Technical Cyber Threat Investigator Jobs

About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the Role We are looking for a Technical Cyber Threat Investigator to join our Threat Intelligence team. In this role, you will be responsible for detecting, investigating, and disrupting the misuse of Anthropic's AI systems for malicious cyber operations. You will work at the intersection of AI safety and cybersecurity, conducting thorough investigations into potential misuse cases, developing novel detection techniques, and building robust defenses against emerging cyber threats in the rapidly evolving landscape of AI-enabled risks. Your work will directly protect the broader ecosystem from sophisticated threat actors who seek to leverage AI technology for harm. Important context: In this position you may be exposed to explicit content spanning a range of topics, including those of a sexual, violent, or psychologically disturbing nature. This role may require responding to escalations during weekends and holidays. Responsibilities Detect and investigate attempts to misuse Anthropic's AI systems for cyber operations, including influence operations, malware development, social engineering, and other adversarial activities Develop abuse signals and tracking strategies to proactively detect sophisticated threat actors across our platform Create actionable intelligence reports on new attack vectors, vulnerabilities, and threat actor TTPs targeting LLM systems Conduct cross-platform threat analysis grounded in real threat actor behavior, using open-source research, dark web monitoring, and internal data Utilize investigation findings to implement systematic improvements to our safety approach and mitigate harm at scale Study tr

About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Threat Intelligence team protects OpenAI’s technology, people, research, and infrastructure by proactively identifying and disrupting adversaries who seek to compromise our systems or misuse our models. We investigate sophisticated threats, build tooling to scale and augment analysis, and deliver intelligence that shapes security strategy and equips leadership with timely, risk-aware insights. We combine technical depth, investigative rigor, and strong cross-functional partnerships to uncover threats and drive impact across OpenAI’s security and research organizations. About the Role As a Technical Threat Investigator at OpenAI, you will help protect the company from sophisticated adversaries targeting OpenAI and the broader ecosystem, as well as those attempting to misuse our models in support of cyber operations. This is a deeply investigative role. You will independently conduct complex, end-to-end investigations into capable threat actors to understand their behavior, infrastructure, emerging techniques, and how AI is integrated into their workflows. You’ll use these insights to proactively identify malicious activity and drive detection, disruption, enforcement, and safety improvements across the company. You’ll translate your investigative findings into durable solutions that scale impact. You’ll build and own lightweight tooling, automate where it matters, and create AI-assisted workflows to make investigations faster, more repeatable, and more effective over time. In this role, you will: Conduct deep, end-to-end investigations into sophisticated threat actors interacting with OpenAI’s models, products, and broader ecosystem. Think like an adversary — model attacker behavior, anticipate misuse patterns, and proactively hunt for, identify, and disrupt malicious activity. Leverage internal telemetry, OSINT, vendor data, a

About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Threat Intelligence team protects OpenAI’s technology, people, research, and infrastructure by proactively identifying and disrupting adversaries who seek to compromise our systems or misuse our models. We investigate sophisticated threats, build tooling to scale and augment analysis, and deliver intelligence that shapes security strategy and equips leadership with timely, risk-aware insights. We combine technical depth, investigative rigor, and strong cross-functional partnerships to uncover threats and drive impact across OpenAI’s security and research organizations. About the Role As a Technical Threat Investigator at OpenAI, you will help protect the company from sophisticated adversaries targeting OpenAI and the broader ecosystem, as well as those attempting to misuse our models in support of cyber operations. This is a deeply investigative role. You will independently conduct complex, end-to-end investigations into capable threat actors to understand their behavior, infrastructure, emerging techniques, and how AI is integrated into their workflows. You’ll use these insights to proactively identify malicious activity and drive detection, disruption, enforcement, and safety improvements across the company. You’ll translate your investigative findings into durable solutions that scale impact. You’ll build and own lightweight tooling, automate where it matters, and create AI-assisted workflows to make investigations faster, more repeatable, and more effective over time. In this role, you will: Conduct deep, end-to-end investigations into sophisticated threat actors interacting with OpenAI’s models, products, and broader ecosystem. Think like an adversary — model attacker behavior, anticipate misuse patterns, and proactively hunt for, identify, and disrupt malicious activity. Leverage internal telemetry, OSINT, vendor data, a

