Senior Fraud Risk Manager

ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- body ace-line old-record-id- ace-line old-record-id- ace-line old-record-id- Who We Are

ace-line old-record-id- At OKX, we believe the future will be reshaped by crypto and blockchain technology. We operate a leading global crypto platform and build products and services designed to expand access to the digital-asset ecosystem.

ace-line old-record-id- Across our global organization, we value ownership, sound judgment, collaboration, innovation, and the ability to operate effectively in a fast-moving and continuously evolving environment.

ace-line old-record-id- Recruiting should insert the current approved OKX em corporate “Who We Are” language when the position is posted.

ace-line old-record-id-

ace-line old-record-id- About the Team

ace-line old-record-id- The Fraud Investigations Team (FIT) is a First Line of Defense function within OKX’s Risk organization responsible for identifying, assessing, investigating, and helping manage significant internal and external fraud risks affecting the company, its customers, personnel, and operations.

ace-line old-record-id- FIT conducts and supports complex investigations involving digital assets, internal and external fraud, employee misconduct, insider threats, unauthorized access or misuse of information, vendor and third-party misconduct, account compromise, social engineering, collusion, conflicts of interest, and other significant fraud-related matters.

ace-line old-record-id- The team works closely with Legal,, Information Security,Engineering, Physical Security, Compliance, Finance, Operations, and other functions across OKX.

ace-line old-record-id-

ace-line old-record-id- About the Opportunity

ace-line old-record-id- We are looking for an experienced Senior Analyst, Blockchain Investigations and Fraud Intelligence to join FIT.

ace-line old-record-id- This is first and foremost a strong blockchain investigations role requiring significant hands-on expertise tracing digital assets across complex blockchain ecosystems. The successful candidate must be capable of independently conducting sophisticated on-chain investigations, developing and testing attribution hypotheses, identifying relationships among wallets and entities, following assets through multiple chains and protocols, and translating highly technical blockchain activity into clear investigative findings.

ace-line old-record-id- Blockchain analysis is a specialized investigative discipline. Accordingly, we are seeking someone who understands not only how to operate commercial tracing platforms, but also the strong underlying blockchain architecture, transactional mechanics, strong attribution strong methodologies, clustering techniques, tracing limitations, and evidentiary considerations necessary to reach reliable conclusions.

ace-line old-record-id- The role extends beyond on-chain analysis. The Senior Analyst will combine blockchain intelligence with enterprise data, system logs, transactional records, open-source information, and other evidence to support complex fraud and insider-risk investigations.

ace-line old-record-id- The position will also provide analytical support to the Global Physical Security Team (PST) on selected protective-intelligence and threat-assessment matters.

ace-line old-record-id- The Senior Analyst will directly manage strong one Analyst and will be expected to serve as a subject-matter resource for blockchain investigations and analytical methodology across FIT.

ace-line old-record-id-

ace-line old-record-id- What You’ll Be Doing

ace-line old-record-id- Blockchain Investigations and Digital-Asset Intelligence

ace-line old-record-id- Lead and conduct complex strong blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems.

ace-line old-record-id- Trace the strong origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets, including activity spanning multiple intermediaries and blockchain environments.

ace-line old-record-id- Conduct investigations using tools such as Chainalysis strong Reactor strong, TRM Labs, Elliptic, or comparable blockchain intelligence platforms, while understanding the methodologies and limitations underlying platform-generated attribution.

ace-line old-record-id- Analyze activity involving strong centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi strong protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems.

ace-line old-record-id- Trace assets across strong multiple chains and cross-chain transactions, identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible.

ace-line old-record-id- Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators.

ace-line old-record-id- Understand and appropriately apply strong wallet-clustering and strong attribution strong methodologies, including the limitations and potential for false attribution associated with particular heuristics.

ace-line old-record-id- Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution.

ace-line old-record-id- Corroborate on-chain findings, where appropriate, with strong internal account records, KYC strong / KYB strong information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence.

ace-line old-record-id- Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities.

ace-line old-record-id- Reconstruct complex transaction flows and create clear strong fund-flow diagrams, transaction maps, timelines, and visualizations that allow investigators and nontechnical stakeholders to understand the movement of assets.

ace-line old-record-id- Analyze blockchain activity associated with suspected strong fraud strong, theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct.

ace-line old-record-id- Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads.

ace-line old-record-id- Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings.

ace-line old-record-id- Distinguish between strong confirmed strong attribution strong, vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis.

ace-line old-record-id- Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct.

ace-line old-record-id- Maintain current knowledge of emerging strong blockchain technologies, protocols, tracing methodologies, obfuscation techniques, strong fraud strong typologies, and developments affecting blockchain strong attribution strong or investigations.

ace-line old-record-id- Fraud Investigations and Investigative Intelligence

ace-line old-record-id- Conduct and support investigations involving strong internal and external strong fraud strong, employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks.

