Senior Software Engineer: Ransomware Collections

Recorded Future•Boston, MA

20h•$129,000 - $193,500

About The Position

Recorded Future is seeking a Senior Engineer to advance its ransomware collection capabilities. The role focuses on improving the depth, reliability, coverage, timeliness, and intelligence value of existing collections, while expanding beyond conventional threat-actor sites to the wider ecosystem of infrastructure, identities, communities, and relationships connected to ransomware activity. The engineer will work closely with ransomware analysts and the broader collections organization to translate intelligence requirements into technical capabilities and evolve automated access strategies as the ransomware ecosystem changes. A central goal is to build collections that provide intelligence beyond what is readily available through open-source ransomware monitoring. The position works across cloud infrastructure, distributed collection services, browser automation, and specialized network environments. The technology landscape may include Python, Go, JavaScript/TypeScript, AWS, Docker, Kubernetes, Terraform, S3, PostgreSQL, Redis, HTTP collectors, browser automation, authenticated session management, TOR, proxies, SOCKS, VPNs, distributed egress, event-driven processing, GitHub, CI/CD, automated testing, observability, and production monitoring. Experience building reliable systems against unstable or intentionally difficult-to-automate sources is particularly valuable. Success means enabling analysts to access relevant information earlier, gain more context about threat-actor claims, and build stronger evidence about relationships among actors, infrastructure, identities, and ransomware operations. The engineer will help the organization adapt to changes in platforms, access controls, infrastructure, and operating practices, and turn recurring collection challenges into durable engineering capabilities. This is a full-time position with a stated base salary range of $129,000–$193,500 across US locations. The role may also be eligible for incentive compensation and equity. The described benefits include medical, dental, vision, life insurance, and a 401(k).

Requirements

Strong collection engineering experience.
Understanding of how technical collection decisions translate into higher-confidence intelligence for analysts and customers.
Comfort learning and operating across cloud infrastructure, distributed collection services, browser automation, and specialized network environments.
Experience building reliable systems against unstable or intentionally difficult-to-automate sources is particularly valuable.
Ability to work closely with analysts and cross-functional engineering, collections, and analysis teams.
Technical leadership and mentorship capability.

Nice To Haves

Experience with languages such as Python, Go, or JavaScript/TypeScript.
Familiarity with AWS, Docker, Kubernetes, Terraform, S3, PostgreSQL, Redis, or distributed caching and storage systems.
Familiarity with HTTP-based collectors, browser automation, headless browsers, Playwright/Selenium-style tooling, or authenticated session management.
Familiarity with TOR, proxies, SOCKS, VPNs, distributed egress, or specialized collection infrastructure.
Familiarity with queue- and event-driven processing architectures.
Familiarity with GitHub, CI/CD pipelines, automated testing, observability, and production monitoring.
Experience with dark-web and restricted-source collection, ransomware infrastructure, identity and entity resolution, or adversarial web environments.

Responsibilities

Own and improve engineering capabilities supporting ransomware collection, emphasizing reliability, coverage, timeliness, and intelligence value.
Expand collection beyond leak sites and conventional sources through user-focused approaches that improve visibility into relevant actors and communities.
Partner with ransomware analysts to translate intelligence requirements and investigative questions into scalable technical collection capabilities.
Develop and refine automated access strategies for ransomware-related sources, including sources with authentication, anti-automation controls, changing infrastructure, or other access challenges.
Build infrastructure to discover, access, monitor, and preserve difficult-to-collect ransomware intelligence at scale.
Improve the resilience and maintainability of existing collection systems while reducing manual intervention and operational overhead.
Establish engineering patterns that move new sources and collection methods from experimentation into production efficiently and reliably.
Collaborate across engineering, collections, and analysis teams to structure and deliver data for downstream intelligence use.
Provide technical leadership and mentorship and help establish engineering standards and long-term architectural direction.
Adapt collection capabilities as ransomware actors change platforms, access controls, infrastructure, and operating practices.