The Team: As a Security Engineer 2 on the Cyber Threat Intelligence team, you will help Datadog stay ahead of evolving threats by identifying, analyzing, and operationalizing intelligence on threat actors, campaigns, and emerging threats. Working within Security Engineering, you will partner closely with security teams to translate intelligence into actionable security improvements across the company. You will serve as a subject matter expert on how the cyber threat landscape intersects with Datadog and contribute to intelligence-led decision making during both steady-state operations and active security incidents. This role provides opportunities to influence detection, response, and security strategy through technical analysis, collaboration, and intelligence-driven initiatives. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Develop and maintain tooling that automates the collection, processing, analysis, and dissemination of threat intelligence. Assess emerging vulnerabilities, threat activity, and security events to help stakeholders understand potential impact to Datadog. Conduct threat hunting and infrastructure analysis to identify adversary activity relevant to Datadog and improve defensive controls. Partner with security teams to operationalize intelligence into detections, investigations, and response workflows. Coordinate with information-sharing communities to gather, evaluate, and disseminate actionable intelligence. Produce technical briefings, threat reports, and intelligence products for security and engineering stakeholders. Who You Are: Experienced in writing and presenting operational and technical intelligence for threat detection, response, and security stakeholders. Skilled in partnering with detection and response te

The Opportunity Our Adobe Cyber Defense Center seeks a skilled and curious Senior Cyber Incident Responder eager to tackle new technologies. You'll use your digital forensics and network-based investigation expertise in this crucial role to boost our incident response capabilities. Collaborating with a multinational team, you'll conduct thorough investigations and defend our enterprise against evolving cyber threats. If you thrive in a challenging environment and are ready to enhance our Incident Response program, we want to hear from you! What you will do Incident Response Experience : Respond to incidents to retrieve, analyze, and preserve critical data, utilizing forensics and network knowledge on a global scale. Conduct thorough host forensics, network forensics, log analysis, and malware triage to arrive at conclusive findings and support incident response investigations. Tool Development : Identify areas for improvement in processes and tooling related to response at scale. Develop and enhance scripts, tools, and methodologies to support the collection and analysis of data on a large scale, optimizing our incident investigation capabilities. Team Support and Mentorship: Provide support and guidance to other members of our CSIRT team, working closely with Staff level responders and management. Global Reporting and Coordination : Translate technical analysis into clear reports and coordinate response actions with team members globally. Assist in drafting detailed reports and assigning remediation recommend dations across internal and external organizations. Training and Presentations: Develop and present comprehensive training sessions and presentations for both technical and non-technical audiences. Global Collaboration : As an expert in the field, work closely with teams globally during incidents, including threat hunting,

Ready to do the most impactful work of your career? At Coinbase , we are uncompromising on our mission to increase economic freedom. The bar is high, the environment is intense, and we like it that way. This isn't a place for complacency, it’s a place to be pushed past your perceived limits. If you're ready to build the future of finance alongside people who refuse to settle for "good enough," you belong here. Coinbase is a remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges.” learn more about working at Coinbase . Security is a primary competency at Coinbase, and the Threat Intelligence team within Security Operations keeps a watchful eye over every aspect of it. As a Senior Threat Intelligence Engineer, you'll combine deep technical expertise in tracking sophisticated adversaries with innovative AI engineering to protect billions of dollars in digital assets. You'll turn internal and external signals into durable detections and actionable intelligence, partnering across the entire organization to bring insights directly to the stakeholders who make risk-based decisions. What you'll do : Automate the tracking and analysis of sophisticated cyber threats targeting Coinbase's customers, employees, products, and infrastructure Influence decisions across the organization by reporting and presenting intelligence analysis to stakeholders, partners, and executives Model and curate our shared view of the threat landscape within Vertex Synapse, our Threat Intelligence Platform, while elevating analytic quality through critical peer review and strategic feedback Cultivate strategic relationships within Threat Intelligence communities to expand access to information and strengthen our trust network Investigate and deliver on a high volume of intelligence requests by prioritizing, documenting, and reporting timely and accurate information Serve as subject matter expert on the latest cyber

