Astrophysicist-turned-data scientist introduces critical thinking to cybersecurity

A big part of a data scientist’s job is taking a step back and visualizing the bigger picture. What problem is the company solving? And what would it do with the answer a data scientist can provide?

“If they're like, oh, well, I don't know what I'd do with that, then maybe that's not the right question?” Leila Powell, Lead Data Scientist at cybersecurity company Panaseer, told Cybernews.

With artificial intelligence-boosted innovation, the role of data scientists is increasingly important. Or so I recently heard. Therefore, I decided to sit down for a chat with a longtime data scientist who, interestingly enough, dropped her academic work in astrophysics to pursue this career.

The interview has been edited for clarity and length.

You’re an ex-astrophysicist. Tell me what you used to do before you deep-dived into data science.

I started out studying physics and then went down the route of astrophysics research. I did my PhD at Oxford, and that was looking at supercomputer simulations of galaxy formation in the early universe.

Then, I continued that work in two postdoctoral positions – one in Paris and one in Munich. I was exploring how galaxies form really early in the universe, looking at the effect of things like supernovae on their formation and then how galaxies kind of merge together and combine. That was really interesting, and I enjoyed my time doing that, publishing papers and speaking at conferences in a range of interesting locations, from places like Burkina Faso to Beijing.

After I'd spent eight years in total doing research, I decided I’d like to do something applicable to day to day life, impacting people around me more directly. That's what prompted me to look for a new adventure.

But what about your degrees? The connection between astrophysics and data science and cybersecurity doesn’t seem to be that obvious.

If you'd had asked me when I was deciding to leave astrophysics, if I thought I would end up in cybersecurity, the answer would have been no. That was luck. Essentially, the skills that are the same are the ability to analyze data, and to code. I was doing a lot of coding and data analysis as part of my academic research. It just so happened there that the data I had was the output of a simulation of a galaxy. Now, the data I would be working with would be the output of a security tool.

So, the key thing that led me to look into data science as a career change was really the ability to answer really interesting problems and still work really closely with data. Data was the essential element to do all of my research, and it's the essential element of what I do now.

The coding, the analysis, and the communication is also really important in data science, same as when being an academic. You have to be able to explain your findings to create appropriate visualizations, present results, and be able to articulate what you found and why it's important.

Did you ever have regrets about leaving the astrophysics field? I mean, maybe by now, you would be sending vehicles on the Artemis mission and whatnot. Maybe it could have been very applicable, too.

I've never regretted it. I enjoyed my time doing what I did, but what I really enjoy about being involved with cybersecurity now is that it's so important to everyday life. Of course, you know, science and astrophysics are super important as well. But for me, it's seeing it reflected in everyday life as our lives become more and more online, and cybersecurity is becoming more and more important. You hear about it all the time. There's always another news story about some breach, some issue.

It's just such an issue that affects absolutely everyone in their day-to-day lives. I really value being part of it. I value being a small piece of that puzzle in terms of protecting critical services and data on which everyone relies.

Data scientists are playing an increasingly important role in business decisions, especially because of AI, with companies and cybercriminals alike rushing to implement it.

Earlier on in my career, there was quite a lot of talk about machine learning and a lot of hype around it. People got a bit tired of it. In the last couple of years, the explosion of generative AI solutions and the fact that a lot of those are just widely available to the public now has really changed the conversation.

The challenge with it is that now it's kind of everywhere. Companies need to be really discerning about when it's appropriate to implement AI. Is AI a useful thing? Could we benefit from it? Is this just something we're doing because it feels like everyone's talking about it?

Companies that are in that position will be leaning on their data science teams to help figure that out. The challenge with something like AI becoming really widely available rather than being a niche topic is that it's available to everyone, including cybercriminals, [...] being able to use ChatGPT to make phishing emails or something like that.

In cybersecurity, it's always been a bit of a race to get the latest technology and try to stay one step ahead of the attackers.

Is it easy for the companies to wrap their heads around the whole cybersecurity market and what they should buy? I know that you guys look into companies’ defenses and how effective they are. And we hear that companies randomly buy stuff based on better marketing. Are companies protecting themselves properly or just following some trends?

It can be difficult to figure out what people are actually selling. How do you validate claims about different AI capabilities? It can be really challenging but even on a more simple level. [...] There are just so many different tools as a part of the toolbox for a standard company that brings complexity in itself.

And then, if they grow through mergers and acquisitions, they might have four different vulnerability scanners for different parts of the business. So even just trying to get a sense of these… What are the tools that everyone agrees we should have, are they deployed across all of the devices? Do I even know what all of my devices are?

It sounds really fundamental, but even that is really challenging. That's where the scientific approach is bringing all that data together, analyzing it, and trying to give a clear picture. And that’s a lot of what my role is about today.

So, tell us more about what being a data scientist entails.

It changes a bit as to whether you are a kind of in-house data scientist working for one organization on their specific internal challenges versus my role – I'm working as a data scientist as part of a product. A lot of what I work on is product development. I'm trying to solve things in a more generic way that can apply to many people. Whereas if you're an in-house data scientist, you can be solving things that just apply to your organization, and that's fine.

The first thing you need to do is to understand what is actually the problem here? What question does someone have? What are we trying to solve? It's really important to establish what question someone has. Essentially, you are trying to translate that question they have into some analysis.

You need to go and see what data is available, to think about how you can analyze or process that data with any of the techniques in your toolbox.

It might be something very simple. Sometimes, simple is better. We don't want to jump to the most complex solution. And then, usually, it'll involve some coding to essentially automate a certain process.

Then there will be some time spent coding, testing, and producing the data. And then again, depending on your role, it'll be perhaps producing visualizations and presenting your results back. Or, in my case, working with the engineering team to make sure that the results are visualized within our software in an appropriate way.

Your role as a data scientist doesn't finish until the people who originally had the question have received and understood the answer you've given. [...] They need to be able to do something with it. This is where it's really important that what you have produced is understandable and someone can drive action off it.

So a big focus on communication, a big focus on being able to really understand from people what they need, and then being able to translate that into mathematical analysis and ultimately put that into code.