Applied Cyber, Detections

About Doppel

Doppel is building the future of social engineering defense. Our AI-native platform uses agentic AI to protect executives, employees, customers, and brands from phishing, impersonation, fraud, and other AI-powered threats across digital channels. We help some of the world’s most recognized brands detect and dismantle attacker infrastructure while strengthening employee resilience through threat-informed training and simulation. By unifying Digital Risk Protection, Human Risk Management and Email Security, Doppel connects threats into a real-time intelligence graph to power faster disruption, smarter defense, and modern security awareness at scale.

Backed by leading investors including Andreessen Horowitz and Bessemer Venture Partners, and trusted by leading enterprises, Doppel is a rapidly growing Series C startup building the future of social engineering defense. Our team combines deep cybersecurity expertise, operational rigor, and startup velocity to solve some of the internet’s most urgent trust and safety challenges.

The Role

At Doppel, we focus on building a culture where people feel respected, supported, and trusted to do meaningful work. We value clarity, collaboration, and solving real problems for our customers and teammates.

We are looking for an Architect, Applied Cyber, Detections to improve detection workflows, conduct ad hoc OSINT investigations, and support key customer implementations. You will optimize intelligence sourcing and brand abuse detection capabilities, partner with Product and Engineering teams, and help drive scalable platform improvements.

What You Will Do

Support post sales detection operations for customers by translating risk, brand abuse, and phishing use cases into effective and scalable detection coverage across website domains, SOCMINT, and other related surface areas.

Conduct onboarding, detection logic implementation, and sourcing workflows for select customers.

Build, refine, and validate platform automation logic using proprietary frameworks to support alert triaging and movements.

Investigate and conduct root cause analyses (RCAs) for missed detections, false positives, false negatives, improper alert movements, and low volume customers.

Work alongside Customer Success Managers (CSMs), Account Executives (AEs), and Technical Account Managers (TAMs) to support ad hoc detection requests and platform configurations.

Collaborate cross functionally with Engineering, Product, and other Solutions Architecture teams to surface platform limitations, share detection findings, and contribute ideas for process improvements.

Stay up to date with trends, patterns, and evolving TTPs related to agentic phishing, credential theft, recruitment scams, social media impersonation, disinformation, and paid ads abuse.

What We Are Looking For

3+ years of experience in OSINT investigations, threat intelligence, or detections engineering.

1+ years of experience conducting SOCMINT investigations.

Experience using URL intelligence platforms and constructing complex queries (for example, URLScan, VirusTotal, or Spamhaus).

Demonstrated knowledge of common phishing and credential theft TTPs.

Demonstrated knowledge of common social media, paid ad, and SERP abuse patterns.

Strong ability to support ad hoc customer requests and collaborate in cross functional discussions with Product and Engineering teams.

Excellent written and verbal communication skills in English.

Nice to Have

A degree in cybersecurity, information assurance, intelligence studies, or data analytics.