Senior Fraud Risk Manager

<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh">
<div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh">
<div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh">
<div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh">
<div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh">
<div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div data-page-id="Kpucdjv7JoAcSZxSf7PuRl5Yscb" data-lark-html-role="root" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-Cfb8dvi9voxFkWxhNcmuJX50sZb">
<div data-page-id="PNNZdiw4Yo1ZOmx8btbucw8qsLG" data-lark-html-role="root" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-JGIsdeznCo2qpfxJAqkuViMfsHS">
<div>
<div class="job__description body">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh">
<div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false">
<div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db">
<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false">
<div data-page-id="Zrp2dGhcIo3UFmxud3WuQirssDb" data-lark-html-role="root" data-docx-has-block-data="false">
<div data-page-id="I1Zud8CYtoGHccx0MImuyRU4s2c" data-lark-html-role="root" data-docx-has-block-data="false">
<div data-page-id="I1Zud8CYtoGHccx0MImuyRU4s2c" data-lark-html-role="root" data-docx-has-block-data="false">
<div data-page-id="Hs6Qdtvg7ol1iox7YnElHJRCgug" data-lark-html-role="root" data-docx-has-block-data="false">
<h2 class="heading-2 ace-line old-record-id-J9ZXd3bHwo3B3CxbC8YlRjczgTh"><strong>Who We Are</strong></h2>
<div class="ace-line ace-line old-record-id-IxBndgvYZoiWPcx9ALuluLjtgFc">At OKX, we believe the future will be reshaped by crypto and blockchain technology. We operate a leading global crypto platform and build products and services designed to expand access to the digital-asset ecosystem.</div>
<div class="ace-line ace-line old-record-id-PxLOd5GpxofwIPxbQFklUoMZgyf">Across our global organization, we value ownership, sound judgment, collaboration, innovation, and the ability to operate effectively in a fast-moving and continuously evolving environment.</div>
<div class="ace-line ace-line old-record-id-KIjIdQhaOo7mJwxaYOilVPa0gqd"><em>Recruiting should insert the current approved </em><em>OKX</em><em> corporate “Who We Are” language when the position is posted.</em></div>
<div class="ace-line ace-line old-record-id-KIjIdQhaOo7mJwxaYOilVPa0gqd"> </div>
<h2 class="heading-2 ace-line old-record-id-P90WdSYRQoQmtpxCzEzletSZgec"><strong>About the Team</strong></h2>
<div class="ace-line ace-line old-record-id-H199dNhoFoBhR1xIuBKl2aR2gNf">The <strong>Fraud</strong><strong> Investigations Team (FIT)</strong> is a First Line of Defense function within OKX’s <strong>Risk organization</strong> responsible for identifying, assessing, investigating, and helping manage significant internal and external fraud risks affecting the company, its customers, personnel, and operations.</div>
<div class="ace-line ace-line old-record-id-Db6vdkjfVoww9YxrveklmwWDgod">FIT conducts and supports complex investigations involving digital assets, internal and external fraud, employee misconduct, insider threats, unauthorized access or misuse of information, vendor and third-party misconduct, account compromise, social engineering, collusion, conflicts of interest, and other significant fraud-related matters.</div>
<div class="ace-line ace-line old-record-id-CXmCd265hof7cyxaByLlyxa6gUc">The team works closely with Legal, HR, Information Security,Engineering, Physical Security, Compliance, Finance, Operations, and other functions across OKX.</div>
<div class="ace-line ace-line old-record-id-CXmCd265hof7cyxaByLlyxa6gUc"> </div>
<h2 class="heading-2 ace-line old-record-id-SDuYdO2DKoVDZaxqk1plbj4fgIc"><strong>About the Opportunity</strong></h2>
<div class="ace-line ace-line old-record-id-Z1bcdUfiAo50VzxeZCTlsnClg7d">We are looking for an experienced <strong>Senior Analyst, Blockchain Investigations & </strong><strong>Fraud</strong><strong> Intelligence</strong> to join FIT.</div>
<div class="ace-line ace-line old-record-id-QZY8daYH5ovlhhxNxMalL7k5gkb">This is first and foremost a <strong>blockchain investigations role</strong> requiring significant hands-on expertise tracing digital assets across complex blockchain ecosystems. The successful candidate must be capable of independently conducting sophisticated on-chain investigations, developing and testing attribution hypotheses, identifying relationships among wallets and entities, following assets through multiple chains and protocols, and translating highly technical blockchain activity into clear investigative findings.</div>
