Responsibilities

As Promise grows, so does the attention on the company and its leaders. Some of it is hostile: fabricated documents, edited Wikipedia pages, fake reviews, planted stories, impersonation. AI has made all of it cheap. We’re building the function that finds it fast, works out who is behind it, and shuts it down through legitimate process.
You’ll be the first person in that function. You’ll have authority over the outside firms we retain (Wikipedia consultants, litigation counsel, investigators) and a direct line to the CEO. You own every surface where Promise and its leaders get judged, from a Wikipedia revision to a procurement officer’s search results.
You’re patient, thorough, and you enjoy the hunt. You use AI fluently, both to work at the attacker’s speed and to spot their output. You can explain Wikipedia’s living-persons policy, a sockpuppet investigation, and a John Doe subpoena without looking anything up. You know where the line is and say so before anyone asks.
What would make you not a fit: search or reputation-management backgrounds, penetration testers without investigative experience, and anyone who needs classified tooling to function.
Build the tripwires. Monitor Wikipedia and Wikidata, search results, review and complaint sites, domain registrations, social platforms, paste sites, and public records, covering the company, its executives, and key clients. We want to hear about a problem in an hour, not three weeks.
Attribute. Use account-graph analysis, stylometry, metadata, and timing to produce a named hypothesis, a stated confidence level, and evidence that holds up for counsel.
Enforce. Work platform process from the inside: biography-of-living-persons noticeboards, sockpuppet investigations, repository and registrar takedowns, search removals. Know the trust and safety teams at the major platforms.
Support counsel. Build preservation lists, subpoena-ready evidence packages, public records requests, and referrals to Attorneys General and Inspectors General. Investigations run at counsel’s direction, under privilege.
Respond. When attribution is solid, work with counsel on the right consequence: platform bans, regulator referrals, formal complaints.
Protect executives. Handle doxxing, impersonation, phishing domains, and physical-security signals.
Write. Most of this work is won in writing, on noticeboards, in referrals, in evidence memos. Plain, short, exact.
What You Won’t Do

Head of Threat Intelligence at Promise · LumiJobs

Head of Threat Intelligence

Responsibilities

Qualification

Required

Company

Promise

More roles at Promise