Principal Cyber Investigator

10a Labs•Washington, DC

13h•$150,000 - $180,000•Remote

About The Position

10a Labs is hiring a Principal Cyber Investigator for its Investigations Team. This is a one-year position with the potential for extension. The role leads day-to-day operations and quality oversight for an embedded cyber review team, combining senior cybersecurity expertise with operational leadership. The investigator manages team performance, works directly with client stakeholders, and establishes standards for the quality and consistency of labeling and review outputs. The position serves as the senior technical authority for complex and escalated cases, assessing potential real-world harm and offensive uplift. It monitors team quality and consistency, improves review processes, mentors investigators, and leads organization-level analysis of actor behavior to inform detection and mitigation. The role also uses DQL and programmatic queries against internal data sources and cross-references open-source information to support reviews and validate team output. The position is fully remote and U.S.-based.

Requirements

At least 9 years of experience in cybersecurity, threat intelligence, Trust & Safety, national security, defense, intelligence, or law enforcement domains.
Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
Demonstrated experience leading or managing investigative or review teams, including oversight of quality, output, and team development.
Deep subject-matter expertise in one or more of scaled data extraction, ransomware, local and remote exploits, or offensive security operations.
Familiarity with LLM systems and how AI technology can be misused for cyber operations.
Proven ability to serve as a final technical authority on complex cases, with sound judgment about harm potential and offensive uplift.
Strong SQL, Python, and other data-language proficiency for querying data and validating investigative output.
Exceptional written and verbal communication skills, including experience presenting findings to senior stakeholders.
Ability to rapidly context-switch across domains, modalities, and abuse areas in a fast-paced, ambiguous environment.
Ability to clear an insider-threat background check.

Nice To Haves

Experience working directly with or within frontier AI labs, large technology platforms, or Trust & Safety organizations.
Experience with threat intelligence frameworks such as MITRE ATT&CK.
Background in dark web monitoring, OSINT, or cross-platform threat analysis.
Experience building or scaling detection and mitigation pipelines.
Full professional proficiency in Arabic, Chinese, Farsi, Portuguese, Russian, or Spanish.
Active security clearance (Secret or above).
Relevant certifications such as OSCP, GREM, or GCTI.

Responsibilities

Oversee day-to-day operations of the embedded team, ensuring exchange labeling and review are accurate, efficient, and consistent with the client's rubric and review guide.
Serve as the senior technical authority on complex and escalated cases, making determinations about real-world harm potential and offensive uplift.
Monitor team quality and consistency metrics, identify gaps, and improve review processes.
Interface directly with client stakeholders to communicate findings, surface emerging trends, and align on evolving policy and rubrics.
Mentor and develop senior and junior investigators, guiding them on technically demanding and ambiguous cases.
Lead organization-level analysis of actor behavior and synthesize patterns across exchanges to inform detection and mitigation efforts.
Query internal data sources via DQL and programmatically, and cross-reference OSINT to support reviews and validate team output.