Threat Intel Manager, Model Exploitation & Fraud

Key Responsibilities

• Own strategy, priorities, and outcomes for the Model Exploitation & Fraud mission area; define what we detect, investigate, action, and share.
• Hire, manage, and develop a team of technical threat investigators; set the quality bar for casework and intelligence reporting.
• Design clear lanes between this role and the team's senior individual contributors: strategy, people leadership, and program ownership sit with you, while ownership of the deepest technical investigations and tradecraft stays with the senior experts closest to the work.
• Capable of independently leading complex investigations.
• Direct, prioritize, and resource complex investigations into model distillation, unauthorized AI R&D usage, unauthorized access, coordinated account abuse, and fraud/scam networks, partnering with the senior investigators who lead the deepest technical casework and clearing blockers from their path.
• Drive the redesign of triage for a very high-volume detection pipeline: partner with investigators and engineering to build abuse signals, clustering, and agentic investigation workflows that separate sophisticated actors from noise.
• Expand the team's coverage into fraud and scams, building the detection and investigation playbooks from the ground up.
• Own the external engagement program for the area, including regular intelligence sharing with U.S. government partners and industry peers, ensuring the investigators driving the work are visible in those channels.
• Anticipate how resellers, proxies, and third-party platforms change the abuse surface, and shape coverage accordingly.
• Work with policy, enforcement, and engineering to convert findings into bans, product mitigations, and safety-by-design improvements.
• Define and report the team's metrics; brief Safeguards and company leadership on the threat landscape.

Minimum Qualifications

• Have led and managed investigative, fraud, platform integrity, or threat intelligence teams, ideally ones built around senior, deeply specialized individual contributors.
• Have strong domain fluency in scaled abuse — fraud patterns, account abuse, unauthorized access, or platform exploitation economics — sufficient to set priorities, pressure-test findings, and earn the confidence of expert investigators.
• Are proficient enough in SQL and Python to review data-heavy casework, pressure-test conclusions, and provide surge capacity when the team needs it.
• Have experience overseeing investigations that track threat actors across surface, deep, and dark web environments, including reseller and access-broker communities.
• Have working familiarity with large language models and a strong grasp of how models can be distilled, extracted, or exploited at scale.
• Have built processes, detection systems, or programs from scratch and can show what changed because of them.
• Communicate crisply with executives, engineers, and external partners alike.

Preferred Qualifications

• Experience at a major technology platform on trust and safety, fraud, or abuse investigations at scale.
• Background in financial crime investigation or fraud analytics.
• Experience working directly with U.S. government stakeholders on threat reporting.
• A track record of partnering with, growing, and retaining senior technical specialists, including defining clear scope between management and senior IC tracks.
• Fluency in Mandarin Chinese and/or Russian with nuanced regional and geopolitical context.
• Active Top Secret security clearance.

Education and Experience

• Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience.
• Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience.
• Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position.