DeFi Market Surveillance Analyst, Global Intelligence & Investigations

Polymarket•New York, NY

About The Position

Global Intelligence & Investigations is the team that keeps Polymarket's markets fair. We detect, investigate, and remediate insider trading, market and oracle manipulation, coordinated wallet activity, automated-trading abuse, sanctions and illicit-finance exposure, and fraud. We also handle law enforcement and regulatory requests tied to that activity. The team is small, operates with a high degree of independence, and works cases that require genuine analytical depth, not template matching. This is a crypto-native surveillance role that draws on two disciplines at once. Every trade on Polymarket settles on-chain, which makes wallet tracing and blockchain analytics the foundation of the work. Markets also run on an order book, so classic trade-surveillance skills apply directly. The strongest investigators here move fluidly between both, following wallets and funding flows across a blockchain, then corroborating against order-book behavior, device data, and open-source intelligence to reach a defensible disposition. You'll join a senior investigator who handles the most complex and ambiguous cases, and your job is to make sure the daily investigative workload gets worked with the same rigor. That means owning the alert queue, running down the matters that clear our investigation thresholds, and keeping every case moving to a documented resolution. Volume is real, and so is the quality bar. Bad actors here are technical and constantly adapting, and this role requires someone who follows threads the rules don't yet cover and looks for a better way to work rather than waiting to be handed one.

Requirements

3+ years in trade surveillance, on-chain investigations, blockchain analytics, financial crime investigation, or exchange operations. Strong DeFi experience can offset lighter traditional-surveillance tenure, and vice versa.
Hands-on wallet tracing experience: you can follow funding flows and withdrawal paths across a blockchain, identify controlling vs. contract wallets, work with bridges and mixers, and cluster related addresses to reach a disposition. This is the core of the job.
Solid working knowledge of order-book manipulation typologies, including spoofing, layering, wash trading, and coordinated multi-account activity, and of how exchange trading and order-book mechanics work. You don't need a decade on a surveillance desk, but this can't be brand new to you.
Proficiency in SQL or a comparable query language for pulling and joining trading, device/IP, and on-chain data. You write your own queries; you don't wait for someone else to pull the data.
Strong written communication, specifically case documentation that holds up to legal and regulatory scrutiny.
Genuine familiarity with how prediction markets and crypto-native platforms work, how markets resolve, and why their integrity matters.

Nice To Haves

Depth with blockchain analytics platforms such as Chainalysis, TRM Labs, or Elliptic.
Hands-on experience with automated trade-surveillance platforms such as Nasdaq SMARTS.
Familiarity with oracle and market-resolution mechanisms, and how resolution manipulation differs from trading-based manipulation.
Prior experience in a regulated financial environment (exchange, FCM, or introducing broker) or with sanctions and illicit-finance screening.
Python or similar scripting for data pulls, analysis, and lightweight tooling.

Responsibilities

Triage incoming alerts and referrals daily against documented investigation thresholds, set priority and next steps, and make sure genuinely novel signals don't get dismissed because they don't fit a known pattern.
Trace flagged wallets across chains, bridges, and funding flows, distinguishing controlling wallets from contract and proxy wallets, clustering related addresses, and following withdrawal paths to a documented disposition.
Review order-book and execution data for spoofing, layering, wash trading, and coordinated multi-account activity, working from trade-surveillance alerts and metrics like order-to-trade and cancellation ratios, and tie observed behavior back to the wallets driving it.
Investigate the full range of manipulation risk: insider trading, oracle and resolution-source manipulation, bot and automated-trading abuse, sanctions exposure, and illicit-finance flows.
Write queries, build lightweight analysis, and propose new detection signals based on what you're seeing day to day. The expectation is that you improve the process while you run it, not just execute it.
Document every matter with clear, sourced findings framed as suspected rather than confirmed, audit-ready from the moment the file opens.
Handle law enforcement and regulatory requests (subpoenas, preservation letters, court orders) against binding deadlines, tracking each matter and escalating anything unusual to legal counsel.