Description
TaskUs partners with pioneering technology companies to build the safety, intelligence, and human-in-the-loop operations powering next-generation artificial intelligence.
As a Senior Cyber Investigator, you will join a specialized cyber investigations pod supporting one of the world’s foremost frontier AI companies. The mission is clear: prevent state-of-the-art AI systems from being leveraged by malicious actors to cause harm. While automated detection systems catch abuse at scale, seasoned human investigators provide the crucial analytical ground truth.
Responsibilities:
- Tackle High-Severity Escalations: Investigate complex abuse cases and appeals escalated by automated detection systems and Junior Investigators across priority threat areas: ransomware and malware authoring / obfuscation, local and remote exploit discovery and weaponization, large-scale data scraping and automated exfiltration, and offensive operations, recon, and intrusion staging.
- Threat Actor & Campaign Analysis: Pivot across accounts, telemetry, and external threat intelligence to uncover coordinated adversarial campaigns and profile actor tradecraft (TTPs).
- Evaluate Dual-Use Scenarios: Make sound, defensible determinations separating legitimate defensive security tasks from active malicious intent.
- Review & Mentor: Review Junior Investigators’ casework, provide actionable feedback, and lead calibration sessions to maintain rigorous labeling standards across the pod.
- Data-Driven Threat Hunting: Use SQL, Python, or investigative tooling to analyze usage telemetry, identify anomalous behavior, and surface emerging abuse trends across large datasets.
- Reporting & Escalations: Author concise intelligence briefs and enforcement recommendations for the Principal Investigator and client safety leads; elevate critical threats and zero-day discoveries promptly.
Requirements:
- 5+ years of hands-on experience in cyber threat intelligence (CTI), incident response (DFIR), digital investigations, offensive security, or technical OSINT.
- Adversary Tradecraft: Strong applied knowledge of the MITRE ATT&CK matrix, modern malware/ransomware delivery chains, and common exploitation techniques.
- Investigative Telemetry & Tooling: Working proficiency in SQL and Python (or similar scripting) to query logs, parse structured data, and identify anomalous actor behavior.
- Defensible Decision-Making: Proven track record of evaluating ambiguous, incomplete evidence, making high-confidence determinations, and articulating technical findings clearly in written case logs.
- Quality & Mentorship: Experience conducting peer reviews, QA, or mentoring junior analysts in a SOC, CIRT, or trust and safety environment.
- Location & Authorization: Based in the United States with unrestricted work authorization (Texas residency preferred).
Benefits:
- Competitive industry salaries
- Comprehensive benefits package including medical, dental, and vision insurance; 401(k) with company match; and paid time off including vacation, sick leave, and holidays.