SIXGEN’s mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and cutting-edge capabilities to uncover vulnerabilities, protect vital systems, and ensure operational superiority in an ever-evolving digital landscape. POSITION OVERVIEW Position: On-NET Operator Job Type: Full-time Location: Sterling or Reston, VA (Hybrid) Clearance Requirements: Active TS/SCI required Experience: 7+ years WHAT YOU'LL DO We are seeking a skilled and motivated On-Net Operators to support advanced offensive cyber operations and mission-focused assessments for federal customers. The ideal candidate will possess deep technical expertise in networking, operating systems, digital forensics, and adversary tradecraft, with the ability to analyze complex environments, identify vulnerabilities, and emulate sophisticated threat actors. This role requires a highly analytical and self-motivated professional who can operate independently, lead small teams, and solve complex technical challenges in support of critical national security missions. KEY RESPONSIBILITIES Operations Conduct cyber operations and adversary emulation activities against complex environments. Analyze networks, systems, applications, and code to identify vulnerabilities and attack paths. Perform network traffic analysis, digital forensics, and technical investigations. Develop and execute creative solutions to achieve operational objectives. Technical Analysis & Development Utilize advanced networking, tunneling, and system-level expertise to support mission requirements. Analyze and manipulate Linux and Windows operating systems, filesystems, and network services. Develop and modify tools, scripts, and automation using languages such as Python, Bash, and C. Assess network protocols, encryption techniques, and enterprise environments. Collaboration & Leadership O

Security Operations Specialist A Career with Point72's Technology Team As Point72 reimagines the future of investing, our Technology team is constantly evolving our firm’s IT infrastructure and engineering capabilities, positioning us at the forefront of a rapidly evolving technology landscape. We’re a team of experts who experiment and work to discover new ways to harness open-source solutions, modern cloud architectures, and sophisticated Artificial Intelligence (AI) solutions, while embracing enterprise agile methodologies. Our commitment to building and innovating in the AI space provides the framework intended to drive smarter decision making and enhance how we build and operate our platforms and applications. As a member of Point72’s Technology team, we encourage and support your professional development from day one—helping you advance your technical skills, contribute innovative ideas, and satisfy your own intellectual curiosity—all while delivering real business impact for our multi-billion-dollar global business. WHAT YOU’LL DO Lead investigations into sophisticated cyber threats and shape defensive actions that protect the critical technology environment at the firm Serve as incident commander for high or critical incidents by coordinating response actions, driving timely decisions, and keeping stakeholders aligned Analyze and correlate security telemetry, log data, and threat intelligence to identify malicious activity and determine organizational impact Develop threat intelligence reports that explain findings, mitigations, confidence levels, and implications for security operations Create dashboards and visualizations that help security teams detect patterns, prioritize risks, and improve response decisions Hunt for advanced adversary activity by applying analytics, network diagrams, and system knowledge to identify hidden threats Partner with development teams to define requirements and enhancements for security capabilities, analytics, and operationa

Since 2003, Entrata has evolved from a visionary, student-led startup into a global leader in AI-driven property management technology. Today, we power the industry's most essential operating system, serving owners and residents worldwide through a comprehensive suite of intelligent leasing, payment, and communication tools powered by cutting-edge AI. With a proven track record of sustained growth and a global team of more than 2,200 employees, we offer the rare combination of established stability and high-velocity innovation. Recognized by the Silicon Slopes Hall of Fame and the Utah Business Fast 50, Entrata fosters a culture of radical transparency and entrepreneurial energy. At Entrata, we create an environment where different perspectives are valued and respected. Those perspectives challenge assumptions, strengthen our decisions, and raise the bar as we reshape the global living experience through AI-powered solutions. The Senior Director, Cyber Defense is responsible for Entrata’s information security defenses, cyber defense strategy, and incident response program. This role leads the capabilities required to detect, investigate, contain, and recover from security events across Entrata’s technology environment. The Senior Director partners with leaders across Security, Technology, Engineering, Infrastructure, Product, Compliance, Legal, and Communications to strengthen Entrata’s security posture and operational resilience. This role establishes the processes, technology, communication channels, and cross-functional discipline necessary to respond effectively to cyber threats while ensuring appropriate coverage across regions and time zones. Responsibilities Define and execute Entrata’s cyber defense strategy and multi-year operational roadmap aligned with enterprise risk. Serve as Incident Commander for significant security incidents—coordinating technical response, triage, containment, eradication, recovery, and b

