Remote Employee Moonlighting Investigation: Secretly Working Two Full-Time Jobs

Background

A software company noticed a senior developer's productivity had dropped over 6 months. Code commit patterns showed concentrated bursts of activity rather than sustained engagement. The company requested a public-source and client-log review for internal security context.

Investigation Methodology

1. LinkedIn Analysis: We examined the employee's LinkedIn profile for subtle indicators — new connections at other companies, skill endorsements from unknown colleagues, and profile update patterns.
2. GitHub Activity Mapping: The employee's public GitHub contributions were analyzed for commit timing patterns that might indicate work for another organization.
3. Digital Presence Correlation: Conference registrations, Slack community memberships, and technical blog posts were analyzed for affiliations beyond the client company.

Key Findings

• The employee's LinkedIn showed 14 new connections at a competing company, all added within a 2-month window 8 months prior.
• GitHub commit analysis revealed two distinct daily activity patterns: coding for the client company in the mornings and a different project with corporate-style commit messages in the afternoons/evenings.
• A technical blog post authored by the employee referenced tools and methodologies specific to the competing company's tech stack.

Outcome

The customer routed the evidence package through counsel and its internal HR process. TraxIntel's output stayed limited to public-source and client-provided context. Total investigation time: 2 weeks.