Fraud Investigator

Aiwf Technologies; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Talview runs a permanent Test Security Research Programme within Managed Services to identify examination malpractice through internal session data and research into external services offering exam leaks, exam assistance, and proxy test-taking.

As the programme's dedicated investigator, you will analyse session telemetry to identify suspicious patterns, conduct structured external threat research, and test qualified services against Talview-controlled assessments under approved rules of

Qualifications

• 3–5 years of experience in fraud investigation, trust and safety, platform integrity, or anti-cheat, with demonstrated ability to take a case from an initial signal to a written finding that withstands challenge.
• Hands-on experience with product analytics tools such as Mixpanel or Amplitude and telemetry or error-monitoring tools such as Sentry or Datadog to reconstruct user activity within a session.
• Strong query-writing skills using columnar databases or event stores such as ClickHouse, BigQuery, Snowflake, or Athena, including independently writing clustering queries.
• Experience using pandas or equivalent tools to turn one-off investigations into repeatable analyses and recurring detection rules.
• Experience sourcing and engaging actors on marketplaces, Telegram, and Discord, with disciplined use of research personas and evidence preservation.
• Familiarity with NAT, CGNAT, device fingerprinting, virtual machines, virtual cameras, remote-access tools, and secure-browser restrictions. Ability to read and interpret logs independently.
• Ability to prepare clear customer-facing reports and detailed internal evidence packs.

Responsibilities

• Internal Telemetry Analysis: Run recurring session-to-IP extracts, maintain baselines, and identify reviewable cases from clusters.
• External Threat Research: Conduct ongoing searches across engines, social platforms, and forums; qualify leads and maintain a lead register.
• Evidence, Escalation, and Reporting: Assemble evidence packs, apply confidence framework, and brief Customer Success Managers within SLAs.
• Publish threat briefs for each investigation and route countermeasure requirements to Product Engineering.

Skills

Investigation

Event data analysis

SQL

Python

OSINT

Technical understanding

Written communication

Tools

Mixpanel

Amplitude

Sentry

Datadog

ClickHouse

BigQuery

Snowflake

Athena

Job description

Fraud Investigator, Test Security

Talview | Managed Services | Test Security Research Programme

Location: Bangalore
Employment Type: Full-time
Experience: 35 years
Reports to: Programme Owner, Managed Services
Works with: Data Science, Product Engineering, Customer Success, Legal, and Proctoring Operations

About the Role

Talview runs a permanent Test Security Research Programme within Managed Services to identify examination malpractice through internal session data and research into external services offering exam leaks, exam assistance, and proxy test-taking.

As the programmes dedicated investigator, you will analyse session telemetry to identify suspicious patterns, conduct structured external threat research, and test qualified services against Talview-controlled assessments under approved rules of engagement.

Each investigation must result in an actionable product improvement request or an evidence-backed customer case, recorded in the Test Security Dashboard. Findings must be corroborated, auditable, and able to withstand scrutiny months after the investigation.

Key Responsibilities

Internal Telemetry Analysis

• Run recurring session-to-IP extracts and maintain baselines and exclusion lists for legitimate shared networks, including corporate NAT, universities, test centres, and CGNAT.
• Cluster sessions using IP addresses and environment fingerprints, identify distinct candidate identities within each cluster, and develop qualifying clusters into reviewable cases.
• Assess shared-IP clusters with different environments using temporal proximity, same-assessment overlap, and completion-time similarity. Advance only those that meet the agreed investigation threshold.
• Audit proctor-flag review decisions against session recordings, logs, and the agreed malpractice taxonomy.
• Analyse false positives and missed incidents by proctor, customer, and flag type, and use findings to improve proctor training.
• Raise structured investigation requests to Data Science for advanced forensic analysis, including event-stream signatures, log reconstruction, and biometric clustering, and incorporate the findings into each case.

External Threat Research

• Maintain an ongoing search programme across search engines, social and video platforms, freelancing marketplaces, forums, Telegram, and Discord, including regional-language channels.
• Maintain a version-controlled keyword set covering exam leaks, exam assistance, remote desktop support, proxy test-taking, and named customer assessments.
• Qualify leads and maintain a lead register.
• Begin with passive research, preserving each service’s pricing, claimed methods, guarantees, delivery mechanisms, and geographic coverage verbatim, with timestamps.
• Engage qualified agencies only under approved rules of engagement, using approved research personas, channels, and payment instruments.
• Plan and execute controlled tests against Talview-controlled assessments, securing Legal and Finance approvals and capturing detailed session telemetry.
• Document the methods observed and produce a detection-gap analysis as the primary deliverable.
• Publish a threat brief for each investigation and route countermeasure requirements to Product Engineering, with priority based on the assessed scope and impact of the threat.

Evidence, Escalation, and Reporting

• Assemble evidence packs that include triggered signals, corroboration from independent signal types, proctor observations, Data Science findings, and alternative explanations considered and ruled out.
• Apply the programme’s confidence framework and draft recommended actions for Programme Owner review.
• Brief Customer Success Managers within agreed SLAs and record the customer’s decision when closing each case.
• Maintain the Test Security Dashboard, ensuring every case has an owner, status, and next action, and that aggregate metrics can be traced to source sessions.
• Prepare weekly summaries and monthly customer test security reports.
• Contribute to monthly trend reports and quarterly leadership briefs.

Required Skills and Experience

Essential

• Investigation: 3–5 years of experience in fraud investigation, trust and safety, platform integrity, or anti-cheat, with demonstrated ability to take a case from an initial signal to a written finding that withstands challenge.
• Event data analysis: Hands-on experience with product analytics tools such as Mixpanel or Amplitude and telemetry or error-monitoring tools such as Sentry or Datadog to reconstruct user activity within a session.
• SQL: Strong query-writing skills using columnar databases or event stores such as ClickHouse, BigQuery, Snowflake, or Athena, including independently writing clustering queries.
• Python: Experience using pandas or equivalent tools to turn one-off investigations into repeatable analyses and recurring detection rules.
• OSINT: Experience sourcing and engaging actors on marketplaces, Telegram, and Discord, with disciplined use of research personas and evidence preservation.
• Technical understanding: Familiarity with NAT, CGNAT, device fingerprinting, virtual machines, virtual cameras, remote-access tools, and secure-browser restrictions. Ability to read and interpret logs independently.
• Written communication: Ability to prepare clear customer-facing reports and detailed internal evidence packs.

Desirable

• Experience in online proctoring, assessment delivery, or high-stakes examination integrity.
• Advanced Excel or Google Sheets skills.
• Dashboarding and data modelling experience using Power BI, Tableau, Looker Studio, or Metabase.
• Familiarity with GDPR, the DPDP Act, and constraints on handling biometric data.
• Experience working under documented rules of engagement in threat research, intelligence, or red-team environments.
• Exposure to fraud rings or marketplace abuse.
• Proficiency in a second language relevant to customer candidate populations.
• Certified Fraud Examiner (CFE) or equivalent certification.