SIXGEN’s mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and cutting-edge capabilities to uncover vulnerabilities, protect vital systems, and ensure operational superiority in an ever-evolving digital landscape. Position: CNE Developer Job Type: Full Time On-site WFH Friday Location: Columbia, MD Clearance Requirements: TS SCI Eligible with ability to pass CI polygraph Travel: 0% We are seeking a Computer Network Exploitation (CNE) Developer to research vulnerabilities, develop specialized software capabilities, and support authorized operations. This role combines low-level software development, reverse engineering, and vulnerability research to address complex technical challenges across operating systems, applications, and network protocols. The ideal candidate is comfortable working with unfamiliar codebases, investigating undocumented system behavior, and turning research findings into reliable, maintainable software. The developer will collaborate with researchers, systems engineers, and testing personnel throughout the development lifecycle. Responsibilities Design, develop, test, and maintain software supporting authorized CNE research, capability development, and mission requirements. Conduct vulnerability research and root-cause analysis of operating systems, applications, services, and network protocols. Reverse engineer compiled software, firmware, and proprietary protocols to understand functionality, identify weaknesses, and assess technical feasibility. Develop proof-of-concept implementations and mature validated research into documented, testable capabilities. Write and debug software Analyze platform internals, including memory management, process execution, system calls, access controls, and interprocess communication. Build development and testing environments tha

Location Details: Remote, India At GoDaddy the future of work looks different for each team. Some teams work in the office full-time; others have a hybrid arrangement (they work remotely some days and in the office some days) and some work entirely remotely.​ This is a remote position, so you’ll be working remotely from your home. You may occasionally visit a GoDaddy office to meet with your team for events or meetings. Join our team... The Securities Analytics and Products Group is responsible for developing and maintaining sophisticated software solutions to safeguard GoDaddy's ecosystem. We are seeking a dedicated Senior Software Engineer with a strong background in software development and a keen focus on security. The ideal candidate will have proven hands-on experience in software development, with a consistent track record of working with the latest software technologies while prioritising security best practices. As a key member of our engineering team, you will play a crucial role in designing, developing, and implementing secure software solutions to protect our organisation from cyber threats. You will get to work with some of the brightest minds to build secure, highly available, fault-tolerant, and globally performant microservices-based platform deployed on the AWS cloud, using the newest technology stack. While the role is primarily backend-focused, you'll also get opportunities to contribute to frontend features as needed, giving you exposure across the full stack. What you'll get to do... Design, develop, and maintain secure, highly available, fault-tolerant, and globally performant code deployed on AWS cloud. Ensure code quality through extensive unit and integration testing Own frontend features and UI components across projects on an as-required cadence, from design through delivery Investigate and resolve production issues, ensuring your team's DevOps on-call responsibilities Contribute to the technical documentation, code reviews,

The Challenge As the Senior Manager of the Cyber Threat Research & Intelligence team, you will guide Adobe's efforts to predict, identify, and respond to the changing threat environment. Your position is key to delivering high-quality intelligence at tactical, operational, and strategic levels. This intelligence helps Adobe's security teams and executive leaders make informed, proactive decisions. You will develop and enhance a leading threat research and intelligence program that transforms raw threat data into actionable insights. This program supports defenses based on adversary behavior and keeps Adobe ahead of advanced threat actors. This is an opportunity to lead with purpose, build Adobe's intelligence strategy, and make a measurable impact on how the organization understands and responds to important threats. What You Will Do Develop and take responsibility for the strategic vision of Adobe's Cyber Threat Research & Intelligence program, covering tactical, operational, and strategic intelligence pillars. Lead a senior team of threat intelligence researchers, balancing deep technical research with timely intelligence production and collaborator engagement. Coordinate the full intelligence lifecycle — from collection and processing to analysis, production, and dissemination — ensuring intelligence outputs are relevant, accurate, timely, and actionable. Build and manage Adobe's threat actor tracking program, maintaining profiles on advanced persistent threat (APT) groups, cyber criminal organizations, and hacktivists relevant to Adobe's industry and attack surface. Produce and deliver intelligence products at multiple levels: tactical reports (IOCs, TTPs, YARA/Sigma rules), operational assessments (campaign analysis, actor attribution), and strategic briefings (threat landscape, industry trends, geopolitical risk). Partner closely wit

