Cybersecurity Data Scientist

Impact Advisors, LLC is a nationally recognized healthcare management consulting firm delivering Best in KLAS advisory, implementation, and optimization services. We are driven by a commitment to exceed client expectations and are proud to be a trusted partner to many of the nation's leading healthcare organizations. Our mission to drive patient-centered, value-driven outcomes has earned us prestigious industry accolades. To learn more about us, visit www.impact-advisors.com

About Us

Impact Advisors, LLC is a nationally recognized healthcare management consulting firm delivering Best in KLAS advisory, implementation, and optimization services. We are driven by a commitment to exceed client expectations and are proud to be a trusted partner to many of the nation's leading healthcare organizations. Our mission to drive patient-centered, value-driven outcomes has earned us prestigious industry accolades. To learn more about us, visit www.impact-advisors.com.

Job Overview

Impact Advisors is building a security product for health systems, and we are adding a security practitioner to the team behind it.

We are looking for someone strong in both security telemetry and data analysis. The primary output is analysis delivered to customers: what the data shows, what it means, and how confident we are in it. That work also feeds requirements the engineering team can build against.

The role suits someone from a security operations, threat detection or security analytics background who is transitioning into a forward deployed engineering role, and in influencing the direction of the product from a data and analysis perspective.

Responsibilities

Analysis and reporting

• Analyze security telemetry and enterprise log sources across identity, access and endpoint systems

• Investigate anomalous activity in large, complex data sets and determine what is worth acting on

• Write reports on analysis for engineering, security and compliance audiences, stating findings, assumptions and confidence

Detection

• Define, document and tune detection logic to improve fidelity and reduce alert noise, recording the assumptions behind each rule and the outcome it is expected to produce

• Map detections to adversary tactics and techniques using MITRE ATT&CK, and identify coverage gaps against them

• Apply threat intelligence and current attacker tradecraft to detection design

• Develop and execute test plans for detections, including use-case testing, regression checks, and the negative cases that confirm a rule stays quiet when it should

Telemetry and data

• Assess log sources for coverage, parsing and normalization quality, field population and overall data integrity

• Identify telemetry gaps

• Profile and validate data sets, quantify data quality, and raise constraints with the engineering team

Tooling

• Build scripts and tooling in Python and SQL to automate analysis, reduce manual effort, and make investigative work repeatable

• Work across data analysis platforms and telemetry-specific tooling, including SIEM and EDR query interfaces, to investigate log data at volume

• Support deployment and post-deployment validation alongside the engineering team

Work is delivered on a weekly cadence. The main deliverable is analysis of security telemetry for the customer, with detection insights. Queries, notebooks and scripts are version controlled.

Qualifications

Education and Experience

• Bachelor's degree in cybersecurity, computer science, mathematics, data analytics or equivalent experience

• 4+ years in security operations, detection engineering, threat hunting, incident response or security analytics

• Hands-on experience with security telemetry: authentication and access logs, identity, endpoint, audit trails

• Experience creating and tuning detection rules in a SIEM, EDR or XDR platform, and reducing false positives without losing coverage

Skills and Competencies

Required qualifications

• Working knowledge of MITRE ATT&CK, the cyber kill chain, or comparable frameworks

• Strong SQL, including window functions and joins across imperfectly matched keys

• Python for analysis and tooling, and the ability to turn exploratory work into something repeatable

• Fluency in at least one security platform query language such as KQL, SPL, Lucene or equivalent

• Clear technical writing for both engineering and non-engineering readers

Preferred qualifications

• Healthcare or healthcare IT experience

• Detection content in portable formats such as Sigma, Sentinel analytics rules, YARA or equivalent

• Experience onboarding log sources and working with telemetry pipelines, including parsing and normalization

• Solid grounding in Windows and Linux logging: authentication events, process activity and network connections

• Cloud logging and monitoring concepts across AWS, Azure or GCP: IAM signals, audit logs, flow logs and service logs

• Experience working with log or audit data at large volume

• Experience with a SIEM or UEBA platform in an operating, engineering or evaluation capacity, and working knowledge of adjacent monitoring technologies: IDS/IPS, firewalls and threat intelligence feeds

• Additional scripting in PowerShell or Bash

• Data tooling beyond SQL: pandas, Polars, DuckDB, or similar

• Version control and reproducible analysis as a working habit

• Familiarity with security frameworks and standards such as NIST or CIS Benchmarks

• Relevant certification such as GCIA, GCDA, GCFA, GCIH, GSEC, CySA+ or comparable

Additional Information

• Travel: 30% on site client travel required
• Work Schedule: remote-friendly.

At Impact Advisors, we are committed to transparency and equity in our compensation practices. The compensation for this role includes a salary range of $95,000 – 180,000. For salaried positions, this role may also be eligible for an annual performance bonus. Additional benefits and perks may also be available, depending on the position and employment terms.

This range reflects consideration of several factors, including skills, experience, training, certifications, and organizational needs.

Our People and Culture

At Impact Advisors, we cultivate a caring, fun, honest, and autonomous work environment. Our success stems from our associates' dedication and a shared mission to create a “Positive Impact.” We embrace diversity and inclusion, fostering an environment where all employees feel valued and empowered.

Join Impact Advisors and make a real difference in healthcare.

For salaried positions, this role may also be eligible for an annual performance bonus. Additional benefits and perks may also be available, depending on the position and employment terms. This range reflects consideration of several factors, including skills, experience, training, certifications, and organizational needs.

Our People and Culture

At Impact Advisors, we cultivate a caring, fun, honest, and autonomous work environment. Our success stems from our associates' dedication and a shared mission to create a “Positive Impact.” We embrace diversity and inclusion, fostering an environment where all employees feel valued and empowered.

Join Impact Advisors and make a real difference in healthcare.