Senior Fraud Risk Manager

Who We Are

About the Team

About the Opportunity

What You’ll Be Doing

Blockchain Investigations & Digital-Asset Intelligence

• Lead and conduct complex blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems.
• Trace the origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets, including activity spanning multiple intermediaries and blockchain environments.
• Conduct investigations using tools such as Chainalysis Reactor, TRM Labs, Elliptic, or comparable blockchain intelligence platforms, while understanding the methodologies and limitations underlying platform-generated attribution.
• Analyze activity involving centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems.
• Trace assets across multiple chains and cross-chain transactions, identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible.
• Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators.
• Understand and appropriately apply wallet-clustering and attribution methodologies, including the limitations and potential for false attribution associated with particular heuristics.
• Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution.
• Corroborate on-chain findings, where appropriate, with internal account records, KYC/KYB information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence.
• Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities.
• Reconstruct complex transaction flows and create clear fund-flow diagrams, transaction maps, timelines, and visualizations that allow investigators and nontechnical stakeholders to understand the movement of assets.
• Analyze blockchain activity associated with suspected fraud, theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct.
• Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads.
• Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings.
• Distinguish between confirmed attribution, vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis.
• Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct.
• Maintain current knowledge of emerging blockchain technologies, protocols, tracing methodologies, obfuscation techniques, fraud typologies, and developments affecting blockchain attribution or investigations.

Fraud Investigations & Investigative Intelligence

• Conduct and support investigations involving internal and external fraud, employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks.
• Combine blockchain findings with off-chain evidence to develop a comprehensive investigative picture rather than treating blockchain activity in isolation.
• Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis.
• Conduct timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities.
• Support investigations involving account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse, particularly where a digital-asset, employee, vendor, or enterprise nexus exists.
• Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct.
• Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up.

Enterprise Data & Insider-Risk Analytics

• Analyze appropriately authorized information including system and access logs, authentication records, audit trails, customer-account activity, KYC/KYB information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry.
• Correlate blockchain activity with enterprise data to identify possible connections among wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities.
• Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access.
• Identify anomalous behavior or access patterns that may warrant additional investigation.
• Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems.
• Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets.

Investigative Reporting & Evidence

• Prepare clear, concise, and well-supported blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products.
• Explain complex blockchain concepts and transaction activity in plain language suitable for investigators, senior management, Legal, regulators, or law enforcement, as appropriate.
• Clearly distinguish among allegations, investigative leads, known facts, third-party attribution, analytical judgments, assumptions, information gaps, and substantiated conclusions.
• Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports.
• Maintain sufficient documentation to allow significant blockchain findings to be reviewed, reproduced, and understood by another qualified analyst.
• Preserve and handle investigative records in accordance with applicable evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements.
• Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions.

Protective Intelligence & Physical Security Support

• Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests.
• Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat.
• Assist in evaluating available information relating to credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators.
• Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels.
• Support PST’s assessment while preserving PST’s responsibility for protective-security decisions and operational response.

Leadership & Development

• Directly manage and develop one Junior Analyst, including work allocation, coaching, technical development, quality assurance, and review of analytical work product.
• Serve as a FIT subject-matter resource for blockchain investigations and on-chain analytical methodology.
• Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support.
• Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology.
• Help establish consistent standards for blockchain investigations, attribution, documentation, quality assurance, and reporting.
• Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required.

What We Look For In You

• 7+ years of relevant investigative or analytical experience, with meaningful professional experience specifically conducting cryptocurrency or blockchain investigations.
• Demonstrated hands-on expertise independently conducting complex blockchain tracing investigations, rather than solely reviewing blockchain alerts or commercial risk scores.
• Advanced proficiency with one or more blockchain intelligence platforms such as Chainalysis Reactor, TRM Labs, Elliptic, or comparable technology.
• Strong understanding of how blockchain intelligence platforms derive attribution, clustering, exposure, and risk information—and the limitations associated with those methodologies.
• Demonstrated understanding of blockchain fundamentals, including wallets and addresses, transactions, UTXO and account-based models, tokens, smart contracts, block explorers, transaction fees, confirmations, and blockchain-specific transactional structures.
• Strong understanding of digital-asset ecosystems including centralized exchanges, self-hosted wallets, DeFi, DEXs, stablecoins, cross-chain bridges, mixers, privacy-enhancing mechanisms, and other relevant technologies.
• Demonstrated ability to trace assets across multiple chains, protocols, and intermediaries and recognize when technical limitations prevent definitive continuity or attribution.
• Experience conducting transaction-graph analysis, wallet attribution, clustering, counterparty analysis, transaction-flow reconstruction, and investigative link analysis.
• Ability to critically assess blockchain attribution and distinguish among technical facts, commercial vendor intelligence, analytical inference, and unsupported assumptions.
• Experience integrating blockchain intelligence with off-chain evidence and enterprise information to develop investigative conclusions.
• Strong knowledge of fraud-investigation principles including corroboration, source evaluation, evidence preservation, timeline development, hypothesis testing, and documentation.
• Experience analyzing large or complex datasets and familiarity with tools such as SQL, advanced Excel, Python, Splunk, or comparable data-analysis technologies.
• Ability to clearly explain technically complex blockchain findings to audiences that may have little or no blockchain expertise.
• Strong investigative writing skills and demonstrated ability to produce accurate, concise, and defensible analytical products.
• Sound judgment and ability to work effectively where evidence is incomplete, conflicting, or evolving.
• Demonstrated discretion when handling sensitive employee, customer, investigative, security, or company information.
• Demonstrated experience mentoring, supervising, or reviewing the work of junior analysts or investigators.

Nice to Haves

• Experience conducting blockchain investigations within a cryptocurrency exchange, blockchain analytics company, law-enforcement agency, regulatory organization, financial institution, intelligence function, or investigative consulting environment.
• Experience investigating digital-asset matters involving fraud proceeds, theft, account compromise, insider activity, social engineering, asset tracing, or complex cross-chain movement.
• Experience supporting asset recovery, law-enforcement referrals, subpoenas/legal process, civil litigation, regulatory inquiries, or other matters requiring defensible blockchain analysis.
• Experience investigating insider threats, employee misconduct, unauthorized access, data exfiltration, credential compromise, vendor fraud, conflicts of interest, or trusted-party abuse.
• Experience with OSINT, digital forensics, enterprise logs, security telemetry, or identity and access-management information.
• Experience creating custom blockchain analytics through APIs, SQL, Python, blockchain explorers, node data, or other raw-data sources, rather than relying exclusively on commercial graphical interfaces.
• Relevant blockchain-specific training or certifications, including certifications associated with Chainalysis, TRM Labs, or comparable blockchain-analysis platforms.
• Professional certifications such as CFE, CFCS, CAMS, GIAC, or comparable investigative, fraud, financial-crime, cybersecurity, or intelligence credentials.

What Success Looks Like