Principal Applied Scientist

About the role

Discover and validate abuse mechanisms. Form original, testable hypotheses about adversarial manipulation of web and advertising systems and emerging LLM-native monetization flows. Investigate system behavior, service interactions, and economic incentives to explain how the abuse works. Personally implement adversarial experiments.

Build automated clients, instrumented browser workflows, simulations, and replay harnesses under safe, authorized conditions with clear scope and safeguards. Use appropriate controls and competing hypotheses to distinguish demonstrated mechanisms from unvalidated assumptions. Develop rigorous evaluation methods.

Assess whether experiments represent real-world conditions, establish the provenance and quality of labels, and measure generalization, coverage, false-positive risk, and robustness to adaptation. Build durable research and investigation systems. Design, implement, test, deploy, and maintain the services, instrumentation, telemetry pipelines, and reusable libraries needed for the research portfolio.

Turn successful approaches into reliable capabilities that other researchers and partner teams can use independently. Connect experiments to real-world evidence. Apply behavioral, graph-based, temporal, and cross-surface analysis to large-scale telemetry. Identify adversary infrastructure and evasion patterns, determine prevalence, and quantify economic exposure while stating uncertainty and limitations.

Establish authoritative ground truth. Correlate evidence across accounts, traffic, transactions, providers, devices, and infrastructure. Reconstruct attack chains and produce reproducible datasets and technical assessments that clearly state mechanism, provenance, confidence, scale, and impact. Translate findings into stronger defenses.

Produce candidate signals, labeled evaluation datasets, monitored indicators, and reproducible regression scenarios. Partner with teams that own production defenses to evaluate improvements and verify that corrective actions address the demonstrated abuse. Lead scientific and technical work.

Set priorities for the research portfolio, guide experimental and architectural decisions, mentor others, and influence adoption across organizational boundaries while making substantial direct research and code contributions. When material incidents arise in the portfolio, lead reconstruction and turn findings into reusable evaluations and capabilities. Embody our Culture and Values.

Bachelor's Degree in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 6+ years related experience (e.g., statistics, predictive analytics, research) OR Master's Degree in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 4+ years related experience (e.g., statistics, predictive analytics, research) OR Doctorate in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 3+ years related experience (e.g., statistics, predictive analytics, research) These requirements include but are not limited to the following specialized security screenings: Master's Degree in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 9+ years related experience (e.g., statistics, predictive analytics, research) OR Doctorate in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 6+ years related experience (e.g., statistics, predictive analytics, research) OR equivalent experience.

Demonstrated experience proactively identifying and investigating adversarial abuse at web scale through hypothesis-driven analysis of large-scale traffic or transaction telemetry and entity resolution across complex ecosystems.

Demonstrated ability to produce written technical assessments that stand up to scrutiny, stating mechanism, evidence, confidence and economic impact clearly enough for engineering and executive audiences to act on.

Demonstrated experience developing and evaluating machine learning or statistical detection methods on large-scale telemetry, including label validation and measurement of precision, recall, coverage, and drift; and shipping production services or data pipelines using Python and large-data tools such as Spark or SQL.

Direct experience with advertising or monetization fraud ecosystems, including invalid traffic detection, OpenRTB and supply-path mechanics, click and conversion fraud, botnets, device spoofing, residential proxy networks, or synthetic identity abuse.

Red team, offensive security, or adversarial simulation experience, with a track record of designing safe attack simulations and converting findings into reusable regression tests rather than one-off exploits.

Working knowledge of LLM-native attack surfaces and agent-assisted analysis tooling, with experience in relevant methods such as structured threat modeling, graph analysis, anomaly detection, controlled experimentation, attack replay, FMEA, or STPA. Experience influencing outcomes across organizational boundaries, where the evidence you produce is acted on by teams that own remediation and enforcement rather than by your own team.