<div class="ace-line ace-line old-record-id-BkixdTjjooiDZQx8njYl2W9zgwd">Blockchain analysis is a specialized investigative discipline. Accordingly, we are seeking someone who understands not only how to operate commercial tracing platforms, but also the <strong>underlying blockchain architecture, transactional mechanics, </strong><strong>attribution</strong><strong> methodologies, clustering techniques, tracing limitations, and evidentiary considerations</strong> necessary to reach reliable conclusions.</div>
<div class="ace-line ace-line old-record-id-ZZi4drdtwoq7StxEyBJlUZrIgvd">The role extends beyond on-chain analysis. The Senior Analyst will combine blockchain intelligence with enterprise data, system logs, transactional records, open-source information, and other evidence to support complex fraud and insider-risk investigations.</div>
<div class="ace-line ace-line old-record-id-In5ndnpyHoNtFPxXapRlhLIcgMf">The position will also provide analytical support to the Global Physical Security Team (PST) on selected protective-intelligence and threat-assessment matters.</div>
<div class="ace-line ace-line old-record-id-LmkPdt3wXoilL2x15i9l4CTXgNc">The Senior Analyst will directly manage <strong>one Analyst</strong> and will be expected to serve as a subject-matter resource for blockchain investigations and analytical methodology across FIT.</div>
<div class="ace-line ace-line old-record-id-LmkPdt3wXoilL2x15i9l4CTXgNc"> </div>
</div>
<div data-page-id="Hs6Qdtvg7ol1iox7YnElHJRCgug" data-lark-html-role="root" data-docx-has-block-data="false">
<h2 class="heading-2 ace-line old-record-id-DsWNdOtE4oq1tyxTyQYlUllWgad"><strong>What You’ll Be Doing</strong></h2>
<h3 class="heading-3 ace-line old-record-id-FjGjdJdyPoqxanxjKaHl48lDgHc"><strong>Blockchain Investigations & Digital-Asset Intelligence</strong></h3>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-AzNidogCUoIDQVxEz7llefCZgVq" data-list="bullet">
<div>Lead and conduct complex <strong>blockchain investigations and transaction tracing</strong> across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems.</div>
</li>
<li class="ace-line ace-line old-record-id-Eyd2dxQoloB7HYxdsMxlThu9gBe" data-list="bullet">
<div>Trace the <strong>origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets</strong>, including activity spanning multiple intermediaries and blockchain environments.</div>
</li>
<li class="ace-line ace-line old-record-id-CjrEd93gpoS3bQxJsQylHSrngpg" data-list="bullet">
<div>Conduct investigations using tools such as <strong>Chainalysis</strong><strong> </strong><strong>Reactor</strong><strong>, TRM Labs, Elliptic, or comparable blockchain intelligence platforms</strong>, while understanding the methodologies and limitations underlying platform-generated attribution.</div>
</li>
<li class="ace-line ace-line old-record-id-FDZddGSGWo4N4gxRokRltHBngFD" data-list="bullet">
<div>Analyze activity involving <strong>centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, </strong><strong>DeFi</strong><strong> protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-BpotdXlJioLdmfxbYr1lgf8wgGc" data-list="bullet">
<div>Trace assets across <strong>multiple chains and cross-chain transactions</strong>, identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible.</div>
</li>
<li class="ace-line ace-line old-record-id-TkW9dXs8ToV55yxsSOdlFEcGgwc" data-list="bullet">
<div>Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators.</div>
</li>
<li class="ace-line ace-line old-record-id-IHQvd5KDxo1uUuxMcnylbvI7gtf" data-list="bullet">
<div>Understand and appropriately apply <strong>wallet-clustering and </strong><strong>attribution</strong><strong> methodologies</strong>, including the limitations and potential for false attribution associated with particular heuristics.</div>
</li>
<li class="ace-line ace-line old-record-id-O5J4dWV3lof9p5x8C6clQ8t9gf3" data-list="bullet">
<div>Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution.</div>
</li>
<li class="ace-line ace-line old-record-id-Kq7qdwZjroWdRWxLe3tl6dxzgee" data-list="bullet">
<div>Corroborate on-chain findings, where appropriate, with <strong>internal account records, </strong><strong>KYC</strong><strong>/</strong><strong>KYB</strong><strong> information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-AnT8dIgspo8Rc1xTCQvlIX8bgpd" data-list="bullet">
