DeFi Market Surveillance Analyst, Global Intelligence & Investigations

About the Role

Global Intelligence & Investigations is the team that keeps Polymarket's markets fair. We detect, investigate, and remediate insider trading, market and oracle manipulation, coordinated wallet activity, automated-trading abuse, sanctions and illicit-finance exposure, and fraud. We also handle law enforcement and regulatory requests tied to that activity. The team is small, operates with a high degree of independence, and works cases that require genuine analytical depth, not template matching.

This is a crypto-native surveillance role that draws on two disciplines at once. Every trade on Polymarket settles on-chain, which makes wallet tracing and blockchain analytics the foundation of the work. Markets also run on an order book, so classic trade-surveillance skills apply directly. The strongest investigators here move fluidly between both, following wallets and funding flows across a blockchain, then corroborating against order-book behavior, device data, and open-source intelligence to reach a defensible disposition.

You'll join a senior investigator who handles the most complex and ambiguous cases, and your job is to make sure the daily investigative workload gets worked with the same rigor. That means owning the alert queue, running down the matters that clear our investigation thresholds, and keeping every case moving to a documented resolution. Volume is real, and so is the quality bar. Bad actors here are technical and constantly adapting, and this role requires someone who follows threads the rules don't yet cover and looks for a better way to work rather than waiting to be handed one.

What You'll Do

• Triage incoming alerts and referrals daily against documented investigation thresholds, set priority and next steps, and make sure genuinely novel signals don't get dismissed because they don't fit a known pattern.

• Trace flagged wallets across chains, bridges, and funding flows, distinguishing controlling wallets from contract and proxy wallets, clustering related addresses, and following withdrawal paths to a documented disposition.