Cyber InvestigatorTaskUs partners with pioneering technology companies to build the safety, intelligence, and human-in-the-loop operations powering next-generation artificial intelligence.
In this role, you will join a frontline cyber investigations pod supporting one of the world's foremost frontier AI research and safety companies. Their Safeguards mission is clear: prevent state-of-the-art AI systems from being leveraged by malicious actors to cause harm. While automated detection systems catch abuse at scale, human investigators provide the crucial analytical ground truth.
As a
Cyber Investigator, you will conduct day-to-day triage and analysis of flagged telemetry. You will evaluate high-risk cyber prompts, differentiate legitimate defensive security research from malicious intent, apply structured labels that train automated safety classifiers, and package well-documented escalations for Senior and Principal investigators.
What you will do:- Queue Review & Triage: Investigate automated system flags across priority threat categories, including:
- Ransomware and malware authoring / obfuscation
- Local and remote exploit discovery and weaponization
- Large-scale data scraping and automated exfiltration
- Offensive operations, recon, and intrusion staging
- Dual-Use Evaluation: Determine whether observed activity represents benign security research (e.g., CTFs, academic exercises, vulnerability remediation) or actionable policy violations, clearly detailing your rationale.
- Ground-Truth Labeling: Apply precise, policy-aligned labels to adjudicated cases to directly test, benchmark, and improve automated machine learning safety filters.
- Adversary Mapping: Map observed user prompts and tool usage to specific MITRE ATT&CK tactics and techniques.
- OSINT & Context Enrichment: Conduct targeted open-source intelligence (OSINT) research on indicators, tooling, and infrastructure to provide operational context.
- Escalations & Handoffs: Prepare concise, evidence-backed case dossiers to escalate high-severity, ambiguous, or novel threats to Senior and Principal Investigators.
- Calibration & Feedback: Actively participate in pod calibration sessions, adopting quality feedback to maintain high labeling consistency across the pod.
What you bring:- 1-3 years of practical experience in SOC analysis (Tier 1/2), digital forensics, incident response (DFIR), threat intelligence, military cyber operations, or technical OSINT investigations.
- Understanding of Attack Lifecycles: Solid working knowledge of the MITRE ATT&CK matrix, basic network/system internals, and how common cyber intrusions and exploit chains progress.
- Analytical Documentation: Proven ability to synthesize complex case details into concise, objective written English summaries under operational timelines.
- Investigative Mindset: Natural curiosity, attention to detail, and sound judgment when evaluating noisy, incomplete, or borderline information.
- Location & Authorization: Based in the United States with unrestricted work authorization (Texas residency preferred).
Nice to have:- Prior background in military service, government intelligence, or federal/local cyber law enforcement.
- Practical exposure to scripting languages (SQL, Python, or Bash) for basic log parsing and telemetry review.
- Foundational cybersecurity certifications (e.g., CompTIA Security+, CySA+, GSEC, GCIH, or CEH).
- An active or previously held U.S. Government Security Clearance (Secret or higher).
- Familiarity with large language models, prompt engineering, or AI red-teaming concepts.
Good to know:- Material Exposure: Daily responsibilities involve reviewing flagged prompts, exploit instructions, offensive scripts, and potentially malicious payloads.
- Schedule & Rotation: The role may require rotational shift or weekend/holiday coverage to maintain rapid escalation turnarounds for critical threat events.
- Security Screening: Selected candidates may be subject to client-directed insider threat screening and specialized background checks prior to and during engagement.
Location: US (Texas preferred)
Work Setup: Remote
Type: Full time
Salary Range: $80,000 - $105,000
How We Partner To Protect You: TaskUs will neither solicit money from you during your application process nor require any form of payment in order to proceed with your application. Kindly ensure that you are always in communication with only authorized recruiters of TaskUs.
