What the work looks like
You turn what our researchers find into advice a small organisation can act on. After a run of fake-invoice emails aimed at nonprofits, for example, you work out which controls would have stopped them: calling back before paying a new bank account, email authentication, two people approving payments. You estimate what each costs a small office in time and money, decide what to do first, check it against NIST CSF or CIS Controls, and write it up as a one-page brief an office manager could follow.
What you’ll do
- Identify the control that would have stopped each scam pattern
- Estimate what that control costs a small organisation
- Map findings to a recognised framework internally
- Write plain-language risk briefs for non-specialists
- Spend about 20–30 minutes a day reviewing incoming reports with the rest of the team, and flag promising leads to your team lead.
What you’ll bring
- Interest in governance, risk and compliance (NIST CSF, CIS Controls or similar)
- The ability to explain security to people who aren't technical
What you’ll get
- Published work with your name on it
- Hands-on time with real investigation tooling and data
- A path to running your own investigations