ace-line old-record-id- Combine blockchain findings with off-chain evidence to develop a strong comprehensive investigative picture rather than treating blockchain activity in isolation.

ace-line old-record-id- Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis.

ace-line old-record-id- Conduct strong timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities.

ace-line old-record-id- Support investigations involving strong account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse, particularly where a digital-asset, employee, vendor, or enterprise nexus exists.

ace-line old-record-id- Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct.

ace-line old-record-id- Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up.

ace-line old-record-id- Enterprise Data and Insider-Risk Analytics

ace-line old-record-id- Analyze appropriately authorized information including strong system and access logs, authentication records, audit trails, customer-account activity, KYC strong / KYB strong information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry.

ace-line old-record-id- Correlate blockchain activity with enterprise data to identify possible connections among strong wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities.

ace-line old-record-id- Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access.

ace-line old-record-id-NUFRdzCVSobPJhxPzSIlELLRgYf Identify anomalous behavior or access patterns that may warrant additional investigation.

ace-line old-record-id- Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems.

ace-line old-record-id- Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets.

ace-line old-record-id- Investigative Reporting and Evidence

ace-line old-record-id- Prepare clear, concise, and well-supported strong blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products.

ace-line old-record-id- Explain complex blockchain concepts and transaction activity in plain language suitable for strong investigators, senior management, Legal, regulators, or strong law enforcement, as appropriate.

ace-line old-record-id- Clearly distinguish among strong allegations, investigative leads, known facts, third-party strong attribution strong, analytical judgments, assumptions, information gaps, and substantiated conclusions.

ace-line old-record-id- Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports.

ace-line old-record-id- Maintain sufficient documentation to allow significant blockchain findings to be strong reviewed, reproduced, and understood by another qualified analyst.

ace-line old-record-id- Preserve and handle investigative records in accordance with applicable strong evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements.

ace-line old-record-id-NFXrdIATEonidXxyaGPlTiSfgrd Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions.

ace-line old-record-id- Protective Intelligence and Physical Security Support

ace-line old-record-id- Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests.

ace-line old-record-id- Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat.

ace-line old-record-id- Assist in evaluating available information relating to strong credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators.

ace-line old-record-id- Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels.

ace-line old-record-id- Support PST’s assessment while preserving PST’s responsibility for protective-security decisions and operational response.

ace-line old-record-id- Leadership and Development

ace-line old-record-id- Directly manage and develop one Junior Analyst, including strong work allocation, coaching, technical development, quality assurance, and review of analytical work product.

ace-line old-record-id- Serve as a FIT strong subject-matter resource for blockchain investigations and on-chain analytical methodology.

ace-line old-record-id- Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support.

ace-line old-record-id- Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology.

ace-line old-record-id- Help establish consistent standards for strong blockchain investigations, strong attribution strong, documentation, quality assurance, and reporting.

ace-line old-record-id- Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required.

ace-line old-record-id- What We Look For In You

ace-line old-record-id- strong 7+ years of relevant investigative or analytical experience, with meaningful professional experience specifically conducting strong cryptocurrency or blockchain investigations.

ace-line old-record-id- Demonstrated hands-on expertise independently conducting strong complex blockchain tracing investigations, rather than solely reviewing blockchain alerts or commercial risk scores.

ace-line old-record-id- Advanced proficiency with one or more blockchain intelligence platforms such as Chainalysis strong Reactor strong, TRM Labs, Elliptic, or comparable technology.

ace-line old-record-id- Strong understanding of how blockchain intelligence platforms derive attribution, clustering, exposure, and risk information, and the strong limitations associated with those methodologies.

ace-line old-record-id- Demonstrated understanding of blockchain fundamentals, including strong wallets and addresses, transactions, UTXO and account-based models, tokens, smart contracts, block explorers, transaction fees, confirmations, and blockchain-specific transactional structures.

ace-line old-record-id- Strong understanding of digital-asset ecosystems including strong centralized exchanges, self-hosted wallets, DeFi strong, DEXs, stablecoins, cross-chain bridges, mixers, privacy-enhancing mechanisms, and other relevant technologies.

ace-line old-record-id- Demonstrated ability to trace assets across strong multiple chains, protocols, and intermediaries and recognize when technical limitations prevent definitive continuity or attribution.

ace-line old-record-id- Experience conducting strong transaction-graph analysis, wallet strong attribution strong, clustering, counterparty analysis, transaction-flow reconstruction, and investigative link analysis.

ace-line old-record-id- Ability to critically assess blockchain attribution and distinguish among strong technical facts, commercial vendor intelligence, analytical inference, and unsupported assumptions.

ace-line old-record-id- Experience integrating blockchain intelligence with strong off-chain evidence and enterprise information to develop investigative conclusions.

ace-line old-record-id- Strong knowledge of fraud-investigation principles including corroboration, source evaluation, evidence preservation, timeline development, hypothesis testing, and documentation.