<div>Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities.</div>
</li>
<li class="ace-line ace-line old-record-id-MKbRdYwKxoRLcVx01m2llpDJgFe" data-list="bullet">
<div>Reconstruct complex transaction flows and create clear <strong>fund-flow diagrams, transaction maps, timelines, and visualizations</strong> that allow investigators and nontechnical stakeholders to understand the movement of assets.</div>
</li>
<li class="ace-line ace-line old-record-id-JVFod7PObo9tv1xWGxNl9xQBg4v" data-list="bullet">
<div>Analyze blockchain activity associated with suspected <strong>fraud</strong><strong>, theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-TXNmd1PbIonh1SxKwIqlIaBkg1b" data-list="bullet">
<div>Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads.</div>
</li>
<li class="ace-line ace-line old-record-id-K4spdgDhxodZknxYGO6l80fxgtf" data-list="bullet">
<div>Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings.</div>
</li>
<li class="ace-line ace-line old-record-id-Jd2cdsWlnoYbDvxXloClukfXgid" data-list="bullet">
<div>Distinguish between <strong>confirmed </strong><strong>attribution</strong><strong>, vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-PQD3dVKPxo7pE2xXfIZlvzRGgUg" data-list="bullet">
<div>Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct.</div>
</li>
<li class="ace-line ace-line old-record-id-NeeWdUi2IoJgsjx8d4il0hrygOf" data-list="bullet">
<div>Maintain current knowledge of emerging <strong>blockchain technologies, protocols, tracing methodologies, obfuscation techniques, </strong><strong>fraud</strong><strong> typologies, and developments affecting blockchain </strong><strong>attribution</strong><strong> or investigations</strong>.</div>
</li>
</ul>
<h3 class="heading-3 ace-line old-record-id-RYIhdShyho7KsaxPO2MlYI00gez"><strong>Fraud</strong><strong> Investigations & Investigative Intelligence</strong></h3>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-MvTvdl0e8oVkruxSliUlhTk5gfd" data-list="bullet">
<div>Conduct and support investigations involving <strong>internal and external </strong><strong>fraud</strong><strong>, employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-EYP1dmE4ioF81Kxd6IPlslLMgTb" data-list="bullet">
<div>Combine blockchain findings with off-chain evidence to develop a <strong>comprehensive investigative picture rather than treating blockchain activity in isolation</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-AqI9daMIvoQiNXxu8mvlHhoqgOc" data-list="bullet">
<div>Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis.</div>
</li>
<li class="ace-line ace-line old-record-id-X6AYd2fdlokvvpxW6fUl1bo9g2c" data-list="bullet">
<div>Conduct <strong>timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis</strong> across individuals, accounts, wallets, devices, systems, transactions, and entities.</div>
</li>
<li class="ace-line ace-line old-record-id-HE0id8cB0oajCLxNyxJl6wdGgNg" data-list="bullet">
<div>Support investigations involving <strong>account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse</strong>, particularly where a digital-asset, employee, vendor, or enterprise nexus exists.</div>
</li>
<li class="ace-line ace-line old-record-id-QvYedmeqbovsf4xa6KclFb98g3o" data-list="bullet">
<div>Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct.</div>
</li>
<li class="ace-line ace-line old-record-id-OrGZdZ79sogAp4xzCJSlqfoxgUe" data-list="bullet">
<div>Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up.</div>
</li>
</ul>
<h3 class="heading-3 ace-line old-record-id-JnizdMU7joJ0UExPdTYlLxVqgjc"><strong>Enterprise Data & Insider-Risk Analytics</strong></h3>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-Q5edd1cDKoehRMxolIbl6ISBgqL" data-list="bullet">
<div>Analyze appropriately authorized information including <strong>system and access logs, authentication records, audit trails, customer-account activity, </strong><strong>KYC</strong><strong>/</strong><strong>KYB</strong><strong> information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-Z2OAdTWVio35oqx9d3hlBX9DgQc" data-list="bullet">
<div>Correlate blockchain activity with enterprise data to identify possible connections among <strong>wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-IAQfdFUSjoMjEcxcbKulvGS3gSh" data-list="bullet">
