PhD FindDoctoral opportunities · PhDFind
Menu
中文

Power Systems Security PhD | Interpretable Cyberattack Detection

Project 2756 · Tallinn University of Technology (TalTech) · Department of Computer Systems, School of Information Technologies; co-supervision in electrical power engineering

Application workspace

Save this opportunity and prepare around its actual requirements. Confirm deadlines and eligibility at the original source.

Read the research report View the recruitment source
Country or region
Estonia
Application deadline
2026-12-04 (confirm the exact time with the source)
Funding
Full-time employment, minimum €2,300 gross per month and tuition-free doctoral study; contract duration, start date and other benefits not specified.

The research opportunity

Project overview

Tallinn University of Technology (TalTech) offers a full-time, salaried doctoral research position in the SIPSIK power-system cybersecurity project. The researcher will combine data mining and machine learning to detect suspicious patterns in operational energy-system data and make alerts interpretable. The vacancy states a gross salary of at least €2,300 per month and tuition-free doctoral study.

Research focus and doctoral work

The work includes reviewing existing detection methods, preparing and analyzing real and simulated operational data, developing interpretable detection algorithms, and benchmarking them in representative scenarios. It considers data representation, transparent rules and the trade-offs among accuracy, false alarms, interpretability, computational cost and transfer across operating conditions. Network and real-time digital simulation may be used where appropriate; the datasets, schedule and access to particular platforms are not specified. Collaboration, research communication, publication and a doctoral thesis are also expected.

Institution and supervisors

The host is TalTech's Department of Computer Systems in the School of Information Technologies, with co-supervision in electrical power engineering. Tara Ghasempouri is the main supervisor, with Marko Tealane and Mart Landsberg as co-supervisors; the vacancy and a saved official profile use different academic titles for Ghasempouri, so confirm her current title and the supervision split. The vacancy lists the Information and Communication Technology doctoral programme. Its general four-year, 240 ECTS structure does not confirm the employment contract length or start date.

Application and funding

Applications run from 4 November to 4 December 2026; the recorded deadline is 4 December at 23:59 Europe/Tallinn. The full-time appointment pays at least €2,300 gross per month and doctoral study is tuition-free; other benefits and the contract term are not specified. A saved support letter documents submission of a SIPSIK funding proposal, not an award decision. The position is advertised as funded, but applicants can confirm the budget and appointment terms. The vacancy does not provide a complete materials checklist or a complete admissions email. TalTech's general guidance describes a €100 non-refundable qualification-assessment fee for most applicants, with exemptions; verify applicability and the correct contact.

Applicant fit and questions

The vacancy requires a relevant master's degree or equivalent, a strong foundation in at least one of data mining, machine learning, cybersecurity or power-system modelling, Python programming, understanding of networks, digital systems or power-system operations, and research and communication skills. General admission guidance describes B2 English evidence or an accepted English-taught master's route for foreign applicants; confirm individual requirements. Experience in interpretable ML, operational time-series, smart grids, simulation or research writing is beneficial rather than mandatory. Confirm the specific datasets and simulation access, enrolment process, the supervisory division, and the written appointment and benefit terms.

Research and application brief

Report generated: . This date does not confirm that recruitment remains open.

Information updated: . Recheck the original notice before applying.

Show report contents

Power Systems Security PhD | Interpretable Cyberattack Detection

Evidence reviewed: 8 November 2026

Quick Decision

Strong but verify fit. This is a clearly scoped, full-time TalTech early-stage researcher position combining data mining, machine learning and power-system cybersecurity. The vacancy states a gross salary of at least EUR 2,300 per month and tuition-free doctoral study. It is best aligned with candidates who can show depth in at least one of the listed areas, practical Python skills, and an ability to explain results across computing and electrical-power domains. Applications are open from 4 November through 4 December 2026; the listed deadline is 23:59 Europe/Tallinn. Official position page

The research problem is concrete: identify suspicious patterns in operational power-system data while distinguishing them from legitimate operating changes, and make alerts interpretable to system operators. Material details remain open: the vacancy gives no contract end date, named datasets, or guaranteed access to particular simulation facilities. TalTech's current researcher profile also uses a different academic title for the main supervisor than the vacancy. A public support letter shows that SIPSIK was submitted to a funding call, but does not document an award; the post itself is advertised as funded. Confirm the job terms, application checklist, data/platform access and supervisory roles with TalTech before accepting an offer.

