Threat Investigator

Cypress HCM; San Francisco (CA); On-site; USD 90,000 - 150,000; Full time

Job summary

Cypress HCM seeks a threat investigator to support the Investigations Team by detecting and responding to malicious activity, and drafting reports based on findings.

You will use SQL and Python to query and transform data, respond to escalations, and work in a fast-paced, high-impact environment. The role involves on-call duties and exposure to distressing content.

Qualifications

• U.S.-based with ability to work West Coast hours (9am–5pm PT).
• 3+ years of experience in related threat investigation topics.
• Proficient in SQL and Python for querying and data analysis.
• Willingness to be on-call to resolve urgent escalations outside normal hours.

Responsibilities

• Proactively detect and reacquire bad actors on our platform.
• Investigate policy-violating activity using SQL/Python and cross-reference open source information.
• Document and share investigative findings with internal stakeholders.

Skills

SQL

Python

Threat investigation

On-call readiness

Job description

As a threat investigator, you will be supporting our Investigations Team and responsible for detecting and/or responding to malicious uses and abuse, investigating the activity, drafting reports based on your findings, and making recommendations.

This will require experience investigating threat actors, harmful behaviors, and/or other activities; as well as a strong ability to use SQL and Python to query, transform, and understand data. You will also respond to escalations and reactive leads, including those that are not caught by our existing safety systems.

This role involves exposure to sensitive and distressing content, including child abuse, violent, or otherwise-disturbing material.

This role includes serving in an on-call capacity that will involve resolving urgent escalations outside of normal work hours, occasionally including evenings and weekends.

In This Role, You Will

• Proactively detect and reacquire bad actors on our platform
• Investigate potentially policy-violating activity by querying internal data sources (using SQL and Python) and cross-referencing open source information
• Document and share investigative findings with internal stakeholders

Requirements

• U.S.-based, with the ability to work West Coast hours (9am - 5pm PT)
• Ability to be on-call that will involve resolving urgent escalations outside of normal work hours, including occasional evenings and weekends
• Familiarity with technical investigations, and detection pipelines, especially using SQL and Python
• Have at least 3+ years of experience working on related topics
• Ability to rapidly context switch across domains, modalities, and abuse areas, to include violent activities and child safety
• Excited to work in a fast paced, ambiguous, and purposeful space with high impact across users and beyond

Desired Qualities (but Not Required)

• Full professional proficiency in Arabic, Chinese, Farsi, Portuguese, Russian, or Spanish
• Have experience scaling and automating processes, especially with language models
• Familiarity using language models to scale
• Familiarity with one of the following topics/areas: AI safety, child safety, digital mental health, fraud abuse, radicalization/persuasion/grooming; hateful activities and groups