Principal Cyber Investigator

This is a fully remote position, open to applicants in Texas.

📋 Description

• Lead a specialized cyber investigations team that supports an AI research and safety organization.

• Serve as the senior technical authority and operational leader of the team.

• Supervise a multi-tiered group of investigators.

• Direct the attribution of complex actors and campaign-level activities.

• Recommend significant enforcement actions with high consequences.

• Ensure that case labels generate high-quality training data for automated detection models.

• Act as the final technical authority for ambiguous, high-severity cyber misuse escalations, customer appeals, and complex actor attribution.

• Develop and enhance investigative playbooks for ransomware, large-scale data exfiltration, local and remote exploits, and offensive cyber operations.

• Mentor both Senior and Junior Investigators.

• Drive calibration processes and quality workflows.

• Provide accurate case labeling to benchmark, test, and enhance automated detection models.

• Analyze telemetry to identify coordinated adversarial campaigns and emerging tactics from threat actors.

• Prepare actionable briefings on cyber findings for client safety leadership.

• Advise on emerging adversary tactics and the scaling needs of the program.

• Build relationships with vetted external threat intelligence and information-sharing communities when permitted.

⛳️ Requirements

• Over 9 years of hands-on experience in cyber threat intelligence (CTI), digital forensics and incident response (DFIR), offensive security, counter-cyber operations, or specialized OSINT investigations.

• Extensive operational knowledge of the MITRE ATT&CK framework, offensive exploit lifecycles, C2 infrastructures, and ransomware/malware staging.

• Proven experience in managing, mentoring, or technically directing an investigative unit, threat pod, or SOC escalation tier.

• Ability to make decisive and reasoned judgments based on incomplete, noisy, or ambiguous data, and to clearly articulate rationale in writing.

• Demonstrated capability to translate technical threat mechanics into actionable risk assessments for policy, legal, and engineering teams.

• Must be based in the United States with unrestricted work authorization.

• Preferred experience includes military intelligence, federal law enforcement, or national security cyber unit work tracking APTs or organized cybercrime.

• Experience in assessing or red-teaming AI/LLM misuse, jailbreaking techniques, or vulnerabilities in autonomous agents is preferred.

• An active or recent U.S. Government Security Clearance (Secret / Top Secret) is preferred.

• Industry certifications such as GCFA, GCTI, GREM, OSCP, or CISSP are preferred.

• Candidates may be subject to client-directed insider threat screening and background checks before and during employment.

🏝️ Benefits

• Competitive salaries within the industry.

• Comprehensive medical, dental, and vision insurance.

• 401(k) plan with company matching.

• Paid time off that includes vacation, sick leave, and holidays.

• An inclusive environment with a positive impact on the community.

• Opportunities for internal mobility and professional development.

• Reasonable accommodations provided during the hiring process.