Research Problem and Doctoral Work

What Is Unsolved and Why It Matters

Power systems increasingly depend on digital communications, monitoring and automated control. This creates a detection problem with real operational consequences: suspicious measurements or events must be noticed without treating every ordinary change in load, configuration or system state as an attack. Estonia's national risk assessment identifies cyberattacks among several possible causes of outages, alongside weather and technical failures. That context supports the public value of better detection, but it does not mean the doctoral researcher will be assigned to operational incident response. National risk assessment

Recent reviews describe a broad research shift toward context-aware monitoring, more careful benchmark and metric choices, and evaluation across changing operating conditions. A 2026 smart-grid survey maps detection research and its dataset and metric limitations; a 2025 power-system review surveys simulation, detection and research gaps. A 2025 TalTech-group paper addresses class imbalance in smart-grid intrusion detection, while a separate study uses multiple forms of power-system data for anomaly detection. Together, these works help explain why the vacancy emphasizes false alarms, interpretability, computation cost and transferability. They do not show that this project will use the same models, data, benchmarks or performance targets. Smart-grid detection survey, power-system cybersecurity review, TalTech smart-grid study, multimodal power-data study

Work, Methods, and Potential Outputs

The advertisement says the researcher will:

  • review cyberattack-detection methods and identify research gaps;
  • prepare and analyze operational and simulated power-system datasets;
  • develop interpretable detection algorithms using data mining and machine learning;
  • validate and benchmark methods under representative scenarios;
  • work with project partners, communicate findings, publish results and complete a doctoral thesis.

The proposed work also examines data representation, feature selection, transparent detection rules, accuracy and false-alarm trade-offs, interpretability, computational cost, and transfer across operating conditions and scenarios. Evaluation may use real and simulated data and controlled network or real-time digital simulation where appropriate. These are advertised directions; the specific datasets, platforms, access arrangements and experimental schedule are not disclosed. Official position page

Recent publications suggest several possible questions that fit the advertised goals: how to preserve useful alert explanations as operating data change; how to evaluate detection when examples are imbalanced; and how to compare methods across more than one operating regime. These are research interpretations, not promised thesis aims. The main supervisor's 2023 work applied temporal association-rule mining to filesystem activity, and a 2024 paper applied temporal association rules to hardware verification. Both are methodologically relevant but use different systems. A 2025 TalTech-group paper is directly about smart-grid intrusion detection, but it is not by the named supervisors. 2023 association-mining paper, 2024 ARTmine record, 2025 smart-grid paper

School, Programme and Field Context

The advertised employer and degree-awarding institution is Tallinn University of Technology (TalTech) in Tallinn, Estonia. The position is hosted in the Department of Computer Systems, part of the School of Information Technologies; its stated doctoral programme is Information and Communication Technology. The vacancy also names co-supervisors from the Department of Electrical Power Engineering and Mechatronics in the School of Engineering. The public evidence supports an interdisciplinary arrangement across these TalTech units. It does not establish a joint degree, an external degree-awarding institution, or a specific assignment at an industry partner. Official position page, ICT doctoral programme, power-engineering department research areas

TalTech describes the ICT doctorate as a four-year, full-time programme worth 240 ECTS, with at least 30 ECTS of coursework and 210 ECTS of research. It is tuition-free and awards a PhD in Information and Communication Technology. The general early-stage researcher route is a competitive university appointment, with doctoral admission and the employment offer handled through the university's process. The programme's four-year nominal duration should not be read as the specific contract's confirmed start and end dates; ask the employer to state the appointment period in writing. ICT doctoral programme, TalTech doctoral admission, doctoral regulations effective 27 February 2026

