Cyber Operations Strategist, Critical Harm Operations

About the role

We are looking for a senior cybersecurity practitioner and operations strategist to raise the quality, scalability, and technical rigor of our Cyber Operations. You will combine hands-on cyber judgment with systems-level operating design: resolve the hardest dual-use questions, evolve SOPs, uplift reviewers and vendors, and build practical tools and automations.

This is a senior IC role. Success is not primarily cases closed; it is durable improvement in the operating model and the reviewers who run it. This Toronto-based role is currently remote and is expected to transition to an in-office arrangement.

Responsibilities

• Drive the Cyber Operations operating model across domain priorities, SOPs, escalation paths, quality health, vendor capability, roadmap inputs and help inform trusted access strategies.
• Serve as the senior cyber expert for complex or high-risk decisions across ChatGPT, API, Codex, agents, and emerging product surfaces.
• Translate policy ambiguity, quality misses, appeals, and reviewer disagreement into clear decision rules, calibration examples, training, and tooling requirements.
• Build durable operating systems and quality loops: golden sets, holdouts, double-labeling, adjudication, error taxonomies, reviewer calibration, and automation evaluations.
• Raise FTE and BPO capability through onboarding, certification, coaching, recurring calibration, and vendor-performance partnership.
• Use quality, appeals, SLA, backlog, and disagreement signals to diagnose root causes and prioritize high-leverage fixes.
• Build hands-on solutions—SQL analyses, scripts, dashboards, LLM eval workflows, evidence enrichment, routing logic, and lightweight automations—that improve decision quality and reduce manual effort.
• Partner with Policy, Integrity, Safety Systems, Security, Legal, Product, Engineering, and Investigations to operationalize changes and drive launch readiness.

Requirements

• Have 8+ years of hands-on cybersecurity experience in offensive security, threat intelligence, incident response, security research, red teaming, application security, DFIR, malware analysis, or a related field.
• Can reason deeply about attacker tradecraft, vulnerability exploitation, credential abuse, malware, persistence, evasion, exfiltration, cloud or identity abuse, and ambiguous dual-use activity.
• Have built or improved high-stakes operations, reviewer programs, QA systems, escalation workflows, or vendor/BPO programs.
• Can turn complex cyber and policy judgment into reviewer-usable SOPs, decision trees, training, and concise written recommendations.
• Are comfortable using SQL, Python, JavaScript, PowerShell, and Bash, APIs, LLM tooling, or automation to solve operational problems.
• Understand human-in-the-loop automation, evaluations, monitoring, holdouts, and fallback paths for sensitive workflows.
• Operate independently in ambiguity, communicate clearly across technical and non-technical audiences, and bring sound judgment and discretion when handling sensitive material.
• Experience with trust and safety, platform abuse, cyber misuse of AI systems, or LLM safety.

Qualifications

• Nice to have: Experience with golden sets, classifier or prompt evaluations, and reviewer-quality programs. Experience enabling global vendor reviewer operations.

Skills

• Hands-on cybersecurity experience in offensive security, threat intelligence, incident response, security research, red teaming, application security, DFIR, malware analysis, or a related field.
• Reasoning about attacker tradecraft, vulnerability exploitation, credential abuse, malware, persistence, evasion, exfiltration, cloud or identity abuse, and ambiguous dual-use activity.
• Built or improved high-stakes operations, reviewer programs, QA systems, escalation workflows, or vendor/BPO programs.
• Turning complex cyber and policy judgment into reviewer-usable SOPs, decision trees, training, and concise written recommendations.
• Using SQL, Python, JavaScript, PowerShell, and Bash, APIs, LLM tooling, or automation to solve operational problems.
• Understanding human-in-the-loop automation, evaluations, monitoring, holdouts, and fallback paths for sensitive workflows.
• Operating independently in ambiguity, communicating clearly across technical and non-technical audiences, and bringing sound judgment and discretion when handling sensitive material.
• Experience with trust and safety, platform abuse, cyber misuse of AI systems, or LLM safety.
• Experience with golden sets, classifier or prompt evaluations, and reviewer-quality programs.
• Experience enabling global vendor reviewer operations.

Benefits

No specific benefits mentioned.

Pay

$140k – $188k

Schedule

The role is currently remote and is expected to transition to an in-office arrangement.