Senior Technical Threat Investigator, Trust and Safety Intel Investigations

Google•Washington, DC

3d•$159,000 - $230,000

About The Position

In this role, the mission is to identify the highest-severity and emerging on-platform Trust and Safety abuse and conduct technical investigative analysis to drive cross-Product Area detection, mitigation, and remediation measures. The investigator proactively hunts sophisticated threat actors, determines how they operate across Google products and services, and works with partner teams to disrupt their effectiveness through network-scoped actions and scaled detection and enforcement mitigations. Operating at the intersection of threat intelligence, data analysis, and security engineering, this role independently leads complex technical investigations and builds scalable, AI-enabled investigative and enforcement solutions across Google. The investigator takes ambiguous, high-severity cases from discovery and root-cause analysis through network-scoped disruption and cross-Product Area enforcement. The work combines investigative tradecraft with coding and analytical execution, including SQL, Python, large-scale data analysis, AI and agentic workflows, automation prototyping, data pipelines, and operationalizing threat signals with engineering partners. The role also evaluates detection performance, contributes reusable investigative playbooks, and mentors junior analysts. The listed US pay range is $159,000–$230,000, plus a 15% bonus target, equity, and benefits. The role involves reviewing graphic, controversial, or objectionable material, including child exploitation, graphic violence, self-injury, severe fraud/scams, and other disturbing content.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Intelligence Studies, a related technical field, or equivalent practical experience.
At least 5 years of experience in data analysis, cybersecurity, or technical threat investigations, including identifying trends, generating summary statistics, and drawing insights from quantitative and qualitative datasets.
At least 5 years of experience using SQL, Python, or similar scripting/programming languages to query datasets, build data pipelines, and solve engineering and abuse-detection problems.
At least 5 years of experience managing projects, including defining project scope, goals, and deliverables in a globally distributed environment.

Nice To Haves

Experience combining investigative and engineering skills for link analysis, root-cause analysis, and correlating internal telemetry with OSINT and third-party data.
Experience designing and deploying AI/LLM solutions, including prompt engineering, agent orchestration, and evaluation workflows, to optimize investigations and scale abuse detection.
Experience partnering with Software Engineering and Data Science teams to engineer detection signals and evaluate performance, including precision, recall, and trade-offs.
Experience leading enterprise-wide impact projects, authoring technical requirements (BRDs), and aligning cross-functional stakeholders.
Expertise in disrupting Trust and Safety threats, including information operations, fraud, and account abuse, using OSINT techniques.
Ability to communicate complex findings effectively to engineering, product, policy, and leadership audiences.

Responsibilities

Investigate sophisticated emerging actor networks and behaviors across Google’s ecosystem by correlating complex internal telemetry, open-source intelligence (OSINT), and third-party intelligence at scale.
Design and build end-to-end SQL and Python scripts and pipelines, LLM/agentic workflows, and evaluation frameworks to automate investigative tradecraft and support proactive threat discovery.
Collaborate with Engineering, Data Science, and Product teams to deploy network-scoped disruptions, implement high-precision signals, and evaluate and improve detection performance, including precision, recall, and false-positive rates.
Analyze large datasets to quantify abuse trends, author actionable intelligence reports, and communicate technical findings and mitigation proposals to engineering, product, policy, and leadership stakeholders.
Review graphic, controversial, or objectionable material, including child exploitation, graphic violence, self-injury, severe fraud/scams, and other disturbing content.
Lead complex investigations from discovery and root-cause analysis through network-scoped disruptions and cross-Product Area enforcement mitigations.
Contribute reusable investigative playbooks and mentor junior analysts.