Head of Threat Intelligence

Promise • San Francisco, CA

2d • $210,000 - $260,000

About The Position

Promise is hiring its first Head of Threat Intelligence to build and lead a function that detects, investigates, attributes, and responds to hostile activity targeting the company and its leaders. The role covers the online surfaces where Promise, its executives, and key clients may be judged, including Wikipedia, search results, review and complaint sites, domain registrations, social platforms, paste sites, and public records. The successful candidate will monitor for emerging issues, develop evidence-based attribution hypotheses, use legitimate platform and legal processes to address abuse, and protect executives from threats such as doxxing, impersonation, phishing domains, and physical-security concerns.

The role has authority over retained outside firms, including Wikipedia consultants, litigation counsel, and investigators, and has a direct line to the CEO. Investigations are conducted at counsel’s direction and under privilege. The work requires careful, concise writing and evidence suitable for counsel and legal proceedings. Promise emphasizes lawful, defensible methods and prohibits unauthorized access, hacking back, undisclosed or retaliatory accounts, planted content, and exposing individuals without attribution that can be defended in court.

Promise builds AI-powered infrastructure for benefits delivery, payments, and program integrity for government agencies. The company supports programs including SNAP, Medicaid, unemployment, LIHEAP, property tax, and municipal fines, working in more than 15 states and with more than 24 utility clients. Candidates must be US persons and reside in the US.

Requirements

• Experience conducting investigations in a challenging environment, such as platform trust and safety, disinformation research, threat intelligence, or OSINT investigative journalism with a digital forensics record.
• Ability to use AI fluently to work at attackers’ speed and identify their output.
• Knowledge of Wikipedia’s living-persons policy, sockpuppet investigations, and John Doe subpoenas.
• Ability to produce attribution hypotheses with explicit confidence levels and evidence suitable for counsel.
• Strong concise writing skills for noticeboards, referrals, and evidence memos.
• Must be a US person (US citizen or permanent resident) and reside in the US.
• Must conduct work through legitimate, defensible means; unauthorized access, hacking back, undisclosed or retaliatory accounts, planted content, and unsupported exposure of individuals are prohibited.

Nice To Haves

• Experience as a trust and safety investigator at a major platform, including threat disruption, influence operations, or Wikimedia Trust and Safety.
• Experience as a disinformation researcher who has attributed coordinated account networks, such as at Graphika, DFRLab, the Stanford Internet Observatory, or a similar organization.
• Experience as a threat intelligence analyst at Nisos, Recorded Future, Mandiant, or Kroll.
• Experience as an OSINT investigative journalist with a digital forensics record.

Responsibilities

• Build monitoring tripwires across Wikipedia and Wikidata, search results, review and complaint sites, domain registrations, social platforms, paste sites, and public records, covering Promise, its executives, and key clients.
• Investigate and attribute hostile activity using account-graph analysis, stylometry, metadata, and timing; provide a named hypothesis, confidence level, and evidence suitable for counsel.
• Use platform processes to seek enforcement, including biography-of-living-persons noticeboards, sockpuppet investigations, repository and registrar takedowns, and search removals.
• Support counsel by preparing preservation lists, subpoena-ready evidence packages, public records requests, and referrals to Attorneys General and Inspectors General.
• Work with counsel on appropriate consequences when attribution is sufficiently supported, including platform bans, regulator referrals, and formal complaints.
• Protect executives from doxxing, impersonation, phishing domains, and physical-security signals.
• Produce concise, exact written materials, including noticeboard submissions, referrals, and evidence memos.
• Oversee retained outside firms, including Wikipedia consultants, litigation counsel, and investigators.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed