Staff Technical Threat Investigator, Trust and Safety Intel Investigations
Washington D.C., DC, USA · Staff · Full-time · Posted Oct 20, 2026
- Experience
- 7 years for each of the three experience areas stated in the minimum qualifications.
- Education
- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Intelligence Studies, a related technical field, or equivalent practical experience.
About the job
Leads technical investigations into emerging Trust and Safety threats across Google products, then develops scalable detection, disruption, and enforcement strategies.
What you'll do
- Investigate threat actors by correlating internal telemetry, open-source intelligence, and third-party intelligence.
- Design production-grade automation, data pipelines, LLM/agentic workflows, and evaluation frameworks for threat discovery.
- Coordinate cross-Product Area defenses, set technical direction, and improve investigative practices through reviews, playbooks, and mentoring.
What they ask for
- Bachelor's degree in a related technical field or equivalent practical experience.
- 7 years of experience in data analysis, cybersecurity, or technical threat investigations.
- 7 years of experience using SQL, Python, or similar languages for querying datasets, building data pipelines, and solving engineering or abuse-detection problems.
- 7 years of experience managing projects, including defining multi-quarter scope, goals, and deliverables in a globally distributed environment.
Nice to have
- Experience designing, deploying, and evaluating production-grade AI/LLM solutions for investigations or abuse detection.
- Experience with security/abuse controls, detection performance, threat-modeling playbooks, code/design reviews, mentoring, or cross-Product Area initiatives.
Pay
$188000 - $274000 USD (base salary)
Tools
SQL, Python, Large Language Model (LLM)
AI focus
Build and evaluate LLM/agentic workflows and AI-first investigative and enforcement solutions to scale threat discovery, abuse detection, and enforcement.
Model-written summary · the original posting is authoritative