Senior Software Engineer: Ransomware Collections

Recorded Future•Washington, DC

1d•$129,000 - $193,500

About The Position

Recorded Future is seeking a Senior Engineer to advance its ransomware collection capabilities. The role focuses on improving the depth, reliability, coverage, timeliness, and intelligence value of existing collections while expanding beyond conventional threat-actor sites into the infrastructure, identities, communities, and relationships surrounding ransomware activity. The engineer will work closely with ransomware analysts and the broader collections organization, translating intelligence needs and investigative questions into scalable collection capabilities that deliver information beyond what is readily available through open-source ransomware monitoring. The work spans cloud infrastructure, distributed collection services, browser automation, and specialized network environments. The role includes developing automated access strategies for difficult-to-collect sources, building infrastructure to discover and preserve intelligence at scale, and making collection systems more resilient and maintainable. The engineer will help move new sources and methods from experimentation into production, ensure collected data supports downstream intelligence, and provide technical leadership and mentorship within the collections organization. Success means enabling analysts to access relevant information earlier, understand threat-actor claims in greater context, and gather stronger evidence about relationships among actors, infrastructure, identities, and ransomware operations. The engineer will help the organization adapt as ransomware actors change platforms, access controls, infrastructure, and operating practices.

Requirements

Strong collection engineering experience.
Understanding of how technical collection decisions translate into higher-confidence intelligence for analysts and customers.
Comfort learning and operating across cloud infrastructure, distributed collection services, browser automation, and specialized network environments.
Experience building reliable systems against unstable or intentionally difficult-to-automate sources is particularly valuable.

Nice To Haves

Experience with Python, Go, or JavaScript/TypeScript.
Familiarity with AWS, Docker, Kubernetes, and Terraform.
Familiarity with S3, PostgreSQL, Redis, and distributed caching or storage systems.
Experience with HTTP-based collectors, browser automation, headless browsers, Playwright/Selenium-style tooling, and authenticated session management.
Familiarity with TOR, proxies, SOCKS, VPNs, distributed egress, or specialized collection infrastructure.
Experience with queue- and event-driven processing architectures.
Familiarity with GitHub, CI/CD pipelines, automated testing, observability, and production monitoring.
Knowledge of dark-web and restricted-source collection, ransomware infrastructure, identity and entity resolution, or adversarial web environments.

Responsibilities

Own and improve engineering capabilities supporting ransomware collection, emphasizing reliability, coverage, timeliness, and intelligence value.
Expand ransomware collection beyond leak sites and conventional sources through user-focused approaches that improve visibility into relevant actors and communities.
Partner with ransomware analysts to translate intelligence requirements and investigative questions into scalable technical collection capabilities.
Develop and refine automated access strategies for ransomware-related sources, including sources with authentication requirements, anti-automation controls, or changing infrastructure.
Build infrastructure to discover, access, monitor, and preserve difficult-to-collect ransomware intelligence at scale.
Improve the resilience and maintainability of ransomware collection systems while reducing manual intervention and operational overhead.
Establish engineering patterns for moving new ransomware sources and collection methodologies from experimentation into production.
Collaborate across engineering, collections, and analysis teams to structure and deliver collected data for downstream intelligence use.
Provide technical leadership and mentorship, helping establish engineering standards and long-term architectural direction.