Technical Threat Investigator, Threat Intel Engineering

Details

Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity.

The Threat Intelligence team protects OpenAI’s technology, people, research, and infrastructure by proactively identifying and disrupting adversaries who seek to compromise systems or misuse models. The team investigates sophisticated threats, builds tooling to scale and augment analysis, and delivers intelligence that shapes security strategy and equips leadership with timely, risk-aware insights.

As a Technical Threat Investigator, you will help protect OpenAI from sophisticated adversaries targeting the company and broader ecosystem, including those attempting to misuse OpenAI models in support of cyber operations. You will conduct complex, end-to-end investigations, analyze adversary behavior and infrastructure, identify malicious activity, and drive detection, disruption, enforcement, and safety improvements.

You will also build lightweight tooling, automate investigative processes, and create AI-assisted workflows that make investigations faster, more repeatable, and more effective.

Responsibilities

• Conduct deep, end-to-end investigations into sophisticated threat actors interacting with OpenAI’s models, products, and broader ecosystem.
• Model attacker behavior, anticipate misuse patterns, and proactively hunt for, identify, and disrupt malicious activity.
• Leverage internal telemetry, OSINT, vendor data, and in-house safety systems to produce high-confidence findings on adversarial use of models in cyber operations, platform abuse, and threats targeting OpenAI.
• Translate investigative findings into improvements across detection, enforcement, intelligence, and safety pipelines.
• Build tooling, scripts, automations, and agentic workflows to scale investigative throughput and reduce manual effort.
• Prototype solutions in ambiguous and emerging problem spaces, including new product surfaces, novel attacker behaviors, and areas with limited existing coverage.
• Partner with teams across Security, Safety Systems, Product Policy, and Integrity to operationalize findings and drive meaningful outcomes.
• Produce clear, high-signal written outputs and recommendations for technical and executive stakeholders.

Requirements

• Experience in threat intelligence, incident response, offensive security, or a closely related field.
• Experience investigating sophisticated threat actors, including model misuse, platform abuse, or other adversarial activity in complex environments.
• Strong understanding of adversary behavior, infrastructure, and tradecraft, with the ability to apply that knowledge to proactive investigations.
• Ability to independently drive deep technical investigations from ambiguous signals to clear, actionable findings.
• Experience using AI to extend or accelerate investigative workflows.
• Strong scripting skills and experience building lightweight automation, investigative tooling, or scalable workflows.
• Ability to leverage telemetry from diverse systems and vendors, including querying, extracting, and stitching together data as needed.
• Strong written and verbal communication skills, particularly the ability to translate technical investigations into high-signal outputs for diverse stakeholders.
• Comfort working independently in ambiguous, fast-moving environments with minimal oversight.

Work Arrangement

This is a remote role requiring close collaboration across teams in the United States and the United Kingdom. Regular in-person engagement with OpenAI’s San Francisco headquarters is expected. Relocation assistance is available for candidates who wish to relocate to San Francisco.

Benefits

• Medical, dental, and vision insurance with employer contributions to Health Savings Accounts.
• Pre-tax accounts for health and dependent care expenses, as well as commuter expenses.
• 401(k) retirement plan with employer match.
• Paid parental, medical, and caregiver leave.
• Paid time off, paid company holidays, office closures, and sick or safe time as required by applicable law.
• Mental health and wellness support.
• Employer-paid basic life and disability coverage.
• Annual learning and development stipend.
• Daily meals in offices and eligible meal delivery credits.
• Relocation support for eligible employees.
• Equity and performance-related bonuses for eligible employees.