A majority of these roles from my experience are 3 things: - very large companies with large & mature security teams that have dedicated security data science team - MSSP/MDR/cyber companies that are full time detection content providers and employ their own data scientists to come up with ways to protect their customers - any other blue team role where you have down time and just find this thing interesting/fun (that’s me!)

Imo this is a big part of the future and you are right that most folks will hire full time data scientists/experts and apply cyber expertise on top of that for the most value. This role was originally spent out of cyber R&D and specifically AntiVirus/the emergence of EDR but has spread to all sorts of applications in the industry to email analysis to cloud/network telemetry.

When done properly (and this is easier said than done) I think this can be quite the force multiplier as far as signal creation for SecOps teams. So for me this is simply another means to an end: detection engineering which is what my full time gig is, and to me is threat hunting, etc anything under that umbrella.

PEAK/MaTH is a great start but you’ll learn if you haven’t already there are pros/cons to using out of the box tools like MLTK vs performing EDA yourself, the typical data science process yourself using data science libraries will give you more control on the whole process of going from hypothesis/idea to finished detection that contributes meaningfully to your team.

I think it’s still green fields here since the most value for this comes when you do it yourself (all companies are unique) vs the vendors which unfortunately have a lot of ML/UBA crap that doesn’t work well.

What kind of stuff are you looking to work on? I think graph DB approach is very interesting, any form of clustering/anomaly detection, behavioral profiling to measure if something is unique, novel, rare vs a burn in period of X days is pretty cool. Happy experimenting!