Threat Intelligence Analyst, Threat Disruption

About the Role

Threat Disruption provides expert threat intelligence and conducts scaled operations against adversaries attacking X. Investigations and disruptions focus on:

• Platform manipulation, including coordinated networks of bots attempting to pollute the information space
• Compromises of accounts owned by high-visibility individuals and organizations
• Sensitive allegations carrying reputational, legal, or geopolitical weight, including suspected foreign-linked influence campaigns
• Financial fraud, monetization abuse, and scam networks operating on and off X
• Other X Rules violations, including illegal activity and child safety

Key Responsibilities

• Identify and counter sophisticated threat actors who are highly motivated to evade detection
• Conduct first-principles investigations into the threat surfaces outlined above
• Design and execute large-scale enforcement operations that remove hundreds of thousands to millions of adversary-controlled accounts
• Clearly and concisely communicate investigative findings and enforcement outcomes
• Partner closely with operations, engineering, product, and policy teams across the organization
• Rapidly and rigorously handle urgent incidents escalated by leadership

Requirements & Tech Stack

• Self-starter mindset with a proven ability to take initiative and drive work forward independently
• Deep commitment to analytical rigor and operational excellence
• Exceptional attention to detail
• Excellent written and verbal communication skills
• Demonstrated ability to learn quickly and adapt in a fast-paced environment
• Maturity and discretion when handling sensitive information, with the ability to remain calm and effective during urgent incidents
• Strong proficiency in SQL for querying large, complex datasets
• Comfort operating in the command line, writing scripts, and leveraging AI tools to amplify impact and scale work
• Flexibility to work across time zones, including weekends and holidays, as part of an on-call rotation
• Strong respect for users’ freedom of speech and privacy

Qualifications

• Experience investigating platform manipulation, account compromise, influence operations, or fraud
• Experience turning investigations into production changes and enforcement outcomes
• Experience in a 24/7 on-call rotation, including owning urgent incidents and briefing leadership