Technical Cyber Threat Investigator
Investigates and disrupts misuse of AI systems for cyber threats like malware and influence operations. Develops detection techniques and intelligence reports, requiring proficiency in SQL, Python, and threat intelligence frameworks.
About the job
Responsibilities
- Detect and investigate attempts to misuse Anthropic's AI systems for cyber operations, including influence operations, malware development, social engineering, and other adversarial activities
- Develop abuse signals and tracking strategies to proactively detect sophisticated threat actors across our platform
- Create actionable intelligence reports on new attack vectors, vulnerabilities, and threat actor TTPs targeting LLM systems
- Conduct cross-platform threat analysis grounded in real threat actor behavior, using open-source research, dark web monitoring, and internal data
- Utilize investigation findings to implement systematic improvements to our safety approach and mitigate harm at scale
- Study trends internally and in the broader ecosystem to anticipate how AI systems could be misused, generating and publishing reports
- Build and maintain relationships with external threat intelligence partners, information sharing communities, and government stakeholders
- Work cross-functionally to build out our threat intelligence program, establishing processes, tools, and best practices
You may be a good fit if you
- Have demonstrated proficiency in SQL and Python for data analysis and threat detection
- Have experience with large language models and understanding of how AI technology could be misused for cyber threats
- Have subject matter expertise in abusive user behavior detection, such as influence operations, coordinated inauthentic behavior, or cyber threat intelligence
- Have experience tracking threat actors across surface, deep, and dark web environments
- Can derive insights from large datasets to make key decisions and recommendations
- Have experience with threat actor profiling and utilizing threat intelligence frameworks (MITRE ATT&CK, etc.)
- Have strong project management skills and ability to build processes from the ground up
- Possess excellent communication skills to collaborate with cross-functional teams and present to leadership
Strong candidates may also have
- Experience working with government agencies or in regulated environments
- Background in AI safety, machine learning security, or technology abuse investigation
- Experience building and scaling threat detection systems or abuse monitoring programs
- Active Top Secret security clearance
Logistics
Annual Salary: $230,000 — $290,000 USD
Education requirements: We require at least a Bachelor's degree in a related field or equivalent experience.
Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Skills
SQL, Python, LLMs, Mitre Att&Ck, Threat Intelligence, Dark Web Monitoring, Data Analysis, Threat Actor Profiling, Abuse Detection, Cyber Threat Intelligence
Similar jobs
Security Engineering jobs
Fluidstack
New York, NYThe Security Engineer will track advanced adversaries targeting frontier AI infrastructure, build intelligence pipelines, conduct threat hunts, and create production detections. The role requires hands-on malware and infrastructure analysis, production programming, and close collaboration with detection and incident response teams.
Tailscale
United StatesThis role builds and improves infrastructure security controls across cloud, operating system, Kubernetes, network, and CI/CD environments. It requires cloud security expertise, programming and Infrastructure as Code proficiency, threat-modeling experience, and the ability to lead infrastructure containment during security incidents.
OpenAI
San Francisco, CAThe Red Team Specialist evaluates AI models for cyber capabilities, safeguard failures, and agentic-system abuse risks. The role combines hands-on security testing, automated evaluation infrastructure, risk assessment, and cross-functional communication.
Vercel
San Francisco, CABuild and operate trust and safety systems that detect and mitigate abuse at internet scale. The role combines security engineering, large-scale data analysis, and applied LLM techniques, requiring 5+ years of relevant experience and strong Python and JavaScript/TypeScript skills.
1Password
United StatesLeads and develops a security incident response team while driving automation, AI-assisted workflows, operational maturity, and response strategy. The role requires 5+ years of incident response experience, people leadership, technical depth, and calm management of high-severity incidents.