Staff Technical Threat Investigator, Trust and Safety Intel Investigations

Google•Washington, DC

3d•$188,000 - $274,000

About The Position

In this role, the mission is to identify the highest-severity and emerging on-platform Trust and Safety abuse and conduct technical investigative analysis to drive cross-Product Area detection, mitigation, and remediation. The investigator proactively hunts major threat actors, develops a deep understanding of how they operate across Google products and services, and works with partner teams to disrupt them through network-scoped actions and scaled detection and enforcement mitigations. As a technical lead and domain authority, this role sets multi-quarter technical direction to uncover systemic threat actor ecosystems and designs scalable, AI-first investigative and enforcement solutions across Google. The investigator leads open-ended investigations and multi-quarter disruption programs from discovery through executive alignment and cross-Product Area operationalization, looking beyond individual cases to identify multi-product-area adversarial ecosystems. The role bridges experimental threat research and production-scale defense by designing modular automation, data pipelines, and agentic AI architectures in partnership with Software Engineering and Data Engineering teams. It also elevates investigative practices through self-service playbooks, code and technical design reviews, and analyst mentoring.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Intelligence Studies, a related technical field, or equivalent practical experience.
7 years of experience in data analysis, cybersecurity, or technical threat investigations, including identifying trends, generating summary statistics, and drawing insights from quantitative and qualitative datasets.
7 years of experience using SQL, Python, or similar scripting/programming languages to query datasets, build data pipelines, and solve engineering and abuse-detection problems.
7 years of experience managing projects, including defining multi-quarter project scope, goals, and deliverables in a globally distributed environment.

Nice To Haves

Experience designing, deploying, and evaluating production-grade AI/LLM solutions to optimize investigative workflows and scale abuse detection and enforcement.
Experience partnering with Software Engineering and Data Science teams to design security/abuse controls, engineer signals and features, and evaluate detection performance.
Experience raising team-wide standards by codifying repeatable threat-modeling playbooks, conducting peer code/design reviews, and mentoring analysts.
Deep expertise tracking and disrupting sophisticated Trust and Safety threats, criminal syndicates, scaled fraud/scams, account-based abuse, violent extremism, or similar threats.
Experience leading multi-organization, cross-Product Area initiatives, authoring technical requirements, influencing engineering roadmaps, and aligning stakeholders across competing priorities.

Responsibilities

Identify and lead investigations into sophisticated emerging actor networks and behaviors across Google’s ecosystem by correlating complex internal telemetry, open-source intelligence (OSINT), and third-party intelligence at scale.
Define the technical strategy and design for technology-enabled automation, building modular, production-grade SQL and Python pipelines, LLM/agentic workflows, and evaluation frameworks to support proactive threat discovery.
Partner with Engineering, Data Science, and Product leads across Product Areas to improve abuse-fighting infrastructure, implement high-precision signals, and optimize detection-system performance.
Author business requirements and technical designs, negotiate shared roadmaps and resource commitments across partners, and align competing priorities into cohesive defense strategies.
Review exposure to graphic, controversial, or objectionable material, including child exploitation, graphic violence, self-injury, severe fraud/scams, and other disturbing content.