Lead, Threat Intelligence

About the Role

Global Intelligence and Investigations exists to protect the integrity of Polymarket's markets and platform. This team sits within Legal and operates at the intersection of analysis, engineering, and real-world consequence. Threat Intelligence is the external-facing arm of that work, responsible for understanding who is targeting Polymarket and the broader crypto and prediction-market ecosystem, and making sure that intelligence actually changes how we defend ourselves.

This is not a monitoring role. You will track real threat actors, build the pipelines that turn raw data into actionable intelligence, and work directly with Product and Security to get protections shipped. The crypto context matters here. Transactions are irreversible, adversaries are often sophisticated, and the gap between detecting a threat and acting on it has real financial consequences for real users. The work has weight.

We're hiring one person to own this end to end. That means you need to be strong on both sides: the intelligence tradecraft and the engineering. If you can track an actor but need someone else to build the detection, or you can build pipelines but can't produce a written assessment a lawyer can act on, this is not the right fit. If you can do both, we want to talk.

What You'll Do

• Monitor external threat actors targeting crypto and prediction-market platforms, tracking campaigns, tactics, and infrastructure across open and closed sources.

• Build and maintain Python pipelines that ingest, normalize, and enrich threat data from internal systems, external feeds, and intelligence partnerships.