<div>Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access.</div>
</li>
<li class="ace-line ace-line old-record-id-NUFRdzCVSobPJhxPzSIlELLRgYf" data-list="bullet">
<div>Identify anomalous behavior or access patterns that may warrant additional investigation.</div>
</li>
<li class="ace-line ace-line old-record-id-SgwbdXMino8hYsxsV9MlK2wegxf" data-list="bullet">
<div>Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems.</div>
</li>
<li class="ace-line ace-line old-record-id-EZsgd5FLVomrRWxDvnElP398gHh" data-list="bullet">
<div>Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets.</div>
</li>
</ul>
<h3 class="heading-3 ace-line old-record-id-N9VpdMhYdoroT6xY6ZglP0cOgqb"><strong>Investigative Reporting & Evidence</strong></h3>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-MzhcdZk13omMrYx5k4elkyqMgPf" data-list="bullet">
<div>Prepare clear, concise, and well-supported <strong>blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-BUX5d6YzcosxHKxgKLTlFVEDg6b" data-list="bullet">
<div>Explain complex blockchain concepts and transaction activity in plain language suitable for <strong>investigators, senior management, Legal, regulators, or </strong><strong>law enforcement</strong>, as appropriate.</div>
</li>
<li class="ace-line ace-line old-record-id-CxSIdlMUmozHCsxZsr7llY2uggd" data-list="bullet">
<div>Clearly distinguish among <strong>allegations, investigative leads, known facts, third-party </strong><strong>attribution</strong><strong>, analytical judgments, assumptions, information gaps, and substantiated conclusions</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-QQbVdbzGPop7HnxvY45l95DqgXb" data-list="bullet">
<div>Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports.</div>
</li>
<li class="ace-line ace-line old-record-id-KSx2dIiggoprUHx84gElwJ8Igjh" data-list="bullet">
<div>Maintain sufficient documentation to allow significant blockchain findings to be <strong>reviewed, reproduced, and understood by another qualified analyst</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-CuMqdIY8qopG3cxioePlmzbugic" data-list="bullet">
<div>Preserve and handle investigative records in accordance with applicable <strong>evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-NFXrdIATEonidXxyaGPlTiSfgrd" data-list="bullet">
<div>Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions.</div>
</li>
</ul>
<h3 class="heading-3 ace-line old-record-id-KOB5degWWoSOlQx2RMWl2K2xgDd"><strong>Protective Intelligence & Physical Security Support</strong></h3>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-C1tKdflGyovbwox6e8LlWDLhgke" data-list="bullet">
<div>Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests.</div>
</li>
<li class="ace-line ace-line old-record-id-H8fDdrQYto0ruVx6G8tlU7uNgEC" data-list="bullet">
<div>Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat.</div>
</li>
<li class="ace-line ace-line old-record-id-CK0OdWRtwo8Ykxxj69ulDaNngxc" data-list="bullet">
<div>Assist in evaluating available information relating to <strong>credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-TOKOdImUqoz3Mxx23whlnwfPgOJ" data-list="bullet">
<div>Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels.</div>
</li>
<li class="ace-line ace-line old-record-id-O9IpdeAnjoHb8ixHs4jls8wWgmh" data-list="bullet">
<div>Support PST’s assessment while preserving <strong>PST’s responsibility for protective-security decisions and operational response</strong>.</div>
</li>
</ul>
<h3 class="heading-3 ace-line old-record-id-Du53dkpyuo408mxPFLeluD3Ogld"><strong>Leadership & Development</strong></h3>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-V9e8dSsWdoyz7exOf02lNJoOgQc" data-list="bullet">
<div>Directly manage and develop one Junior Analyst, including <strong>work allocation, coaching, technical development, quality assurance, and review of analytical work product</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-Ua3pdTngIoUBwixThRClwKOwgDb" data-list="bullet">
<div>Serve as a FIT <strong>subject-matter resource for blockchain investigations and on-chain analytical methodology</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-MSOhdUYGRokQxhxyIBklIAjVg5g" data-list="bullet">
<div>Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support.</div>
</li>
<li class="ace-line ace-line old-record-id-PlSpdMu3WoCgPqxOX2AlB2AYgpe" data-list="bullet">
<div>Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology.</div>
</li>