TalTech's QS profile shows #600 overall in the QS World University Rankings 2027. This is an institutional ranking only; the saved material does not identify a subject ranking for power-system cybersecurity or this particular ICT specialty. It should not substitute for reviewing the supervisors' direct fit and the project's research resources. QS TalTech profile

Supervisor and Lab Assessment

The vacancy names Tara Ghasempouri as main supervisor, with Marko Tealane and Mart Landsberg as co-supervisors. The official researcher-system profile currently describes Ghasempouri as a Computer Systems professor working in hardware verification and hardware security; the vacancy labels her Assistant Professor. This may reflect a title update, but the exact current appointment and day-to-day supervisory role should be confirmed. Her recent association-mining work is a useful methodological signal, not evidence of previous supervision on this exact power-system topic. Ghasempouri profile, 2024 ARTmine record, 2023 association-mining paper

The power-engineering co-supervisors add relevant engineering and sector context. TalTech's record of Tealane's 2023 thesis concerns synchronized-phasor-based power-system protection. Landsberg's official profile records an energy PhD and prior Elering work in power-system management, planning and asset management. TalTech lists power systems as a department research area. An older 2020 paper coauthored by Tealane is directly about cyber risk to power-system automation and protection; because it is outside the recent 3–5-year window, it is context rather than evidence of current project methods. Tealane thesis defence, Landsberg profile, department research areas, 2020 power-system cyber paper

The public sources confirm an interdisciplinary team and departmental research areas, but they do not confirm the specific simulation laboratory, hardware or data repositories available to this post. Ask what the researcher can access at the start and which partners supply operational data. TalTech Cybersecurity Research Group publications

Funding, Application, and Living Cost

Funding and Application

The employer advertises a full-time gross monthly salary of at least EUR 2,300 and tuition-free doctoral study. This is an employee salary floor, not a net take-home estimate. TalTech's general ICT programme page says early-stage researchers have a work contract and gross monthly income during the four-year nominal study period. The job page does not state its own contract start/end date or describe benefits beyond tuition-free study, professional development, collaboration and publication/conference opportunities. Confirm the exact appointment term and compensation package in the offer. Official position page, ICT doctoral programme

An RIA support letter dated 17 April 2026 confirms that SIPSIK was submitted to the Estonian Research Council's TemTA 2026 call and that RIA was ready to participate as a partner. It is not an award notice. This does not negate the vacancy's funded-position offer; it means the public record reviewed here does not establish the proposal's later award status or the exact funding source. RIA support letter

The employer page lists applications from 4 November to 4 December 2026. The captured deadline is 23:59 Europe/Tallinn on 4 December; verify the cutoff shown in the application portal before submitting. TalTech's general admission guidance calls for a CV, passport/ID, degree diplomas and transcripts, and for foreign applicants proof of English at least B2 or confirmation that the master's programme was fully taught in English. From 1 June 2026, the university also charges a non-refundable EUR 100 qualification-review fee, with exemptions for specified applicants including EU citizens and graduates of Estonian higher-education institutions. The vacancy may request extra materials, so use its current checklist and ask admissions whether the fee applies to the applicant's case. Official position page, TalTech doctoral admission

Tallinn Cost Context

TalTech's cost page gives student-oriented estimates of about EUR 300 per month for food and EUR 500–750 or more for a small private flat, with winter utilities estimated at EUR 120–350. Using those three items only gives a rough subtotal of EUR 920–1,400 per month before transport, personal costs, taxes, deposits or other housing charges. The estimates are dated and are not a researcher-specific 2026 budget. TalTech staff guidance warns that attractive rentals move quickly, which makes early housing research useful if the application progresses. The gross salary cannot be compared directly with this subtotal as disposable income. TalTech cost of living, TalTech staff accommodation guidance

