This role: You will research and analyze underground sources such as forums, shops, marketplaces, and secure communication channels. You will also help identify sources, maintain persistence on those sources, and interact with threat actors to obtain information not publicly available. You will be engaged in both proactive research and in responding to requests from clients related to the dark web.

What you’ll do as a Threat Intelligence Analyst:

• Research, track, and author finished intelligence reports on cybercriminal threat actors, tools, sources, and campaigns
• Support finished intelligence products for Recorded Future Analyst on Demand clients 
• Identify and report proactive threat leads on new and emerging threats
• Assist with sourcing, collecting, and curating new data into the Recorded Future Platform
• Create and maintain access to underground sources of relevance
• Propose and oversee proactive reporting topics on cybercriminal-related TTPs and trends for internal and public consumption

What you’ll bring to the Threat Intelligence Analyst role (required):

• Knowledge and experience with analytic tradecraft, the intelligence cycle, open-source intelligence gathering techniques, and strong intelligence writing skills, techniques, and methodologies
• 4+ years of professional experience in roles in cyber intelligence, cybersecurity more broadly, cyber investigations, or other related disciplines
• Demonstrated experience operating on underground/deep web sources (forums, marketplaces, and shops) and other mediums of communications
• Knowledge of the structure and trends within the underground economy and landscape: common communications vectors, source locations, operations security considerations, etc.
• Experience with handling or transacting in cryptocurrencies
• Knowledge of and ability to conduct blockchain and cryptocurrency investigations
• Knowledge of money laundering, fraud, and current cyber crime TTPs
• Ability to work collaboratively with others in a globally distributed environment

Additional skills/experience (preferred but not required):

• Foreign language proficiency: preference for Russian, Chinese, Spanish, Portuguese, German, Dutch, French, Turkish, Romanian, or Southeast Asian languages
• BA/BS or MA/MS degree or equivalent experience in Computer Science, International Relations, Security Studies, Regional Studies, or a related discipline
• Knowledge or understanding of the links and relationships between cybercriminal, hacktivist, extremist, and nation-state operations and organizations
• Knowledge of hacktivist trends and activities

#LI-Remote