Hiring nowAI application security and misuse defence

AI Threat Intelligence Analyst

Also called AI Misuse Analyst

An AI Threat Intelligence Analyst tracks how threat actors use AI to attack, deceive and abuse systems, then turns what they find into detections. It helps safety teams stop misuse before it reaches customers.

What they do

The analyst watches how hostile groups and opportunistic abusers use AI tools. They collect evidence from open sources, internal logs, abuse reports and community chatter. They work out who is behind a pattern, what they want and how they get around current controls. Then they write up findings and turn them into detection rules, signals and test cases for safety and security teams. They brief engineers and policy colleagues, track how tactics change after a fix ships, and keep a clear record of what is known and what is only suspected.

What a strong hire delivers

In the first months, a strong hire gives the company a clear picture of who is misusing its products and how. They set up a repeatable way to collect and rate evidence. They ship the first detections that safety teams actually adopt. They also write short, usable briefings that change what engineers build and what reviewers look for.

How you can tell they are good

Ask them to walk through a past investigation from first signal to detection. Strong people show their evidence, say how confident they were and explain what they ruled out. They separate attribution from guesswork. Ask how they would test a detection for false positives. Worry if they only list threats and cannot show a finding that changed a control.

Why it is hard to fill

Few people have done this work for long, because the abuse patterns are new. Titles vary: misuse analyst, threat researcher, abuse investigator. Most candidates come from one side only, either classic threat intelligence or trust and safety, and lack the model knowledge or the detection engineering to finish the job. Employers compete for the same small group, so strong people are rarely on the market for long.

Where to find them

Look in threat intelligence teams at security vendors, and in application security and threat detection groups. Open source intelligence analysts and security researchers often have the right instincts. Trust and safety investigators bring abuse experience at scale. Frontier labs and model providers employ many of the people already doing this, so adjacent teams at platforms and security firms are a sensible place to start.

Indicative pay

Not enough published evidence yet to give a fair range for this role, which is common for work this new. We benchmark it for you as part of a search.

Interview questions for an AI Threat Intelligence Analyst

Describe an investigation where you tracked a threat actor from first signal to a detection. What did you find and what changed?
A strong answer follows a real case with evidence, confidence levels and a concrete outcome such as a new rule or control. Worry if it stays at the level of general trends or names no result.
How do you separate what you know about an actor from what you suspect?
Good answers describe sources, corroboration and explicit confidence wording. They admit gaps and revise views. Worry about confident attribution from thin evidence or a single source.

4 more questions, with what a strong answer covers, are in the Role Kit.

Job description you can post

We build products that connect AI models to real users and real systems, and some people will try to misuse them. We are hiring an analyst to find out who, how and why, and to turn that knowledge into detections that safety and security teams use every day.

What you will do

Track how threat actors use AI in attacks, fraud and abuse
Investigate suspicious activity using logs, reports and open sources
Write clear intelligence briefings for engineers, safety and policy teams
Turn findings into detection rules, signals and test cases
Measure detections and reduce false positives with the teams that own them
Monitor how tactics change after we ship fixes
Maintain a clear record of evidence and confidence for each finding

What you will bring

Demonstrated investigations that led to a detection or control change
Experience in threat intelligence, threat detection, application security or trust and safety
Comfort with open source intelligence methods and handling sensitive data
Ability to write detection logic and query large sets of logs
Clear, concise writing for technical and non-technical readers
Sound judgement on confidence, attribution and disclosure

Nice to have

Hands-on experience red teaming AI systems
Familiarity with agent frameworks and tool integrations
Experience running or supporting incident response

Free to use and adapt. If it saves you time, a link back to this page is appreciated.

Skills that matter

Security engineeringWorkingProtect systems, identities and sensitive assets
AI red teamingWorkingTest systems adversarially under authorisation
Tool and protocol integrationWorkingConnect models to external data and capabilities
Reliability and incident responseWorkingDetect failures, restore service and prevent recurrence

Other roles in aI application security and misuse defence

Hiring nowAI Security EngineerAn AI Security Engineer hardens the applications, interfaces and sensitive assets built around models. They find how attackers could misuse the…Hiring nowAI Red Team EngineerAn AI Red Team Engineer runs authorised attacks against model-connected systems to find weaknesses before real adversaries do. They give the company…Hiring nowAI Abuse Detection AnalystAn AI Abuse Detection Analyst spots unauthorised and harmful use of a company's models and products, then turns what they find into rules and cases…EmergingModel Supply Chain Security EngineerA Model Supply Chain Security Engineer protects model files, datasets and dependencies from tampering. They give the company confidence that what it…Hiring nowAgent Security EngineerAn Agent Security Engineer protects AI agents from prompt injection, data leaks and tool misuse. They let a company ship agents that act on real…Hiring nowModel Weights Security EngineerA Model Weights Security Engineer protects trained model weights and the training infrastructure around them from theft, including by well-resourced…EmergingAgent Identity and Permissions ArchitectThis person designs how AI agents prove who they are and what they may do. They keep access narrow as agent numbers grow, so one compromised agent…Hiring nowAI Trust and Safety SpecialistAn AI Trust and Safety Specialist writes and enforces the rules for how a model-connected product can be used, and investigates misuse. They keep…

Related roles in other families

Hiring nowCybersecurity ML ScientistCyber defence and security operations AIA Cybersecurity ML Scientist builds and tests models that spot malicious activity in authorised security data. They keep detection useful as…Hiring nowAI Detection EngineerCyber defence and security operations AIAn AI Detection Engineer builds the detections that turn AI-derived signals into alerts a security team can trust. They cut noise, catch real…EmergingAI Security Operations EngineerCyber defence and security operations AIAn AI Security Operations Engineer builds constrained AI support for security triage and response. It lets a security team move faster on alerts and…EmergingDefensive AI Agent EvaluatorCyber defence and security operations AIA Defensive AI Agent Evaluator tests how AI agents behave inside security detection and response work, and shows where they fail. It matters because…

How we wrote this

Role definitions are our own editorial work, checked against occupational classifications, standards, research and employer pages. Titles vary by company, and this is a description of the work, not a job advert.

← AI application security and misuse defence All new job families

Start a search

Hiring an AI Threat Intelligence Analyst?

Tell us the work. We find the people already doing it, whatever their job title says, and you meet them already interviewed for your role.