Description
TaskUs partners with pioneering technology companies to build the safety, intelligence, and human-in-the-loop operations powering next-generation artificial intelligence.
As the Principal Cyber Investigator, you will serve as the pod's senior technical authority and operational lead. You will oversee a tiered team of investigators, direct complex actor and campaign-level attribution, recommend high-consequence enforcement actions, and ensure case labels provide high-fidelity training data for automated detection models.
Responsibilities:
- Technical Escalations & Adjudication: Act as the final technical authority on the pod for ambiguous, high-severity cyber misuse escalations, customer appeals, and complex actor attribution.
- Investigation Standards: Develop and refine investigative playbooks targeting priority abuse vectors: ransomware, large-scale data exfiltration, local/remote exploits, and offensive cyber operations.
- Team Leadership & Calibration: Lead and mentor a pod of Senior and Junior Investigators; drive regular calibration routines and quality workflows to maintain defensible, consistent determinations across the team.
- Model Feedback & Data Labeling: Deliver precise, highly calibrated case labeling to benchmark, test, and directly improve the accuracy of client automated detection models.
- Campaign & Pattern Analysis: Pivot off isolated telemetry to uncover coordinated adversarial campaigns and emerging threat actor tactics.
- Executive Briefings: Synthesize complex cyber findings into concise, actionable briefings for client safety leadership; advise on emerging adversary tradecraft and program scaling needs.
- External Threat Intelligence: Cultivate working relationships with vetted external threat intelligence and information-sharing communities where client protocols permit.
Requirements:
- 9+ years of hands-on experience in cyber threat intelligence (CTI), digital forensics and incident response (DFIR), offensive security, counter-cyber operations, or specialized OSINT investigations.
- Applied Adversary Tradecraft: Deep operational familiarity with the MITRE ATT&CK framework, offensive exploit lifecycles, C2 infrastructures, and ransomware/malware staging.
- Technical Leadership: Proven experience managing, mentoring, or technically directing an investigative unit, threat pod, or SOC escalation tier.
- Pragmatic Judgment: Proven ability to make decisive, reasoned determinations based on partial, noisy, or ambiguous data, with the ability to clearly justify your rationale in writing.
- Cross-Disciplinary Communication: Demonstrated skill translating technical threat mechanics into actionable risk assessments for policy, legal, and engineering counterparts.
- Location & Authorization: Based in the United States with unrestricted work authorization.
Benefits:
- Competitive industry salaries
- Comprehensive benefits package including medical, dental, and vision insurance; 401(k) with company match; and paid time off including vacation, sick leave, and holidays