<li class="ace-line ace-line old-record-id-YGdPdiOiBoktk4xxAmklBPmwgtc" data-list="bullet">
<div>Help establish consistent standards for <strong>blockchain investigations, </strong><strong>attribution</strong><strong>, documentation, quality assurance, and reporting</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-NulPdMTZ6o8Jm2x4p9fllOtOgIb" data-list="bullet">
<div>Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required.</div>
</li>
</ul>
<p> </p>
<h2 class="heading-2 ace-line old-record-id-Etx0dEib6ogvzOxwPDrlvpicgYd"><strong>What We Look For In You</strong></h2>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-MJHSdFNthoCforx5FVnlLWZ7gFr" data-list="bullet">
<div><strong>7+ years of relevant investigative or analytical experience</strong>, with meaningful professional experience specifically conducting <strong>cryptocurrency or blockchain investigations</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-KGrSdqCYCo28dvxtwATlqWH9gRe" data-list="bullet">
<div>Demonstrated hands-on expertise independently conducting <strong>complex blockchain tracing investigations</strong>, rather than solely reviewing blockchain alerts or commercial risk scores.</div>
</li>
<li class="ace-line ace-line old-record-id-Q4jXdiIgIo7b4CxFzall3gY9gfu" data-list="bullet">
<div>Advanced proficiency with one or more blockchain intelligence platforms such as <strong>Chainalysis</strong><strong> </strong><strong>Reactor</strong><strong>, TRM Labs, Elliptic, or comparable technology</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-VvAtdKwsZoNjkEx2a4Ml9kiSgxc" data-list="bullet">
<div>Strong understanding of how blockchain intelligence platforms derive attribution, clustering, exposure, and risk information—and the <strong>limitations associated with those methodologies</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-EcQJdp567ofKQnxx5EGlGVipgOf" data-list="bullet">
<div>Demonstrated understanding of blockchain fundamentals, including <strong>wallets and addresses, transactions, UTXO and account-based models, tokens, smart contracts, block explorers, transaction fees, confirmations, and blockchain-specific transactional structures</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-W5bOdXfmyoN8Q1xPAWclnvCRgBL" data-list="bullet">
<div>Strong understanding of digital-asset ecosystems including <strong>centralized exchanges, self-hosted wallets, </strong><strong>DeFi</strong><strong>, DEXs, stablecoins, cross-chain bridges, mixers, privacy-enhancing mechanisms, and other relevant technologies</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-TD1HdrgBkomZSBxp1EUlS3KQgQb" data-list="bullet">
<div>Demonstrated ability to trace assets across <strong>multiple chains, protocols, and intermediaries</strong> and recognize when technical limitations prevent definitive continuity or attribution.</div>
</li>
<li class="ace-line ace-line old-record-id-GMiRdaiC8oQJs9xlPUTlyX4TgXf" data-list="bullet">
<div>Experience conducting <strong>transaction-graph analysis, wallet </strong><strong>attribution</strong><strong>, clustering, counterparty analysis, transaction-flow reconstruction, and investigative link analysis</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-MDSVd3anZodL73xVkZ4lXYFegLh" data-list="bullet">
<div>Ability to critically assess blockchain attribution and distinguish among <strong>technical facts, commercial vendor intelligence, analytical inference, and unsupported assumptions</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-Mr0tdichpo7nHYxIaKvloZm9gMw" data-list="bullet">
<div>Experience integrating blockchain intelligence with <strong>off-chain evidence and enterprise information</strong> to develop investigative conclusions.</div>
</li>
<li class="ace-line ace-line old-record-id-GGoMd5pfzoPRjwxj6v2lierigee" data-list="bullet">
<div>Strong knowledge of fraud-investigation principles including corroboration, source evaluation, evidence preservation, timeline development, hypothesis testing, and documentation.</div>
</li>
<li class="ace-line ace-line old-record-id-DaVcdkq7koexkMx91Z9limrZgPq" data-list="bullet">
<div>Experience analyzing large or complex datasets and familiarity with tools such as <strong>SQL</strong><strong>, advanced Excel, Python, Splunk, or comparable data-analysis technologies</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-M5lFdENtgoXtvnxkaSQlCTr1g3d" data-list="bullet">
