Lead, Threat Intelligence

Polymarket

About The Position

Global Intelligence and Investigations exists to protect the integrity of Polymarket's markets and platform. This team sits within Legal and operates at the intersection of analysis, engineering, and real-world consequence. Threat Intelligence is the external-facing arm of that work, responsible for understanding who is targeting Polymarket and the broader crypto and prediction-market ecosystem, and making sure that intelligence actually changes how we defend ourselves. This is not a monitoring role. You will track real threat actors, build the pipelines that turn raw data into actionable intelligence, and work directly with Product and Security to get protections shipped. The crypto context matters here. Transactions are irreversible, adversaries are often sophisticated, and the gap between detecting a threat and acting on it has real financial consequences for real users. The work has weight. We're hiring one person to own this end to end. That means you need to be strong on both sides: the intelligence tradecraft and the engineering. If you can track an actor but need someone else to build the detection, or you can build pipelines but can't produce a written assessment a lawyer can act on, this is not the right fit. If you can do both, we want to talk.

Requirements

Demonstrated threat intelligence experience tracking real external actors, running collection and analysis, and producing intelligence that directly changed how a team defended itself or took action.
Hands-on engineering skills in Python, SQL, and data pipelines. You build detections and automation yourself. You do not spec them out for someone else to build.
On-chain analysis experience in crypto contexts, including familiarity with how adversaries use blockchain infrastructure and how to follow activity across chains.
Clear understanding of why crypto threats are different, irreversibility, pseudonymity, cross-border actors, and how that shapes both the threat landscape and the stakes.
Ability to distill complex, sensitive information into written assessments that legal and compliance teams can use to make real decisions.
Strong independent judgment. You can identify what matters, prioritize without being told, and build without a detailed brief.

Nice To Haves

Experience tracking sophisticated or state-linked threat actors.
Experience building threat intelligence platforms, feed automation, or enrichment pipelines at scale.
Hands-on experience with blockchain analytics tooling such as Chainalysis, TRM Labs, or Elliptic.
Brand protection or anti-abuse work at scale.
Prior experience at a crypto-native or prediction-market platform.

Responsibilities

Monitor external threat actors targeting crypto and prediction-market platforms, tracking campaigns, tactics, and infrastructure across open and closed sources.
Build and maintain Python pipelines that ingest, normalize, and enrich threat data from internal systems, external feeds, and intelligence partnerships.
Conduct on-chain analysis to identify suspicious activity and build monitoring systems that surface what matters before it becomes a problem.
Write threat assessments that legal, compliance, and non-technical stakeholders can read, understand, and act on without losing the nuance that makes them useful.
Turn intelligence findings into working detections and automated defenses, coordinating with Product and Security to get them deployed.
Manage relationships with external intelligence providers and integrate the data they supply into internal systems and workflows.
Identify gaps in coverage before they are exploited, and take ownership of closing them without waiting to be asked.