Staff Technical Threat Investigator, Trust and Safety Intel Investigations

Minimum qualifications:

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Intelligence Studies, a related technical field, or equivalent practical experience.
• 7 years of experience in data analysis, cybersecurity, or technical threat investigations, including identifying trends, generating summary statistics, and drawing insights from quantitative and qualitative datasets.
• 7 years of experience utilizing SQL, Python, or similar scripting/programming languages to query datasets, build data pipelines, and solve engineering and abuse-detection problems
• 7 years of experience managing projects, including defining multi-quarter project scope, goals, and deliverables in a globally distributed environment.

Preferred qualifications:

• Experiencing designing, deploying, and evaluating production-grade AI/LLM solutions to optimize investigative workflows and scale abuse detection and enforcement.
• Experience partnering with Software Engineering and Data Science teams to design security/abuse controls, engineer signals and features, and evaluate detection performance.
• Experience elevating team-wide standards by codifying repeatable threat-modeling playbooks, conducting peer code/design reviews, and mentoring junior-to-senior analysts.
• Deep expertise in tracking and disrupting sophisticated trust and safety threats, criminal syndicates, scaled fraud/scams, account-based abuse, violent extremism, etc.
• Has led multi-organization, cross-Product Area initiatives, authoring technical requirements, influencing engineering roadmaps, and aligning stakeholders across competing priorities.

About the job:

In this role, your mission is to identify the highest-severity and emerging, on-platform T&S abuse and conduct technical investigative analysis to drive cross-Product Area (xPA) detection, mitigation and remediation measures.

As a part of the team of technical investigators, you will work to proactively hunt out the biggest and baddest threat actors in the Trust and Safety space, deeply understand how they achieve their objectives on Googles family of products and services. You will then work with partner teams to stop the threat actors from being effective by deploying both network-scoped disruptions and scaled detection and enforcement mitigations.

As a Staff Engineering Analyst Investigator, you will serve as a technical lead and domain authority for the team, setting multi-quarter technical direction to uncover systemic threat actor ecosystems and architecting scalable, AI-first investigative and enforcement solutions across Google. You will look beyond individual cases to identify systemic, multi-product area adversarial ecosystems, leading open-ended investigations and multi-quarter disruption programs from initial discovery through executive alignment and cross-Product Area (xPA) operationalization. You will bridge experimental threat research and production-scale defense by designing modular, maintainable automation, data pipelines, and agentic AI architectures in partnership with Software Engineering (SWE) and Data Engineering teams. You will act as a technical multiplier who elevates team-wide investigative tradecraft, codifying methodologies into self-service playbooks, reviewing peers' code and technical designs, and mentoring analysts.

Individual pay is determined by factors including job-related skills, experience, and relevant education or training.

US: $188000 - $274000 (USD) + 20% bonus target + equity + benefits

Learn more about benefits at Google.

Responsibilities:

• Identify and lead investigations into sophisticated emerging actor networks and behaviors across Google’s ecosystem by correlating complex internal telemetry, open-source intelligence (OSINT), and third-party intelligence at scale.
• Define the technical strategy and design for technology-enabled automation, building modular, production-grade SQL and Python pipelines, Large Language Model (LLM)/agentic workflows, and evaluation frameworks to support proactive threat discovery .
• Partner with Engineering, Data Science, and Product leads across Product Areas to uplevel abuse-fighting infrastructure, implement high-precision signals, and optimize detection systems’ performance.
• Author business requirements and technical designs, negotiate shared roadmaps and resource commitments across partners, and align competing priorities into cohesive defense strategies .
• Review exposure to graphic, controversial, or objectionable material (including child exploitation, graphic violence, self-injury, severe fraud/scams, and other disturbing content).