ace-line old-record-id- Experience analyzing large or complex datasets and familiarity with tools such as SQL strong, advanced Excel, Python, Splunk, or comparable data-analysis technologies.

ace-line old-record-id- Ability to clearly explain technically complex blockchain findings to audiences that may have little or no blockchain expertise.

ace-line old-record-id- Strong investigative writing skills and demonstrated ability to produce accurate, concise, and defensible analytical products.

ace-line old-record-id- Sound judgment and ability to work effectively where evidence is incomplete, conflicting, or evolving.

ace-line old-record-id- Demonstrated discretion when handling sensitive employee, customer, investigative, security, or company information.

ace-line old-record-id- Demonstrated experience mentoring, supervising, or reviewing the work of junior analysts or investigators.

ace-line old-record-id- Nice to Haves

ace-line old-record-id- Experience conducting blockchain investigations within a strong cryptocurrency exchange, blockchain analytics company, law-enforcement agency, regulatory organization, financial institution, intelligence function, or investigative consulting environment.

ace-line old-record-id- Experience investigating digital-asset matters involving strong fraud strong proceeds, theft, account compromise, insider activity, social engineering, asset tracing, or complex cross-chain movement.

ace-line old-record-id- Experience supporting strong asset recovery, law-enforcement referrals, subpoenas/legal process, civil litigation, regulatory inquiries, or other matters requiring defensible blockchain analysis.

ace-line old-record-id- Experience investigating insider threats, employee misconduct, unauthorized access, data exfiltration, credential compromise, vendor fraud, conflicts of interest, or trusted-party abuse.

ace-line old-record-id- Experience with OSINT, digital forensics, enterprise logs, security telemetry, or identity and access-management information.

ace-line old-record-id- Experience creating custom blockchain analytics through APIs, SQL strong, Python, blockchain explorers, node data, or other raw-data sources, rather than relying exclusively on commercial graphical interfaces.

ace-line old-record-id- Relevant blockchain-specific training or certifications, including certifications associated with Chainalysis strong, TRM Labs, or comparable blockchain-analysis platforms.

ace-line old-record-id- Professional certifications such as CFE, CFCS, CAMS, GIAC, or comparable investigative, strong fraud strong, financial-crime, cybersecurity, or intelligence credentials.

ace-line old-record-id- What Success Looks Like

ace-line old-record-id- Success in this role requires significantly more than knowing how to enter an address into a blockchain analytics platform.

ace-line old-record-id- The successful candidate should be able to receive a complex transaction, wallet, allegation, or investigative question and independently determine strong how to trace the activity, which chains and protocols are involved, what the available data establishes, what additional information is needed, what strong attribution strong can reasonably be made, and where the technical or evidentiary limitations prevent a definitive conclusion.

ace-line old-record-id- The individual should be able to move seamlessly between strong on-chain and off-chain evidence, recognizing that a blockchain transaction may establish movement of assets without necessarily establishing the identity, knowledge, intent, or conduct of the person behind a wallet.

ace-line old-record-id- They should also be capable of converting a highly technical blockchain investigation into a concise and defensible explanation that an investigator, attorney, executive, regulator, or law-enforcement partner can understand and act upon.

ace-line old-record-id- At the same time, this person must be sufficiently versatile to apply the same investigative discipline to strong internal strong fraud strong, insider risk, enterprise data, third-party misconduct, and protective-intelligence matters when required.

ace-line old-record-id- The hierarchy is much clearer this way: strong blockchain investigations are the specialized core competency; strong fraud strong /investigative intelligence is the broader mission; enterprise analytics and PST support are complementary capabilities. That should materially improve the candidate pool versus a title that makes blockchain expertise appear interchangeable with general data analytics.

ace-line old-record-id- span 18pt; OKX Statement:

ace-line old-record-id- OKX is committed to equal employment opportunities regardless of race, color, genetic information, creed, religion, sex, sexual orientation, gender identity, lawful alien status, national origin, age, marital status, and non-job related physical or mental disability, or protected veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

ace-line old-record-id-

ace-line old-record-id- The salary range for this position is $143,000 - $214,000

ace-line old-record-id- The salary offered depends on a variety of factors, including job-related knowledge, skills, experience, and market location. In addition to the salary, a performance bonus and long-term incentives may be provided as part of the compensation package, as well as a full range of medical, financial, and/or other benefits, dependent on the position offered. Applicants should apply via OKX internal or external careers site.

span span span Notice:
span span All official span text-with-abbreviation text-with-abbreviation-bottomline OKX span vacancies are published on this website. span span While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. strong span span If in doubt, please apply directly through our official careers website.

span span Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to span text-with-abbreviation text-with-abbreviation-bottomline OKX span s a rich-text-anchor __anchor-intercept-flag__ text-content-link Candidate Privacy Notice span span.