Description
TaskUs partners with pioneering technology companies to build the safety, intelligence, and human-in-the-loop operations powering next-generation artificial intelligence.
In this role, you will join a frontline cyber investigations pod supporting one of the world’s foremost frontier AI companies. The mission is clear: prevent state-of-the-art AI systems from being leveraged by malicious actors to cause harm. While automated detection systems catch abuse at scale, human investigators provide the crucial analytical ground truth.
As a Cyber Investigator, you will conduct day-to-day triage and analysis of flagged telemetry. You will evaluate high-risk cyber prompts, differentiate legitimate defensive security research from malicious intent, apply structured labels that train automated safety classifiers, and package well-documented escalations for Senior and Principal investigators.
Responsibilities:
- Queue Review & Triage: Investigate automated system flags across priority threat categories, including ransomware and malware authoring / obfuscation, local and remote exploit discovery and weaponization, large-scale data scraping and automated exfiltration, and offensive operations, recon, and intrusion staging.
- Dual-Use Evaluation: Determine whether observed activity represents benign security research or actionable policy violations, clearly detailing your rationale.
- Ground-Truth Labeling: Apply precise, policy-aligned labels to adjudicated cases to directly test, benchmark, and improve automated machine learning safety filters.
- Adversary Mapping: Map observed user prompts and tool usage to specific MITRE ATT&CK tactics and techniques.
- OSINT & Context Enrichment: Conduct targeted open-source intelligence (OSINT) research on indicators, tooling, and infrastructure to provide operational context.
- Escalations & Handoffs: Prepare concise, evidence-backed case dossiers to escalate high-severity, ambiguous, or novel threats to Senior and Principal Investigators.
- Calibration & Feedback: Actively participate in pod calibration sessions, adopting quality feedback to maintain high labeling consistency across the pod.
Requirements:
- 1–3 years of practical experience in SOC analysis (Tier 1/2), digital forensics, incident response (DFIR), threat intelligence, military cyber operations, or technical OSINT investigations.
- Understanding of Attack Lifecycles: Solid working knowledge of the MITRE ATT&CK matrix, basic network/system internals, and how common cyber intrusions and exploit chains progress.
- Analytical Documentation: Proven ability to synthesize complex case details into concise, objective written English summaries under operational timelines.
- Investigative Mindset: Natural curiosity, attention to detail, and sound judgment when evaluating noisy, incomplete, or borderline information.
- Location & Authorization: Based in the United States with unrestricted work authorization (Texas residency preferred).
Benefits:
- Competitive industry salaries
- Comprehensive benefits package including medical, dental, and vision insurance; 401(k) with company match; and paid time off including vacation, sick leave, and holidays.