Principal Cyber Investigator

TaskUs

19h•$140,000 - $215,000•Remote

About The Position

TaskUs partners with pioneering technology companies to build safety, intelligence, and human-in-the-loop operations for next-generation artificial intelligence. The Principal Cyber Investigator leads a dedicated cyber investigations pod supporting a frontier AI research and safety company. The role supports the mission of preventing malicious actors from using advanced AI systems to cause harm, with human investigative expertise providing ground truth for automated systems. Serving as the pod’s senior technical authority and operational lead, this position oversees a tiered team of investigators, directs complex actor and campaign-level attribution, recommends high-consequence enforcement actions, and ensures case labels provide high-fidelity training data for automated detection models. The position is remote in the United States, with Texas preferred. Daily work involves flagged prompts, malicious code, exploit attempts, and potential cyber threat tradecraft. Candidates may be subject to client-directed insider threat screening and background checks before and during employment.

Requirements

At least 9 years of hands-on experience in cyber threat intelligence (CTI), digital forensics and incident response (DFIR), offensive security, counter-cyber operations, or specialized OSINT investigations.
Deep operational familiarity with the MITRE ATT&CK framework, offensive exploit lifecycles, C2 infrastructures, and ransomware or malware staging.
Proven experience managing, mentoring, or technically directing an investigative unit, threat pod, or SOC escalation tier.
Ability to make decisive, reasoned determinations based on partial, noisy, or ambiguous data, and clearly justify the rationale in writing.
Demonstrated ability to translate technical threat mechanics into actionable risk assessments for policy, legal, and engineering counterparts.
Must be based in the United States with unrestricted work authorization.

Nice To Haves

Professional background in military intelligence, federal law enforcement, or national security cyber units tracking advanced persistent threats (APTs) or organized cybercrime.
Direct experience assessing or red-teaming AI/LLM misuse, jailbreaking techniques, or autonomous agent vulnerabilities.
Active or recent U.S. Government Security Clearance (Secret / Top Secret).
Industry certifications reflecting deep technical or investigative capability, such as GCFA, GCTI, GREM, OSCP, or CISSP.

Responsibilities

Act as the pod’s final technical authority for ambiguous, high-severity cyber misuse escalations, customer appeals, and complex actor attribution.
Develop and refine investigative playbooks for priority abuse vectors, including ransomware, large-scale data exfiltration, local and remote exploits, and offensive cyber operations.
Lead and mentor Senior and Junior Investigators, and drive regular calibration routines and quality workflows to maintain defensible, consistent determinations.
Deliver precise, highly calibrated case labeling to benchmark, test, and improve client automated detection models.
Analyze telemetry beyond isolated cases to uncover coordinated adversarial campaigns and emerging threat actor tactics.
Synthesize complex cyber findings into concise, actionable briefings for client safety leadership, and advise on emerging adversary tradecraft and program scaling needs.
Cultivate working relationships with vetted external threat intelligence and information-sharing communities where client protocols permit.
Recommend high-consequence enforcement actions and ensure case labels provide high-fidelity training data for automated detection models.