<div>Ability to clearly explain technically complex blockchain findings to audiences that may have little or no blockchain expertise.</div>
</li>
<li class="ace-line ace-line old-record-id-Ndywd0IVXolIIPx3mQolDb9FgXc" data-list="bullet">
<div>Strong investigative writing skills and demonstrated ability to produce accurate, concise, and defensible analytical products.</div>
</li>
<li class="ace-line ace-line old-record-id-XcyFdUPlxoIhEUxK505lzWfBgpc" data-list="bullet">
<div>Sound judgment and ability to work effectively where evidence is incomplete, conflicting, or evolving.</div>
</li>
<li class="ace-line ace-line old-record-id-WTMndqJNMoxTKdx3Ag2l066cgXR" data-list="bullet">
<div>Demonstrated discretion when handling sensitive employee, customer, investigative, security, or company information.</div>
</li>
<li class="ace-line ace-line old-record-id-VTgwduFlAo1CWGxUdtklOoS6g0f" data-list="bullet">
<div>Demonstrated experience mentoring, supervising, or reviewing the work of junior analysts or investigators.</div>
</li>
</ul>
<p> </p>
<h2 class="heading-2 ace-line old-record-id-WwB6dWsqkobPL9xPUkilKF5ZgNc"><strong>Nice to Haves</strong></h2>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-Unc5dN9Y8oWxKGx8hzgln0VqgAb" data-list="bullet">
<div>Experience conducting blockchain investigations within a <strong>cryptocurrency exchange, blockchain analytics company, law-enforcement agency, regulatory organization, financial institution, intelligence function, or investigative consulting environment</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-HdAAdY7b7ofJ50xoAk7luF2kgSd" data-list="bullet">
<div>Experience investigating digital-asset matters involving <strong>fraud</strong><strong> proceeds, theft, account compromise, insider activity, social engineering, asset tracing, or complex cross-chain movement</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-Jd4hdukQboUXgCxsDg0lX422gZE" data-list="bullet">
<div>Experience supporting <strong>asset recovery, law-enforcement referrals, subpoenas/legal process, civil litigation, regulatory inquiries, or other matters requiring defensible blockchain analysis</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-D1cTdBQYtoWOY6xqlAClQ7lygX4" data-list="bullet">
<div>Experience investigating insider threats, employee misconduct, unauthorized access, data exfiltration, credential compromise, vendor fraud, conflicts of interest, or trusted-party abuse.</div>
</li>
<li class="ace-line ace-line old-record-id-Tsa6d9i2zoEsPFxotUllEJF5gMd" data-list="bullet">
<div>Experience with <strong>OSINT, digital forensics, enterprise logs, security telemetry, or identity and access-management information</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-Bl7fdi16Go2JyKxbp8alTNorg9f" data-list="bullet">
<div>Experience creating custom blockchain analytics through <strong>APIs, </strong><strong>SQL</strong><strong>, Python, blockchain explorers, node data, or other raw-data sources</strong>, rather than relying exclusively on commercial graphical interfaces.</div>
</li>
<li class="ace-line ace-line old-record-id-UlM4dgNrforA2GxM1Wllb94Jg9c" data-list="bullet">
<div>Relevant blockchain-specific training or certifications, including certifications associated with <strong>Chainalysis</strong><strong>, TRM Labs, or comparable blockchain-analysis platforms</strong>.</div>
</li>
<li class="ace-line ace-line old-record-id-UeKkd4y75orEAtx8XOzld7S1gwM" data-list="bullet">
<div>Professional certifications such as <strong>CFE, CFCS, CAMS, GIAC, or comparable investigative, </strong><strong>fraud</strong><strong>, financial-crime, cybersecurity, or intelligence credentials</strong>.</div>
</li>
</ul>
<p> </p>
<h2 class="heading-2 ace-line old-record-id-A90jdVaYVoBIybxFqTLlZkbagPd"><strong>What Success Looks Like</strong></h2>
<div class="ace-line ace-line old-record-id-UH4odIgUaoZ1CjxmsJ2l7F2BgKc">Success in this role requires significantly more than knowing how to enter an address into a blockchain analytics platform.</div>
<div class="ace-line ace-line old-record-id-VeC5dIdUvoXEKuxn99kl47nFgEd">The successful candidate should be able to receive a complex transaction, wallet, allegation, or investigative question and independently determine <strong>how to trace the activity, which chains and protocols are involved, what the available data establishes, what additional information is needed, what </strong><strong>attribution</strong><strong> can reasonably be made, and where the technical or evidentiary limitations prevent a definitive conclusion</strong>.</div>
