Head of Threat Intelligence

About the role

Company Overview

Promise modernizes how government agencies and utilities support people in financial difficulty. We build technology that makes it simple for residents to receive benefits, engage with assistance programs, set up flexible payment plans, and stay on track—while helping agencies increase efficiency, recover revenue, and deliver services with dignity. Our mission is to transform public systems so they work better for everyone, especially the most vulnerable.

Our team includes experts from companies like Palantir, Google, Stripe , and esteemed government leaders. We work hard and believe deeply in what we do. We're looking for excellent people to build innovative, resilient technology.

Backed by over $50 million in funding from top investors – such as Reid Hoffman, Howard Schultz, Michael Seibel, Y Combinator, 8VC, The General Partnership, First Round Capital, Kapor Capital, XYZ Ventures, and Bronze Investments – Promise has been recognized as one of Fast Company's "World's Most Innovative Companies of 2022,” “Forbes Next Billion-Dollar Startups 2024,” and Y Combinator’s #1 GovTech startup.

About Promise

Promise builds AI-powered infrastructure for benefits delivery, payments, and program integrity for state and federal government agencies. We work inside the agencies that run SNAP, Medicaid, unemployment, LIHEAP, property tax, and municipal fines, in more than 15 states and with more than 24 utility clients. The systems we build decide whether people get the support they’re owed, on time.

The Role

As Promise grows, so does the attention on the company and its leaders. Some of it is hostile: fabricated documents, edited Wikipedia pages, fake reviews, planted stories, impersonation. AI has made all of it cheap. We’re building the function that finds it fast, works out who is behind it, and shuts it down through legitimate process.

You’ll be the first person in that function. You’ll have authority over the outside firms we retain (Wikipedia consultants, litigation counsel, investigators) and a direct line to the CEO. You own every surface where Promise and its leaders get judged, from a Wikipedia revision to a procurement officer’s search results.

You’re patient, thorough, and you enjoy the hunt. You use AI fluently, both to work at the attacker’s speed and to spot their output. You can explain Wikipedia’s living-persons policy, a sockpuppet investigation, and a John Doe subpoena without looking anything up. You know where the line is and say so before anyone asks.

What would make you not a fit: search or reputation-management backgrounds, penetration testers without investigative experience, and anyone who needs classified tooling to function.

What You’ll Do

• Build the tripwires. Monitor Wikipedia and Wikidata, search results, review and complaint sites, domain registrations, social platforms, paste sites, and public records, covering the company, its executives, and key clients. We want to hear about a problem in an hour, not three weeks.

• Attribute. Use account-graph analysis, stylometry, metadata, and timing to produce a named hypothesis, a stated confidence level, and evidence that holds up for counsel.

• Enforce. Work platform process from the inside: biography-of-living-persons noticeboards, sockpuppet investigations, repository and registrar takedowns, search removals. Know the trust and safety teams at the major platforms.

• Support counsel. Build preservation lists, subpoena-ready evidence packages, public records requests, and referrals to Attorneys General and Inspectors General. Investigations run at counsel’s direction, under privilege.

• Respond. When attribution is solid, work with counsel on the right consequence: platform bans, regulator referrals, formal complaints.

• Protect executives. Handle doxxing, impersonation, phishing domains, and physical-security signals.

• Write. Most of this work is won in writing, on noticeboards, in referrals, in evidence memos. Plain, short, exact.

What You Won’t Do

Our customers are state governments, so every action has to survive a procurement-integrity review and a deposition. That means no unauthorized access, no hacking back, no undisclosed or retaliatory accounts, no planted content, and no exposing a person without attribution we can defend in court. If you need those tools to win, this isn’t the role. The best people in this field never need them.

What You Bring

You’ve done this somewhere hard. Most likely:

• A trust and safety investigator at a major platform (threat disruption, influence operations, or Wikimedia Trust and Safety)

• A disinformation researcher who has attributed coordinated account networks, at Graphika, DFRLab, the Stanford Internet Observatory, or similar

• A threat intelligence analyst at Nisos, Recorded Future, Mandiant, or Kroll who wants to own an outcome instead of billing hours

• An OSINT investigative journalist with a digital forensics record

If you are energized by this problem space and want to get creative about this work, please get in touch (even if you don’t meet every single requirement).

Promise is an equal opportunity employer and does not discriminate against any applicant or employee because of race, color, religion, sex, sexual orientation, gender identity, national origin, disability, genetic information, age, or military or veteran status. Additionally, the Company complies with applicable state and local laws governing non-discrimination in employment in every jurisdiction in which it operates. Promise is committed to promoting diversity and inclusion in the workplace. We also provide reasonable accommodations to qualified individuals with disabilities, pregnant individuals, and those with sincerely held religious beliefs, in accordance with applicable laws. To request a reasonable accommodation, please email [email protected].

Promise engages in US government contracts and restricts hiring to US persons, which includes US citizens and permanent residents (e.g., Green Card holders). Additionally, candidates must reside in the US.

Promise participates in E-Verify. To learn more, view E-Verify Participation Notice and Right to Work Notice.