Principal Data Science Security Engineer

Why UKG:

At UKG, the work you do matters. The code you ship, the decisions you make, and the care you show a customer all add up to real impact. Today, tens of millions of workers start and end their days with our workforce operating platform. Helping people get paid, grow in their careers, and shape the future of their industries. That's what we do.

We never stop learning. We never stop challenging the norm. We push for better, and we celebrate the wins along the way. Here, you'll get flexibility that's real, benefits you can count on, and a team that succeeds together. Because at UKG, your work matters-and so do you.

As a Principal Data Science Security Engineer, you will be part of UKG's Global Security Detection Engineering team. This global team is responsible for detecting and responding to sophisticated cyber threats and attacks. In your role you will leverage a variety of tools and resources to proactively detect, investigate, and respond to emerging and/or persistent threats impacting UKG and/or its customers.

Responsibilities:

• Assist with the development of a multi agent AI system leveraging current industry knowledge around AI Engineering
• Researching, developing, implementing, and managing data-driven algorithms, AI/ML techniques, & classical statistics for threat detection, behavior analytics, vulnerability assessment, prediction, and prevention
• Communicating complex data findings, model predictions, and the implications to non-technical stakeholders using reports and visualizations
• Staying abreast of the latest research, developments, experimentations, and products in the AI/ML and cybersecurity landscapes to identify new opportunities
• You will be providing hands-on solutions, customization and tuning, automation, and use case development for the SIEM, SOAR, and other stakeholder requirements for threat informed defense strategies
• You will be providing hands-on solutions, customization and tuning, automation, and use case development for the SIEM, SOAR, and other stakeholder requirements for threat informed defense strategies
• You will support leading production level projects to completion as a contributor and a collaborator between multiple stakeholder teams including the Security Operations Center (SOC), Threat Intelligence, Incident Response, and Incident Response
• You will be working on a globally distributed team and expected to create and present strategies, technical plans, and architecture to audiences of technical and executive leadership levels when asked.
• You will also maintain existing internal code, use cases, and further extend SIEM and SOAR integrations aligned to the Detection Engineering program efforts
• You will design and engineer Security Operations focused integrations and automations including diagrams, documentation, and threat modeling of what is built
• You will support the Director of Detection Engineering in directly enhancing the strategic capabilities of the program through complex technical projects

• Experience with AI Engineering & LLMOps, beyond prompt engineering, to include tuning & training language models, model selection criteria, agent design, eval systems, pipelines, RAG, custom embeddings, and monitoring
• Experience with creating large datasets (Big Query/ Big Lake) and knowledge graphs
• 5+ years of working experience with the Data Science Lifecycle, MLOps workflows & tools, and the python data science stack, with a proven track record of leading significant data science projects from conception to deployment
• 8+ years of security and hands on technical automation experience, with 5 or more of those years focused on creating use cases and detection focused automation (can substitute years of security experience with data science experience and vice versa)
• 5+ years of operational experience working directly with or in security operational teams including: SOC, Threat Intelligence, and Incident Response
• The ability to lead complex projects, other team members, and support building strategic and technical initiatives
• Deep understanding of SOC, SIEM, and other engineering best practices, limitations, and ways of extending or customizing threat detection automation related use cases
• Demonstratable hands-on skills in a major scripting/programming language or a search query language for use in security operations and threat detection
• Splunk Cloud ES and Splunk SOAR (Phantom) Experience highly preferred

• Experience with a major public cloud service provider (CSP) preferred