Senior Cyber Investigator

Task Us is a provider of outsourced digital services and next-generation customer experience to fast-growing technology companies, helping its clients represent, protect and grow their brands. Leveraging a cloud-based infrastructure, Task Us serves clients in the fastest-growing sectors, including social media, e-commerce, gaming, streaming media, food delivery, ride-sharing, HiTech, Fin Tech, and Health Tech.

Task Us partners with pioneering technology companies to build the safety, intelligence, and human-in-the-loop operations powering next-generation artificial intelligence.

In this role, you will join a specialized cyber investigations pod supporting one of the world's foremost frontier AI research and safety companies. Their Safeguards mission is clear: prevent state-of-the-art AI systems from being leveraged by malicious actors to cause harm. While automated detection systems catch abuse at scale, seasoned human investigators provide the crucial analytical ground truth.

As a Senior Cyber Investigator, you will take ownership of complex, high-consequence misuse escalations and threat actor profiling. You will evaluate sophisticated cyber abuse, distinguish malicious intent from benign dual-use security research, mentor Junior Investigators, and deliver high-fidelity labels that train automated safety classifiers.

• Tackle High-Severity Escalations:
  Investigate complex abuse cases and appeals escalated by automated detection systems and Junior Investigators across priority threat areas:
  • Ransomware and malware authoring / obfuscation
  • Local and remote exploit discovery and weaponization
  • Large-scale data scraping and automated exfiltration
  • Offensive operations, recon, and intrusion staging
• Threat Actor & Campaign Analysis:
  Pivot across accounts, telemetry, and external threat intelligence to uncover coordinated adversarial campaigns and profile actor tradecraft (TTPs).
• Evaluate Dual-Use Scenarios:
  Make sound, defensible determinations separating legitimate defensive security tasks (e.g., authorized auditing, academic research) from active malicious intent.
• Review & Mentor:
  Review Junior Investigators' casework, provide actionable feedback, and lead calibration sessions to maintain rigorous labeling standards across the pod.
• Data-Driven Threat Hunting:
  Use SQL, Python, or investigative tooling to analyze usage telemetry, identify anomalous behavior, and surface emerging abuse trends across large datasets.
• Reporting & Escalations:
  Author concise intelligence briefs and enforcement recommendations for the Principal Investigator and client safety leads; elevate critical threats and zero-day discoveries promptly.

• 5+ years of hands-on experience in cyber threat intelligence (CTI), incident response (DFIR), digital investigations, offensive security, or technical OSINT.
• Adversary Tradecraft:
  Strong applied knowledge of the MITRE ATT&CK matrix, modern malware/ransomware delivery chains, and common exploitation techniques.
• Investigative Telemetry & Tooling:
  Working proficiency in SQL and Python (or similar scripting) to query logs, parse structured data, and identify anomalous actor behavior.
• Defensible Decision-Making:
  Proven track record of evaluating ambiguous, incomplete evidence, making high-confidence determinations, and articulating technical findings clearly in written case logs.
• Quality & Mentorship:
  Experience conducting peer reviews, QA, or mentoring junior analysts in a SOC, CIRT, or trust and safety environment.
• Location & Authorization:
  Based in the United States with unrestricted work authorization (Texas residency preferred).

• Prior background in military intelligence, law enforcement cyber units, or government national security operations.
• Direct experience analyzing AI misuse, LLM prompt exploitation/jailbreaks, or automated abuse vectors.
• Technical certifications such as GCFA, GCTI, GREM, OSCP, or CySA+.
• An active or recent U.S. Government Security Clearance (valued, not required).
• Experience tracking threat actors across dark web and closed criminal forums.

• Material Exposure:
  Daily responsibilities involve reviewing flagged prompts, exploit instructions, offensive scripts, and potentially malicious payloads.
• On-Call & Escalations:
  Role may involve rotational escalation coverage, including occasional weekend or holiday support for critical incidents.
• Security Screening:
  Selected candidates may be subject to client-directed…