Technical cyber threat investigator

A technical cyber threat investigator, or investigator of AI-related cyber threats, is an intelligence specialist who studies actors misusing AI models to conduct malicious cyber operations. They connect evidence, track campaigns and produce analysis that security teams can act on. Their core output is evidence-based intelligence on actors and their operations.

This specialism is documented at Anthropic and OpenAI. It draws on the foundations of cyber threat intelligence, or CTI: collecting, analysing and communicating intelligence to those able to use it. The title therefore goes beyond describing an analyst who uses AI to speed up their monitoring. Here, the misuse of AI systems is the subject of the investigation.

Investigations combine information accessible within the organisation with open-source research. The investigator seeks to understand adversary behaviours, the infrastructure used and links between activities. They present their conclusions and limitations, then contribute to recommendations for detecting and disrupting campaigns. Conducting an investigation does not, in itself, give them enforcement authority.

To define the role, clarify its reporting line, the security teams it will work with and the decisions its reports are expected to inform. Also define the data the investigator will be able to access and who is authorised to decide on action. These choices depend on the organisation.

AI-related cyber investigator, SOC analyst and penetration tester: who does what?

• The investigator tracks actors and campaigns to produce operational intelligence.
• The SOC analyst focuses on assessing security alerts, outside the remit described here.
• The penetration tester conducts offensive security assessments, which are distinct from this intelligence investigation role.

The boundary with enforcing usage policies also needs clarification: this profile covers actor tracking and intelligence reporting, rather than all forms of abuse on a platform. It excludes research into the cyber capabilities of models and the development of agentic cybersecurity services.

The first priority is to make an investigation useful to a security decision. Collecting evidence is not enough: recipients need to understand what connects the activities observed, what remains hypothetical and what action the analysis could support. The role must therefore combine a technical understanding of operations with clear communication of findings.

The subject also requires a distinction between the use of an AI model and its actual role in a campaign. Microsoft documents uses related to phishing, malicious code and operational support, among others. These observations concern campaigns tracked by Microsoft. They do not measure the overall prevalence of attacks using AI.

For the recruiter, the risk is confusing familiarity with models with the ability to investigate cyber operations. A candidate may know about large language models without being able to connect infrastructure to a series of activities. Conversely, cyber intelligence experience deserves examination to identify what knowledge of AI use still needs to be developed. Focus on the responsibilities the person will actually take on, rather than familiarity with a job title alone.

The strength of conclusions matters as much as their technical precision. The CERT-EU framework distinguishes source reliability from information credibility. It also relates confidence levels to the evidence available and the strength of the reasoning. An unknown identity should not prevent a set of activities from being described with the necessary qualifications.

Fictional example: several suspicious messages have similar wording. Before concluding that they form a campaign using AI, ask for an analysis that also considers the behaviours observed, the infrastructure and the context of the messages. Linguistic resemblance alone is not enough to support that conclusion.

Finally, clarify who receives recommendations and who decides whether to implement them. Hiring an investigator without identifying recipients for their reports risks producing analysis with no clear use.

• Translate security needs into intelligence questions about actors misusing AI systems.
• Combine accessible internal data with open-source research to connect activities to campaigns.
• Analyse adversary behaviours and infrastructure associated with the operations under investigation.
• Track actors’ tactics, techniques and procedures and document links between observed activities.
• Develop data processing routines and scripts to support the analysis of investigation data.
• Produce contextualised intelligence reports for security recipients.
• Make recommendations for detection and disruption, distinguishing established conclusions from hypotheses.
• Cooperate with the teams responsible for implementing the measures decided on.

A useful background prepares someone to investigate cyber operations, process the traces they leave and explain what the evidence collected allows them to conclude. The CTI foundations described by ENISA include systems and network security, programming, attack procedures, intelligence-sharing frameworks and responsible disclosure. These skills provide a basis for understanding campaigns that misuse AI.

There is no single educational route into the role. Anthropic mentions a bachelor’s degree or an equivalent combination of education and experience. OpenAI cites transferable experience in threat intelligence, incident response or offensive security. These recruitment examples encourage an examination of the responsibilities candidates have held, without making one employer’s degree requirement a general condition.

For a CTI background, look for work connecting several activities to a campaign and reports written for a security team. For incident response experience, explore the analysis of traces and the reconstruction of operations. For an offensive security background, ask how an understanding of attack techniques can support an investigation into actors.

Knowledge of large language models complements these foundations. Distinguish the skills the candidate has already used in investigations from those they will need to develop in malicious cyber uses of AI. If further development is needed, provide a technical specialist who can support it. The level of autonomy on arrival must match the investigations actually assigned and the expertise available in the team.

To assess this profile, adapt the following steps to the data accessible, the recipients of reports and the autonomy expected within your organisation.

1. Define the criteria with a technical specialist

Prepare an assessment framework covering cyber analysis, connecting data, reasoning under uncertainty and intelligence writing. Include an understanding of the misuse of AI models.

For each criterion, specify what the person will need to do independently and what can be discussed with the team. Relate the level expected to the investigations assigned on arrival.

If your company lacks this expertise, involve an external CTI specialist in the technical assessment. Keep an internal lead responsible for assessing the usefulness of outputs and the conditions for cooperation.

2. Examine work that can be shared

Ask the candidate to describe an investigation they can present without disclosing confidential data. Ask them to clarify the initial question, the information available, their contribution and the recipients of the result.

Explore a decisive connection: what evidence supported it, and what other explanation could have fitted? Ask what would have led them to revise their conclusion.

Treat a clear distinction between personal work, contributions from other teams and collective results as a positive sign. Highly confident attribution without an explanation of the evidence available calls for further questioning.

3. Set a bounded investigation exercise

Fictional example: provide a case file of synthetic traces, open-source extracts and timelines describing several suspicious activities involving an AI model.

Ask the candidate to formulate an intelligence question, connect the relevant evidence and present several hypotheses. Ask them to explain what additional information they would seek.

Examine how they distinguish source reliability from information credibility. This distinction appears in CERT-EU’s CTI framework.

Ask for a short data processing task if programming forms part of the role’s responsibilities. Assess the choice of data and the explanation of the result as well as the code.

Look for traceable reasoning and conclusions proportionate to the evidence. Explore groupings based solely on similar wording or proximity in time.

4. Test communication and cooperation

Ask for a short briefing for a security team, followed by an oral explanation for a less technical manager. Ask the candidate to clarify observations, hypotheses and confidence levels.

Ask what recommendation could be considered without waiting for certain attribution. Check that the candidate also identifies the limits of their authority and the people who would decide on follow-up action.

For a management role, explore how investigations are allocated and analyses discussed within the team. For an expert role, focus the discussion on cooperation with operational teams.

5. Cross-check references and decide

With the candidate’s consent, ask referees about the responsibilities actually held, the quality of reporting and the response to contradictory evidence. Respect the limits of the information they can share.

Compare the observations collected with the initial assessment framework. Distinguish demonstrated skills, those still needing development and support needs. Record any gaps that would prevent the candidate from taking on the first investigations planned.