Senior Malware Analyst (Media, Malware, and Analysis – MMA) US CITIZEN ONLY Job Type Full-time Location Annopolis Junction, MD Clearance Requirement TS/SCI with CI polygraph Position Description The Senior Malware Analyst provides advanced technical expertise in malware analysis, digital forensics, and cyber threat intelligence in support of USCYBERCOM cyberspace operations. This role directly supports operations across USCYBERCOM J3, Cyber National Mission Force (CNMF), and Joint Task Force-Ares (JTF-ARES), delivering critical insights into adversary tactics, techniques, and procedures (TTPs) targeting the Department of Defense Information Network (DODIN) and associated mission systems. The analyst performs deep technical analysis of malicious code, compromised systems, and digital media to identify threats, develop mitigation strategies, and enhance operational situational awareness. This position contributes to mission assurance, defensive cyberspace operations (DCO), and offensive cyberspace operations (OCO) by enabling timely, actionable intelligence and supporting enterprise cyber defense and exploitation capabilities. Key Responsibilities Conduct static and dynamic malware analysis , reverse engineering, and forensic examination of compromised systems and digital media to identify adversary TTPs and intrusion artifacts. Perform media exploitation and forensic analysis , including extraction and analysis of malicious files, logs, and system artifacts across Windows, UNIX/Linux, and network environments. Develop and disseminate technical intelligence reports, threat briefs, and executive summaries to support operational decision-making and leadership awareness. Identify and develop indicators of compromise (IOCs) , signatures, heuristics, and MD5 hash repositories to support detection and mitigation strategies. Analyze and correlate cyber threat intelligence (all-source, SIGINT, and technical data) to identify patterns, anomalies, and emerging thr

About the team The OpenAI for Government team is a mission-driven group bringing frontier AI to the U.S. Intelligence Community (IC) and broader national security enterprise. We partner with intelligence professionals to deploy secure, compliant AI capabilities—including ChatGPT Enterprise, ChatGPT Gov, and the OpenAI API—in mission-aligned environments that meet rigorous security, privacy, reliability, and responsible-AI requirements. As part of the OpenAI for Government team, you will work across IC elements and mission partners—including ODNI, CIA, NSA, DIA, NGA, NRO, and other federal intelligence organizations—to help analysts, collectors, operators, and technical teams apply frontier AI to their highest-priority missions. We accelerate adoption through hands-on support, mission-specific workflows, tailored enablement, and measurable operational outcomes while preserving human judgment, analytic integrity, and protection of sensitive information. About the Role The Strategic Delivery Lead (SDL) for the Intelligence Community will identify, shape, and deliver OpenAI’s highest-impact deployments for U.S. intelligence organizations. You will help IC customers translate mission priorities—including all-source analysis, intelligence production, collection management, open-source and geospatial exploitation, cyber threat analysis, knowledge discovery, and analyst productivity—into secure, technically feasible AI deployments built on the OpenAI API and enterprise products. The role is highly cross-functional and customer-facing: you will partner with Research, Engineering, Go-to-Market, Security, Legal, Privacy, and government mission, acquisition, and technical stakeholders to align on scope, remove delivery obstacles, and communicate progress from working teams to agency leadership. You will own end-to-end execution of technical delivery workstreams led by Forward Deployed Engineers, Researchers, Solutions Architects, and Enablement teams. You will establish mission

About the team Preparedness is a critical Safety Research team at OpenAI, which is focused on mitigating AI threats to global security that could scale to an extreme level of severity. Our work involves: Measurement. Monitoring and predicting the evolving capabilities of frontier AI systems. Mitigation. Keeping misuse safeguards, alignment tools, and security measures on track to adequately address extreme threats that might arise in the future. Coordination. Setting mitigation targets by maintaining OpenAI’s preparedness framework , and partnering with other staff to achieve these targets. This is urgent, fast-paced work that has far-reaching implications for the company and for society. About the role The stakes of securing OpenAI increases as our internal coding and research becomes increasingly driven by autonomous AI agents. Compromising these agents could allow a cyber threat actor to compromise many other parts of the company. In this role, you would lead Preparedness work defending the security of our internal AI agents against insiders, Advanced Persistent Threats (APTs), or powerful AI agents. We’re looking for a strong hands-on technical executor with experience working directly with advanced cyber threat actors. In this role, you will: Develop and maintain threat models via which advanced attackers could compromise our coding assistants and automated security systems. Identify security investments that are especially critical to make in advance; for example, prioritizing by implementation lead-times, costs, and benefit. Partner with Security, Infrastructure, Research, Legal, and Preparedness to align on implementation plans and tradeoffs. Lead technical execution directly when needed, including prototyping controls, writing and reviewing software, and coordinating engineers across teams. Work with penetration testers to close gaps in defenses. You might thrive in this role if you: Are an exceptional hands-on technical executor. Have worked with advanced