We are looking for a Principal Applied Scientist to join our Security Engineering organization and help define the future of security operations for Oracle’s SaaS ecosystem. This role offers a rare and high-impact opportunity to shape how next-generation detection, response, and threat defense will work across one of the largest enterprise cloud environments in the world.

As a Principal IC, you will architect and develop advanced ML and behavioral models that enable a new class of adaptive, intelligence-informed security capabilities. You will work directly with massive, noisy, and adversarial telemetry; build models that must operate at extreme scale; and pioneer approaches that transform how our analysts, detections, and automated systems understand attacker behavior.

In this role you will:

• Invent new ways to detect and disrupt attackers
• Build machine learning foundations for an AI-driven SOC
• Influence the architecture of detection pipelines for years to come
• Operationalize research at petabyte scale
• Raise the scientific bar across the security organization

You will work closely with Detection Engineering, Red Team, Threat Intelligence, and Data Engineering to identify meaningful signal, reduce noise, validate hypotheses, and translate research into production systems that materially reduce risk.

Research & Modeling

• Develop novel ML models for anomaly detection, identity analytics, time-series/sequence analysis, graph modeling, and pattern mining across noisy, high-volume telemetry.
• Design experiments, baselines, evaluation metrics, and scientific methodologies for threat detection problems.
• Build prototypes, run experiments, analyze results, and iterate quickly.

Data & System Understanding

• Work with massive, sparse, high-cardinality datasets (1.2PB/day+) to extract signal from noise.
• Create data-efficient modeling approaches (self-supervision, embedding models, sampling strategies, feature extraction).
• Design inference strategies that work under tight cost, performance, and real-time constraints.

Cross-Functional Technical Work

Collaborate with Detection Engineering, Data Engineering, Red Team, and Threat Intelligence to define problem statements, understand attack patterns, and interpret telemetry.

• Provide scientific insights and deep technical guidance to engineering partners building pipelines and detections.
• Translate research prototypes into production-ready designs with engineering teams.

Scientific Rigor

• Establish strong modeling baselines, validation methodologies, ablation studies, and well-defined success criteria.
• Document findings, methodologies, and recommended approaches clearly and reproducibly.
• Maintain awareness of current academic and industry research; apply relevant advances appropriately.

Required Qualifications

Technical Expertise

• Deep knowledge of ML approaches relevant to security:
  • anomaly detection
  • statistical modeling
  • representation learning / embeddings
  • sequence models (RNNs, Transformers)
  • graph-based analysis
  • clustering and outlier detection
• Strong understanding of:
  • adversarial ML challenges
  • noisy/weak/no-label environments
  • data imbalance and cost-sensitive modeling
  • model explainability and operational constraints

Hands-On Skills

• Expert programming in Python, SQL; comfortable with Spark, Beam, Flink, or similar distributed data systems.
• Ability to rapidly prototype models and experiment with large datasets using PyTorch, TensorFlow, JAX, or similar.
• Experience building models that run in production, including monitoring, drift detection, and model evaluation.

Experience

• PhD or Master’s in Computer Science, Machine Learning, Applied Mathematics, or equivalent experience.
• 10+ years of industry or research experience applying ML to real-world problems.
• Experience with security telemetry, cloud logs, SIEM/EDR/XDR analytics, identity data, fraud detection, or similar adversarial domains strongly preferred.
• Demonstrated impact through deployed models, patents, publications, or widely adopted research outputs.

Disclaimer:

Oracle uses Artificial Intelligence in our recruiting process. Read more about it in our Recruiting Privacy Policy.
Range and benefit information provided in this posting are specific to the stated locations only


Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect Oracle's differing products, industries and lines of business.
Candidates are typically placed into the range based on the preceding factors as well as internal peer equity.

Career Level - IC4

Vacancy Type - New Position

This role will be working on a regular basis with colleagues around the world. To support this collaboration, knowledge of English is required for this role. Proficiency in French is required for candidates residing in Quebec, otherwise it is considered an asset.