Senior Fraud Risk Manager
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). However we need to map content to appropriate headings. The posting includes sections: Who We Are, About The Team, About The Opportunity, What You’ll Be Doing (with subheadings: Blockchain Investigations & Digital-Asset Intelligence, Fraud Investigations & Investigative Intelligence, Enterprise Data & Insider-Risk Analytics, Investigative Reporting & Evidence, Protective Intelligence & Physical Security Support, Leadership & Development), What We Look For In You (experience etc). We need to decide which headings to use: "About the role" could correspond to About The Opportunity? Or "Responsibilities" for What You’ll Be Doing. "Requirements" or "Qualifications" for What We Look For In You. "Skills" maybe not present. "Benefits", "Pay", "Schedule" not present, so we should not create those sections. Also "Who We Are" and "About The Team" could be combined into maybe "About the company" but not in allowed headings list. The allowed headings list includes: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should only use those headings if we have content. We have content for About the role (maybe About The Opportunity). Responsibilities (What You’ll Be Doing). Requirements/Qualifications (What We Look For In You). We might not have Skills separate. We should not create headings for Benefits, Pay, Schedule because not present.
We must not repeat job title as heading. Also we should not include Job ID etc.
We need to preserve all substantive information, not invent or summarize away detail. Must not emit heading with filler. So we need to include sections only if we have real content.
Thus output:
About the role
... content from About The Opportunity ... maybe also include Who We Are and About The Team? The instruction: "About the role" heading for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can put the description of the role under About the role. Could combine Who We Are and About The Team as part of About the role? Probably better to include them as paragraphs under About the role. Then
Responsibilities
with- for each duty. The responsibilities are many bullet-like paragraphs under What You’ll Be Doing subheadings. We need to convert each duty into list items. We must preserve all substantive information; we can break into list items for each major duty. Could be many items; but we need to keep content.
We could create subheadings inside responsibilities? Not allowed; only
for section headings. Inside responsibilities we can have
- and maybe
for prose inside li? Probably just plain text. We need to include all the bullet points from the "What You’ll Be Doing" sections. Let's extract them: Under Blockchain Investigations & Digital-Asset Intelligence: - Lead and conduct complex blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems. - Trace the origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets, including activity spanning multiple intermediaries and blockchain environments. - Conduct investigations using tools such as Chainalysis Reactor, TRM Labs, Elliptic, or comparable blockchain intelligence platforms, while understanding the methodologies and limitations underlying platform-generated attribution. - Analyze activity involving centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems. - Trace assets across multiple chains and cross-chain transactions, identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible. - Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators. - Understand and appropriately apply wallet-clustering and attribution methodologies, including the limitations and potential for false attribution associated with particular heuristics. - Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution. - Corroborate on-chain findings, where appropriate, with internal account records, KYC/KYB information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence. - Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities. - Reconstruct complex transaction flows and create clear fund-flow diagrams, transaction maps, timelines, and visualizations that allow investigators and nontechnical stakeholders to understand the movement of assets. - Analyze blockchain activity associated with suspected fraud, theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct. - Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads. - Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings. - Distinguish between confirmed attribution, vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis. - Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct. - Maintain current knowledge of emerging blockchain technologies, protocols, tracing methodologies, obfuscation techniques, fraud typologies, and developments affecting blockchain attribution or investigations. Fraud Investigations & Investigative Intelligence: - Conduct and support investigations involving internal and external fraud, employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks. - Combine blockchain findings with off-chain evidence to develop a comprehensive investigative picture rather than treating blockchain activity in isolation. - Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis. - Conduct timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities. - Support investigations involving account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse, particularly where a digital-asset, employee, vendor, or enterprise nexus exists. - Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct. - Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up. Enterprise Data & Insider-Risk Analytics: - Analyze appropriately authorized information including system and access logs, authentication records, audit trails, customer-account activity, KYC/KYB information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry. - Correlate blockchain activity with enterprise data to identify possible connections among wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities. - Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access. - Identify anomalous behavior or access patterns that may warrant additional investigation. - Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems. - Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets. Investigative Reporting & Evidence: - Prepare clear, concise, and well-supported blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products. - Explain complex blockchain concepts and transaction activity in plain language suitable for investigators, senior management, Legal, regulators, or law enforcement, as appropriate. - Clearly distinguish among allegations, investigative leads, known facts, third-party attribution, analytical judgments, assumptions, information gaps, and substantiated conclusions. - Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports. - Maintain sufficient documentation to allow significant blockchain findings to be reviewed, reproduced, and understood by another qualified analyst. - Preserve and handle investigative records in accordance with applicable evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements. - Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions. Protective Intelligence & Physical Security Support: - Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests. - Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat. - Assist in evaluating available information relating to credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators. - Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels. - Support PST’s assessment while preserving PST’s responsibility for protective-security decisions and operational response. Leadership & Development: - Directly manage and develop one Junior Analyst, including work allocation, coaching, technical development, quality assurance, and review of analytical work product. - Serve as a FIT subject-matter resource for blockchain investigations and on-chain analytical methodology. - Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support. - Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology. - Help establish consistent standards for blockchain investigations, attribution, documentation, quality assurance, and reporting. - Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required. Now What We Look For In You: truncated at "7+ years of relevant investigative or analytical experience, with meaningful professional ex". The text cut off. We need to preserve all substantive information; we have only that partial sentence. We must not invent. So we include that as is. Possibly there is more after but not provided. We'll just include that sentence. Thus Requirements/Qualifications section: we can put that sentence. We need to decide whether to use Requirements or Qualifications. Both are allowed headings. We have experience requirement. Could put under Requirements. Or Qualifications. We'll choose Requirements. Now About the role: we need to include Who We Are, About The Team, About The Opportunity. Let's combine them into a few paragraphs. Who We Are: "At OKX, we believe the future will be reshaped by crypto and blockchain technology. We operate a leading global crypto platform and build products and services designed to expand access to the digital-asset ecosystem. Across our global organization, we value ownership, sound judgment, collaboration, innovation, and the ability to operate effectively in a fast-moving and continuously evolving environment." About The Team: "The Fraud Investigations Team (FIT) is a First Line of Defense function within OKX’s Risk organization responsible for identifying, assessing, investigating, and helping manage significant internal and external fraud risks affecting the company, its customers, personnel, and operations. FIT conducts and supports complex investigations involving digital assets, internal and external fraud, employee misconduct, insider threats, unauthorized access or misuse of information, vendor and third-party misconduct, account compromise, social engineering, collusion, conflicts of interest, and other significant fraud-related matters. The team works closely with Legal, HR, Information Security, Engineering, Physical Security, Compliance, Finance, Operations, and other functions across OKX." About The Opportunity: "We are looking for an experienced Senior Analyst, Blockchain
- and maybe