Senior Cyber Investigator

TaskUs

15h•$120,000 - $160,000•Remote

About The Position

TaskUs is hiring a Senior Cyber Investigator to support a specialized cyber investigations pod serving a frontier AI research and safety company. The role supports a safeguards mission to prevent advanced AI systems from being used by malicious actors. The investigator owns complex, high-consequence misuse escalations and threat actor profiling, distinguishes malicious activity from benign dual-use security research, mentors Junior Investigators, and produces high-fidelity labels used to train automated safety classifiers. The role is remote in the United States, with Texas residency preferred. Daily work involves reviewing potentially harmful prompts, exploit instructions, offensive scripts, and malicious payloads. Rotational escalation coverage may include occasional weekend or holiday support. Selected candidates may undergo client-directed insider threat screening and specialized background checks before and during the engagement.

Requirements

At least 5 years of hands-on experience in cyber threat intelligence, incident response or digital forensics, digital investigations, offensive security, or technical OSINT.
Strong applied knowledge of the MITRE ATT&CK matrix, modern malware and ransomware delivery chains, and common exploitation techniques.
Working proficiency in SQL and Python, or similar scripting, to query logs, parse structured data, and identify anomalous actor behavior.
A proven ability to assess ambiguous or incomplete evidence, make high-confidence determinations, and clearly document technical findings in written case logs.
Experience conducting peer reviews or quality assurance, or mentoring junior analysts in a SOC, CIRT, or trust and safety environment.
Based in the United States with unrestricted work authorization.

Nice To Haves

Texas residency.
Background in military intelligence, law enforcement cyber units, or government national security operations.
Direct experience analyzing AI misuse, LLM prompt exploitation or jailbreaks, or automated abuse vectors.
Technical certifications such as GCFA, GCTI, GREM, OSCP, or CySA+.
An active or recent U.S. Government Security Clearance.
Experience tracking threat actors across the dark web and closed criminal forums.

Responsibilities

Investigate complex abuse cases and appeals escalated by automated detection systems and Junior Investigators, including cases involving ransomware and malware authoring or obfuscation, exploit discovery and weaponization, large-scale data scraping and automated exfiltration, and offensive operations, reconnaissance, and intrusion staging.
Analyze accounts, telemetry, and external threat intelligence to identify coordinated adversarial campaigns and profile actor tactics, techniques, and procedures.
Distinguish legitimate defensive security work, such as authorized auditing and academic research, from active malicious intent.
Review Junior Investigators’ casework, provide actionable feedback, and lead calibration sessions to maintain rigorous labeling standards.
Use SQL, Python, or investigative tooling to analyze usage telemetry, identify anomalous behavior, and surface emerging abuse trends across large datasets.
Write concise intelligence briefs and enforcement recommendations for the Principal Investigator and client safety leads.
Promptly escalate critical threats and zero-day discoveries.