methods, freshness, coverage limits and known gaps.

- Build and operate idempotent batch and streaming collection from APIs, event streams, object stores and internal systems. Make partial drains, late feeds and schema changes detectable; support backfill and replay.

- Define consistent identity, asset, time and severity conventions while preserving raw payloads. Document lineage, retention and the limits of what each dataset can support, and handle personal data and secrets deliberately.

Data reliability and quality

- Monitor freshness, volume, completeness, duplicates, schema drift and cross-source consistency. Route quality failures to an owner so analysts know when the data cannot be trusted.

- Make pipeline failures visible, with routine backfill and replay and measured cost per source.

- Distinguish exact figures from lower bounds and unknowns wherever the data is used.

Detection and investigation

- Build and evaluate behavioral baselines, anomaly detection and cross-source correlations against investigation outcomes and real alert volume. Work with Security Operations to tune or retire signals that do not earn their place.