Threat Researcher

™

Responsibilities:

• Monitor and analyze dark web forums, marketplaces, Telegram channels, and leak sites using CyberInt and other OSINT/darknet tools
• Identify and assess:
• Leaked credentials and sensitive data
• Phishing domains and impersonation sites
• Threat actor discussions mentioning client brands or environments
• Sale of access by Initial Access Brokers (IABs)
• Track emerging threat actor TTPs, malware families, ransomware groups, and underground ecosystem trends
• Correlate dark web findings with client infrastructure and attack surface to assess risk and exposure
• Develop threat hunting queries (e.g., using SIEM/EDR platforms) based on dark web discoveries to determine active targeting or compromise
• Create concise, actionable intelligence reports to communicate risks to internal and client stakeholders
• Assist in incident enrichment, providing dark web context and attribution to ongoing investigations or IR cases
• Stay current on major malware and ransomware variants, and support attribution or profiling work when actors reference client asset
  

Requirements:

• 3+ years of experience in threat intelligence, dark web research, or cybercrime investigations
• Hands-on experience with CyberInt or similar dark web intelligence platforms (e.g., Flashpoint, Cybersixgill, KELA, Recorded Future)
• Strong OSINT skills and familiarity with darknet environments and tradecraft
• Understanding of malware families, ransomware operations, and threat actor group dynamics
• Experience with brand protection monitoring, phishing detection, and social media threat analysis
• Ability to write clear, intelligence-driven reports for technical and executive audiences
• Familiarity with attack surface management and common enterprise exposure risk
  

Preferred Qualifications:

• Experience tracking Initial Access Brokers (IABs) and ransomware affiliates
• Knowledge of security risks specific to healthcare, education, and financial sectors
• Basic scripting or automation skills (Python, Regex, etc.) for hunting or parsing data
• Experience writing threat hunting queries (e.g., Splunk, Elastic, Sigma rules)
• Previous consulting or client-facing experience in intelligence reporting or briefings