Built on patterns: How Susan Chang’s econometrics roots drive machine learning for security and her minimalist workspace

Susan Chang’s path into machine learning didn’t start in computer science — it started in economics.

While studying econometrics, a field focused on applying statistical models to real-world economic systems, she developed a deep interest in understanding patterns hidden inside complex data.

“Econometrics is applied statistics for economics … that’s a large part of the foundation of machine learning,” she says. 

Susan brings that mindset to cybersecurity as a principal data scientist on Elastic’s Security team, where she builds machine learning systems that help organizations detect anomalous behavior across massive streams of security data.

A typical day for Susan involves some combination of reviewing design documents and pull requests, writing code, testing models, and collaborating across teams. 

To optimize her productivity, she keeps her desk setup intentionally simple. But the type of desk is important. Susan loves her Flexispot standing desk so much that she’s bought it twice.

“They're essential for stretching, or if I'm getting drowsy, then standing up can fix that. So, I really like a large standing desk,” she says. 

The core tools on her desk include an Acer 34” ultrawide monitor, a Logitech MX Master 3S mouse, and a Ducky One 65% Mechanical Keyboard, all used with her Apple M4 Pro with 48 GB memory. 

“I really like ultrawide monitors because you can fit a lot of stuff on them,” Susan says, but they’re less clunky to her than a dual monitor setup. 

Keeping things compact on her desk is a theme for Susan. After experimenting with different keyboard styles, she settled on a compact layout to maximize desk space. 

“The 65% keyboard layout doesn't have a Function key row or number pad,” Susan. “But I can even do heavy spreadsheets with just the number row.”

And the one non-technical thing on her desk is an Elastic mug she received for referring people to Elastic that says “employee referral expert.”

With a team spread across time zones, Susan relies on focus blocks and asynchronous communication to maintain momentum. She and her team brainstorm on Slack whenever they’re stuck on a problem.

“I find the people we hire in our team are all very good writers and communicators. I think Elastic indexes high for that, but not for the type of technical person that doesn't talk a lot, because it's very hard to do that here,” Susan says.

Susan and her team develop machine learning capabilities that power Elastic Security, helping organizations detect suspicious behavior across enormous datasets. Security data arrives as high-volume time-series logs, which makes identifying meaningful patterns difficult.

“The volume of data is quite high. But then you don't always have the correct patterns over time. You have to rely on the machine learning models to identify behaviors. Sometimes attackers might wait for a day or two days, or even longer, so how do you write detections that can account for those patterns?” she says.

One of the team’s current areas of focus is building evaluation frameworks for AI systems. These frameworks allow the team to measure whether new models actually improve outcomes, such as reducing false positives or identifying threats more accurately.

“For all of our tooling, we built testing frameworks and evaluation frameworks, so when we make a change, we can see if it will create more false positives or more errors,” she says.

Elastic’s architecture also allows models to be trained and deployed directly within Elasticsearch, enabling anomaly detection capabilities that identify suspicious logins, abnormal network activity, or unusual behavior on servers.

Looking ahead, Susan is particularly excited about the role Elastic will play in helping organizations extract insights from their proprietary data using AI.

“We're always creating new ways to make it easier for people to retrieve or find their data. This includes security logs as well, but it could include any other data that they store in Elasticsearch. We keep making and improving features and finding more AI-native ways to extract the data. I'm excited to see and use it myself, too.”

Outside of building machine learning systems, Susan spends her time speaking at conferences and sharing research with the broader machine learning community. This year, she is speaking at two conferences in Boston.

“I attend or speak at a lot of conferences. I really enjoy speaking about what I've been doing at Elastic,” she says.

But, while many of her colleagues speak at security conferences, Susan often presents at machine learning events, where she discusses topics such as evaluating AI-driven security features and comparing model performance.

This way, she bridges the machine learning and security communities while helping others understand how AI can be applied in real-world environments.

And for people just getting into security machine learning, she recommends developing strong machine learning fundamentals first, and then learning the domain context needed to apply those skills effectively.

“I started from the machine learning side and learned the domain of each industry I go into. Don’t neglect either of them.”

If you’re looking to join a company that’s pushing tech forward, check out our careers site.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.