Technical Cyber Threat Investigator

Written by the T&S Network from Anthropic's posting.

Detects, investigates and disrupts misuse of Anthropic's AI systems for malicious cyber operations, working at the intersection of AI safety and cybersecurity. The role sits on the Threat Intelligence team and covers influence operations, malware development and social engineering carried out through the company's models.

What you'd do

• Look into attempts to use Anthropic's models for cyber operations, including malware and social engineering.
• Develop abuse signals and tracking strategies to find sophisticated threat actors across the platform.
• Produce actionable reports on emerging attack methods, weaknesses and threat actor behavior aimed at LLMs.
• Run cross-platform threat analysis using open-source research, dark web monitoring and internal data.
• Turn investigation findings into systematic safety improvements that reduce harm at scale.
• Study internal and ecosystem trends on how AI could be misused, and publish reports.
• Maintain ties with outside threat intel partners, sharing groups and government contacts.

What it asks for

• Working proficiency in SQL and Python to analyze data and detect threats.
• Experience with large language models and how AI could be misused for cyber threats.
• Deep expertise in detecting abusive behavior like influence operations, coordinated inauthentic activity or cyber threat intel.
• Hands-on history following threat actors across surface, deep and dark web sources.
• Experience with threat actor profiling and frameworks such as MITRE ATT&CK.
• Proven project management and experience building processes from scratch.
• Excellent communication skills for cross-functional work and presenting to leadership.

Worth knowing

• May be exposed to explicit sexual, violent or psychologically disturbing content.
• May need to respond to escalations during weekends and holidays.

Terms in this role

Coordinated inauthentic behavior.

Networks of accounts working together to mislead people about who is behind them. Meta's term for influence operations, now widely used.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on Anthropicnorth_east before you apply. If we got something wrong, report this listing.