Trust Investigator - Scaled Investigations

LinkedIn•Omaha, NE

13d•Hybrid

About The Position

At LinkedIn, our approach to flexible work is centered on trust and optimized for culture, connection, clarity, and the evolving needs of our business. The work location of this role is hybrid, meaning it will be performed both from home and from a LinkedIn office on select days, as determined by the business needs of the team. This position will be hybrid in LinkedIn’s Omaha, NE office. We are seeking a Trust Investigator to join our Scaled Investigations Team. This role applies investigative tradecraft at scale to uncover coordinated, persistent, and high-impact abuse targeting LinkedIn members, and to drive the resulting enforcement and detection improvements. The work spans detection and mitigation of fake account networks, account takeover and credential abuse, payment and subscription fraud, and the scam infrastructure behind them. Investigations generally begin with a single lead and expand through pivot analysis across account, device, and behavioral signals. Investigators own this work from the initial lead through enforcement, and surface the detection gaps that allowed the abuse to reach members. Their findings identify the product and model gaps that inform engineering investment. Investigators on this team work with platform-scale data and have latitude to build their own tooling. We are looking for a self-starter who takes ownership over their work and enjoys being part of a fast-paced, collaborative, global team that values results.

Requirements

Bachelor's Degree in cyber security, criminal justice or other related technical disciplines, or equivalent technical experience
3+ years of experience investigating account, behavior, or content abuse, preferably within a trust and safety, social media, or online platform context
Experience independently writing SQL queries to access and analyze large-scale datasets in support of investigations
Experience using Python or another scripting language to automate investigative workflows.
Experience with open-source investigation techniques and familiarity with a variety of internet research tools
Experience synthesizing complex data sets into clear and actionable insights for diverse audiences

Nice To Haves

BS and 5+ years of relevant work experience, MS and 4+ years of relevant work experience, or PhD and 2+ years of relevant work experience.
5+ years of experience in threat investigations, preferably within a trust and safety, social media, or online platform context
A combination of investigative and technical skills, with the ability to define detection logic from case findings and work with Engineering, Product teams, and Data Science to implement detection rules
Demonstrated AI skill development, including prompt and context engineering, agent use, and quality and accuracy review of AI output, with a record of applying AI to improve investigative workflows
Experience conducting proactive threat and fraud hunting against large scale threats
Experience with enforcement at scale, including bulk action preparation and false positive validation
Technical acumen and the ability to translate data and investigative outcomes into actionable insights for Engineering, AI partners, and senior leadership
Excellent communication skills, with the ability to inspire and influence across all levels of the organization
Familiarity with frameworks such as MITRE ATT&CK and cyber kill chain, and the ability to adapt them to platform abuse

Responsibilities

Lead investigations into coordinated campaigns and abuse networks, expanding from an initial lead through pivot analysis across account, device, and behavioral signals.
Track persistent abuse patterns and the actors behind them, including how they adapt after enforcement.
Proactively hunt for undetected abuse and generate investigative leads using internal platform signals, open-source research, and threat intelligence.
Define and validate detection logic from case findings, partner with Engineering, Product teams, and Data Science on implementation, and evaluate detection performance after deployment.
Drive large-scale enforcement and takedown actions, including backtesting detection logic, validating targets before enforcement, and measuring false positives after action.
Triage and route front-line signals and alerts, and provide escalation support and investigative analysis on high-severity incidents.
Produce threat intelligence reports, briefings, and risk recommendations that identify product, policy, and model gaps exposed by investigations and inform strategic investment in our defenses.
Use AI-assisted workflows, agents, and notebooks to scale investigation and analysis, and evaluate the quality and accuracy of AI output.
Write SQL queries to access and analyze large-scale platform data, identify abuse patterns, test investigative hypotheses, and support enforcement and detection decisions.
Build tooling, playbooks, and documentation that scale investigative methodology across the team.