Applicant Fit and Preparation

Required Background and Skills

The vacancy requires a master's degree or equivalent in computer engineering, cybersecurity, electrical engineering, power systems, computer science or a closely related subject. It asks for strong grounding in at least one of data mining, machine learning, cybersecurity, or power-system modelling/simulation; good programming, especially Python; and understanding of computer networks, digital systems or power-system operation. Applicants should also be able to conduct independent research, analyze experimental results, communicate clearly, meet TalTech's doctoral English requirements, and work independently with an interdisciplinary team. Official position page

Preferred Experience and Suggested Preparation

The following are beneficial, not stated as mandatory: association-rule mining, anomaly detection or interpretable ML; time-series, network-traffic or energy data; smart grids, industrial control, power protection or automation; NS-3, RTDS or comparable simulation; threat analysis or monitoring; and relevant research writing or publications. A candidate need not claim expertise in every item. A useful application would show one substantive match and explain how it connects to the other side of the computing/power-systems boundary.

As preparation rather than an advertised requirement, candidates can choose one research or engineering example and explain how they assessed false alerts, handled changing operating conditions, and made outputs understandable to a technical user. TalTech's ENISA-aligned skills material can help describe cybersecurity competencies, but it does not promise a specific job outcome. TalTech doctoral programme, ENISA cybersecurity skills development

Field and Career Context

Saved EURES information describes Estonia's information and communication technology sector; ENISA reports discuss European cybersecurity recruitment and retention challenges and map relevant professional roles and competencies. These sources provide context for cybersecurity, energy-system monitoring and research careers, but do not promise employment or establish vacancy counts or salaries for this particular niche. EURES Estonia labour-market information, ENISA cybersecurity investment report, ENISA skills framework

Next Actions and Questions to Verify

Before Applying

  1. Ask the doctoral admissions office for the vacancy-specific document checklist, required English evidence, evaluation-fee applicability and whether the 4 December cutoff is 23:59 Europe/Tallinn in the application system.
  2. Confirm the position's contract start/end dates, salary conditions and any benefits beyond those on the vacancy page.
  3. If the funding source matters to the decision, ask whether SIPSIK's TemTA application was awarded and which budget guarantees the advertised employment.

At Interview

  1. Ask which operational datasets and simulation environments are available, what access conditions apply, and whether the network or real-time digital simulation mentioned in the advertisement is planned for this post.
  2. Ask how the three named supervisors divide research and career guidance, who will meet with the doctoral researcher regularly, and whether Ghasempouri's current role/title differs from the vacancy label.
  3. Ask how the research will be evaluated across operating conditions, including the intended balance between detection quality, false alerts, explainability and computational cost.

Before Accepting an Offer

  1. Obtain written confirmation of employment duration, gross pay, tuition status, leave and other employment terms.
  2. Confirm the degree programme, matriculation conditions, fee or exemption, and any qualification-assessment steps that apply to the applicant.
  3. Build an up-to-date personal Tallinn budget from current housing offers and the candidate's tax, household and relocation circumstances; do not treat the dated student estimates above as a guaranteed budget.

Evidence and Sources

Position, Programme and Admission

Institution, Supervisors and Research Environment

Supervisor and Field Publications

Estonia, Funding and Living Cost

Career and Skills Context

Sources

The listing may come from a university or recruitment platform. Check the notice and official sources in the report for current application requirements. View the recruitment source

Explore opportunities with related research or the same country, prioritising similar funding where relevant. Recheck each notice before applying.

Tallinn University of Technology (TalTech) · Estonia

PhD in smart-building energy modelling | Physics-informed transfer learning

The notice promises four years of full funding but does not specify salary or employment category. SMARTWIN runs from January 2027 to December 2029; request written confirmation of contract and funding for all 48 months.

2026-12-05 (confirm the exact time with the source)