<div class="ace-line ace-line old-record-id-JjVedMMI3oXBNmxWaeplMDlYghd">The individual should be able to move seamlessly between <strong>on-chain and off-chain evidence</strong>, recognizing that a blockchain transaction may establish movement of assets without necessarily establishing the identity, knowledge, intent, or conduct of the person behind a wallet.</div>
<div class="ace-line ace-line old-record-id-CtVPdRXh9oIUJlxL79BlD3mCglh">They should also be capable of converting a highly technical blockchain investigation into a concise and defensible explanation that an investigator, attorney, executive, regulator, or law-enforcement partner can understand and act upon.</div>
<div class="ace-line ace-line old-record-id-ZYJ2dbpFlog2XixcEXllXfSJg3d">At the same time, this person must be sufficiently versatile to apply the same investigative discipline to <strong>internal </strong><strong>fraud</strong><strong>, insider risk, enterprise data, third-party misconduct, and protective-intelligence matters</strong> when required.</div>
<div class="ace-line ace-line old-record-id-DBTdd8hrvo9cR9xcgiDlHk5agdb">The hierarchy is much clearer this way: <strong>blockchain investigations are the specialized core competency; </strong><strong>fraud</strong><strong>/investigative intelligence is the broader mission; enterprise analytics and PST support are complementary capabilities.</strong> That should materially improve the candidate pool versus a title that makes blockchain expertise appear interchangeable with general data analytics.</div>
</div>
<h2 class="ace-line ace-line old-record-id-ICVNdKGbzoyJvjx3MkouO6E4sSb"><span style="font-size: 18pt;"><strong><br>OKX Statement:</strong></span></h2>
<div class="ace-line ace-line old-record-id-I3fmdZuJFoTBq5x36pAufcDSstf">OKX is committed to equal employment opportunities regardless of race, color, genetic information, creed, religion, sex, sexual orientation, gender identity, lawful alien status, national origin, age, marital status, and non-job related physical or mental disability, or protected veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.</div>
<div class="ace-line ace-line old-record-id-BTzbdHPT4oLKUgxn32luBDXHsLb"> </div>
<ul class="list-bullet1">
<li class="ace-line ace-line old-record-id-VQLRdGn0XoVOLTx4jG6uxTLfsyc" data-list="bullet">
<div>The salary range for this position is $143,000 - $214,000</div>
</li>
<li class="ace-line ace-line old-record-id-doxusmlMoCSm31HSRuqUGUssOLg" data-list="bullet">
<div>The salary offered depends on a variety of factors, including job-related knowledge, skills, experience, and market location. In addition to the salary, a performance bonus and long-term incentives may be provided as part of the compensation package, as well as a full range of medical, financial, and/or other benefits, dependent on the position offered. Applicants should apply via OKX internal or external careers site.</div>
</li>
</ul>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div><div class="content-conclusion"><div data-lark-html-role="root"><span class="text-only" data-eleid="18"><span class="text-only"><span class="text-only" data-eleid="6">Notice:<br></span></span></span>
<div data-lark-html-role="root"><span class="text-only" data-eleid="26"><span class="text-only">All official </span><span class="text-only text-with-abbreviation text-with-abbreviation-bottomline">OKX</span><span class="text-only"> vacancies are published on this website.</span></span> <span class="text-only" data-eleid="28"><span class="text-only">While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. </span></span><strong><span class="text-only" data-eleid="29"><span class="text-only">If in doubt, please apply directly through our official careers website.</span></span></strong></div>
</div>
<div data-lark-html-role="root"><span class="text-only" data-eleid="18"><span class="text-only">Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to </span><span class="text-only text-with-abbreviation text-with-abbreviation-bottomline">OKX</span><span class="text-only">'s </span></span><a class="link rich-text-anchor __anchor-intercept-flag__ text-content-link" href="https://www.okx.com/en-eu/help/okx-candidate-privacy-notice" target="_blank" data-eleid="19" data-lark-is-custom="true" data-lark-link="true">