Remote job
Threat Investigator US
Job details
About this role
Role overview Investigate harmful or suspicious activity and help respond to safety incidents across areas such as violence, child safety, cyber abuse, hate, and mental health. The work combines proactive threat detection, data analysis, open-source research, and clear reporting, including urgent escalations that existing systems may not catch. Investigations can involve distressing content.
Responsibilities - Identify and track potentially malicious actors and patterns of abuse. - Query and analyze internal data with SQL and Python to investigate suspected policy violations. - Cross-reference findings with open-source information and other investigative leads. - Write up findings and recommendations for internal teams. - Respond to urgent escalations, including during an on-call rotation. - Develop and maintain technical detection workflows.
Requirements - At least three years of relevant investigative experience in trust and safety, national security, defense, intelligence, law enforcement, or a related field. - Willingness to investigate sensitive material, including child safety content. - Based in the United States and able to work 9 a.m.–5 p.m. Pacific Time. - Strong SQL and Python skills, or comparable programming ability. - Technical investigation experience, including building or maintaining detection pipelines. - Able to shift quickly among different abuse areas and handle occasional after-hours escalations, including evenings and weekends.
Nice to have - Experience assessing risks and abuse involving AI platforms. - Professional fluency in Arabic, Chinese, Farsi, Portuguese, Russian, or Spanish. - Experience automating detection or mitigation, or using language models to scale investigative work. - Familiarity with areas such as extremism, scams, grooming, radicalization, digital mental health, or hateful groups.
Benefits and work setup This is a full-time remote role. The on-call rotation is typically seven consecutive days every two months, though operational needs may change the schedule.