AI Cyber Threat Researcher (OSINT)

Location: Remote (4+ hours overlap with CET working hours preferred).

Type: Full-time or Part-time.

Application deadline: 3 November 2026, end of day (Anywhere on Earth).

Compensation: $80 - $120/h. Adjusted depending on location, seniority, and experience. It can be higher for exceptional candidates or specific locations with higher costs of living (e.g. San Francisco).

Start: As soon as possible.

About Apart

Apart Research is a nonprofit AI safety research organisation. We run research on how frontier AI systems behave in the real world, and we work closely with policymakers, including in the EU, to make sure that research informs how AI is governed.

AI agents are now showing up in real-world incidents. They break out of sandboxes, chain together public web services to get around their limitations, probe websites for data, and adapt their tactics within days. Incident reports on these events have quickly become one of the most influential sources of evidence in AI policy. However, not many people are systematically looking for these incidents, so most of them are never found.

We are building an incident discovery capability to change that.

The Role

You will find AI incidents in the wild before anyone else does. Your job is detection and discovery, not deep forensics: you surface and triage incidents, document the evidence, and hand promising cases to our research team and to forensics partners for in-depth investigation.

This is a broad remit. You'll cover autonomous agents behaving unexpectedly, misuse of AI systems by people, and anything in between. Your findings will feed our research on AI manipulation and misuse, and they will build a shared incident dataset for the wider safety and policy community.

Core Responsibilities

• Hunt for incidents across the open internet. Monitor public sources such as URL scanning and sandbox services, web archives, public relays and proxies, code repositories, forums, social media, and dark-web channels for signs of AI agent activity or AI-enabled misuse.
• Develop sensors for rogue agent traffic. Design and deploy honeypots, canary tokens, and decoy web services that attract and log AI agent activity, and build detection rules that tell agent traffic apart from ordinary bots and human users.
• Pivot on indicators. When you find a signal (a distinctive payload, a user agent, an encoded command string, an account-creation pattern), search for it at scale to map the full extent of the activity.
• Track evolving tactics. Agents switch tools and techniques quickly, for example moving from disposable email domains to mainstream providers once they're blocked. You'll maintain indicator sets and do the meta-analysis needed to keep up.
• Triage and document. Assess each candidate incident for credibility, severity, and research value. Preserve evidence carefully and write clear incident summaries.
• Hand off to investigators. Package cases for our researchers and for forensic partners, and stay involved as the investigation proceeds.
• Help with attribution. Contribute to the hard question of distinguishing fully autonomous agents from human-directed or human-assisted activity.
• Build the pipeline. Turn manual hunting into repeatable, partially automated workflows, using LLMs and scripting wherever they help.

Required Qualifications

Essential:

• Hands-on experience in OSINT, cyber threat intelligence, threat hunting, or trust & safety investigations
• Strong ability to pivot on indicators and connect weak signals across disparate public sources
• Solid technical literacy: comfort with web infrastructure (HTTP, DNS, URLs, encodings), log and dataset analysis, and scripting (Python or similar)
• Rigour in evidence handling and the ability to write clear, well-sourced reports for both technical and policy audiences
• Comfort working fast and independently in an ambiguous, new problem area

Nice to have:

• Experience tracking threat actor TTPs using frameworks such as MITRE ATT&CK
• Familiarity with LLM agents, tool use, and how agents interact with web services
• Background in influence operations, disinformation, or coordinated inauthentic behaviour research
• Experience in government, intelligence, or a threat intelligence vendor
• Interest in AI safety and how evidence shapes AI policy

You don't need prior AI safety experience. If you're an excellent investigator and curious about AI agents, we'd like to hear from you.

What We Offer

• You'll shape a new field. Systematic discovery of AI incidents barely exists yet, and you'll help define how it's done.
• Your findings will reach decision-makers. Incident reports are already shaping how governments and AI companies respond.
• We move fast. You'll have a small team, minimal bureaucracy, and direct collaboration with researchers and forensic specialists.
• The arrangement is flexible: part-time or full-time contracting, fully remote.

Apart Research is an equal opportunity organization and welcomes applicants of all backgrounds. We may use AI-assisted tools to support review; all applications are read by a human and final decisions are made by people. We process the information you submit to assess your application and may match it against our candidate-sourcing records (public professional information and talent-directory entries) to give reviewers fuller context; we keep application data only as long as needed for recruiting, including considering you for future roles, and delete it on request. Questions about the role or how your data is processed: careers@apartresearch.com.