The RoleAs Promise grows, so does the attention on the company and its leaders. Some of it is hostile: fabricated documents, edited Wikipedia pages, fake reviews, planted stories, impersonation. AI has made all of it cheap. We9re building the function that finds it fast, works out who is behind it, and shuts it down through legitimate process.
You9ll be the first person in that function. You9ll have authority over the outside firms we retain (Wikipedia consultants, litigation counsel, investigators) and a direct line to the CEO. You own every surface where Promise and its leaders get judged, from a Wikipedia revision to a procurement officer9s search results.
You9re patient, thorough, and you enjoy the hunt. You use AI fluently, both to work at the attacker9s speed and to spot their output. You can explain Wikipedia9s living-persons policy, a sockpuppet investigation, and a John Doe subpoena without looking anything up. You know where the line is and say so before anyone asks.
What would make you not a fit: search or reputation-management backgrounds, penetration testers without investigative experience, and anyone who needs classified tooling to function.
What You9ll Do- Build the tripwires. Monitor Wikipedia and Wikidata, search results, review and complaint sites, domain registrations, social platforms, paste sites, and public records, covering the company, its executives, and key clients. We want to hear about a problem in an hour, not three weeks.
- Attribute. Use account-graph analysis, stylometry, metadata, and timing to produce a named hypothesis, a stated confidence level, and evidence that holds up for counsel.
- Enforce. Work platform process from the inside: biography-of-living-persons noticeboards, sockpuppet investigations, repository and registrar takedowns, search removals. Know the trust and safety teams at the major platforms.
- Support counsel. Build preservation lists, subpoena-ready evidence packages, public records requests, and referrals to Attorneys General and Inspectors General. Investigations run at counsel9s direction, under privilege.
- Respond. When attribution is solid, work with counsel on the right consequence: platform bans, regulator referrals, formal complaints.
- Protect executives. Handle doxxing, impersonation, phishing domains, and physical-security signals.
- Write. Most of this work is won in writing, on noticeboards, in referrals, in evidence memos. Plain, short, exact.
What You Won9t DoOur customers are state governments, so every action has to survive a procurement-integrity review and a deposition. That means no unauthorized access, no hacking back, no undisclosed or retaliatory accounts, no planted content, and no exposing a person without attribution we can defend in court. If you need those tools to win, this isn9t the role. The best people in this field never need them.
What You BringYou9ve done this somewhere hard. Most likely:
- A trust and safety investigator at a major platform (threat disruption, influence operations, or Wikimedia Trust and Safety)
- A disinformation researcher who has attributed coordinated account networks, at Graphika, DFRLab, the Stanford Internet Observatory, or similar
- A threat intelligence analyst at Nisos, Recorded Future, Mandiant, or Kroll who wants to own an outcome instead of billing hours
- An OSINT investigative journalist with a digital forensics record
If you are energized by this problem space and want to get creative about this work, please get in touch (even if you don9t meet every single requirement).
Promise engages in US government contracts and restricts hiring to US persons, which includes US citizens and permanent residents (e.g., Green Card holders). Additionally, candidates must reside in the US.
Promise participates in E-Verify. To learn more, view E-Verify Participation Notice and Right to Work Notice.
