Intelligence Analyst II, Buyer Threat Intelligence Unit

Amazon • Seattle, WA

4d • $82,700 - $129,800 • Onsite

About The Position

The Buyer Fraud Intelligence Unit (BFIU) within PRISM SWAT is seeking a Threat Intelligence Analyst to lead a net-new intelligence function within Buyer Risk Prevention (BRP). This role is responsible for proactively identifying, analyzing, and disrupting emerging buyer-related threats to Amazon through systematic intelligence gathering across dark web marketplaces, encrypted channels, and fraud-as-a-service platforms. You will establish investigation methodology, tradecraft standards, and tooling workflows while also delivering actionable intelligence that feeds directly into detection rules, ML model retraining, and Legal referrals. This position is open to both internal and external candidates. Internal candidates with strong fraud investigation foundations and a willingness to develop specialized tradecraft are encouraged to apply.

Requirements

• Experience handling confidential information
• Experience establishing successful partnerships with internal and external teams to execute tactical initiatives or equivalent
• Proficiency with OSINT methodologies and investigative research techniques
• Knowledge of fraud ecosystems: carding, account takeover (ATO), synthetic identity fraud, refund abuse, phishing, or fraud-as-a-service models
• Familiarity with payment systems, e-commerce fraud vectors, or chargeback patterns
• Ability to operate with discretion and sound judgment when handling sensitive information
• 5+ years of experience in one or more of the following: cyber threat intelligence, fraud investigations, risk analysis, or cybercrime research

Nice To Haves

• Experience navigating and collecting intelligence from dark web marketplaces, underground forums, and encrypted communication channels
• Operational security (OPSEC) expertise — persona management, attribution avoidance, and safe browsing practices in adversarial environments
• Experience with threat intelligence frameworks (MITRE ATT&CK)
• SANS certifications: FOR578 (Cyber Threat Intelligence), SEC487 (OSINT Gathering and Analysis), or equivalent
• Experience with intelligence platforms: Flashpoint, Recorded Future, Maltego Enterprise
• Established relationships with law enforcement agencies or intelligence-sharing communities (e.g., FS-ISAC)
• Experience building or contributing to a threat intelligence function
• Background in producing court-ready evidence or supporting legal/enforcement proceedings
• Experience integrating threat intelligence into ML pipelines or automated detection systems
• Experience with link analysis tools for visual investigation and relationship mapping

Responsibilities

• Monitor and analyze dark web marketplaces, carding forums, private Telegram channels, Discord servers, and paste sites for Amazon-specific exploitation techniques and emerging fraud modus operandi.
• Identify, profile, and track threat actors, fraud-as-a-service providers, and organized fraud rings targeting Amazon's buyer ecosystem.
• Produce at least one comprehensive fraud modus operandi investigation report per month for Legal, including threat actor attribution, technical indicators, and estimated business impact.
• Establish and maintain investigation methodology, operational security standards, and tooling workflows for the BFIU team.
• Serve as team lead, mentoring fellow analysts, and building toward independent investigation capability across the team.
• Partner with ML, Risk Mining, Engineering, Legal, and Law Enforcement teams to operationalize intelligence findings into detection rules, model features, and enforcement actions.
• Establish and maintain referral pathways with CPE, SPI-External Enforcement, and external law enforcement agencies.
• Issue real-time alerts when active exploitation campaigns targeting Amazon buyers are detected, enabling immediate defensive response.
• Drive adoption and optimization of intelligence platforms (Flashpoint, Maltego) and build custom collection scripts and enrichment pipelines.

Benefits

• health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage)
• 401(k) matching
• paid time off
• parental leave
• sign-on payments
• restricted stock units (RSUs)

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed