Senior Software Engineer: Ransomware Collections

Recorded Future•Boston, MA

1d•$129,000 - $193,500

About The Position

Recorded Future is seeking a Senior Engineer to advance its ransomware collection capabilities. The role will improve the depth, reliability, coverage, timeliness, and intelligence value of existing collections, while expanding collection beyond traditional threat-actor sites to the infrastructure, identities, communities, and relationships surrounding ransomware activity. The engineer will work closely with ransomware analysts and the broader collections organization to translate intelligence requirements and investigative questions into scalable technical capabilities, and to evolve automated access strategies as the ransomware ecosystem changes. The position focuses on building collection capabilities that provide intelligence beyond what is readily available through open-source ransomware monitoring. The work spans cloud infrastructure, distributed collection services, browser automation, specialized network environments, and queue- or event-driven processing. Success means giving analysts earlier information and richer context about threat-actor claims, relationships, infrastructure, identities, and operations, while making collection systems resilient to changes in platforms, access controls, infrastructure, and operating practices. The role also contributes technical leadership, mentorship, engineering standards, and long-term architectural direction.

Requirements

Strong collection engineering experience.
Understanding of how technical collection decisions translate into higher-confidence intelligence for analysts and customers.
Comfort learning and operating across cloud infrastructure, distributed collection services, browser automation, and specialized network environments.
Ability to build reliable systems against unstable or intentionally difficult-to-automate sources.

Nice To Haves

Experience with Python, Go, or JavaScript/TypeScript.
Experience with AWS, Docker, Kubernetes, or Terraform.
Experience with S3, PostgreSQL, Redis, or distributed caching and storage systems.
Experience with HTTP-based collectors, browser automation, headless browsers, Playwright/Selenium-style tooling, or authenticated session management.
Experience with TOR, proxies, SOCKS, VPNs, distributed egress, or specialized collection infrastructure.
Experience with queue- and event-driven processing architectures.
Experience with GitHub, CI/CD pipelines, automated testing, observability, or production monitoring.
Experience with dark-web and restricted-source collection, ransomware infrastructure, identity and entity resolution, or adversarial web environments.

Responsibilities

Own and improve ransomware collection engineering capabilities, emphasizing reliability, coverage, timeliness, and intelligence value.
Expand collection beyond leak sites and conventional sources using user-focused approaches that increase visibility into relevant actors and communities.
Partner with ransomware analysts to turn intelligence requirements and emerging investigative questions into scalable collection capabilities.
Develop and refine automated access strategies for ransomware-related sources, including those with authentication, anti-automation controls, or changing infrastructure.
Build infrastructure to discover, access, monitor, and preserve difficult-to-collect ransomware intelligence at scale.
Improve the resilience and maintainability of existing collection systems while reducing manual intervention and operational overhead.
Establish engineering patterns for moving new sources and collection methodologies from experimentation into production reliably and efficiently.
Collaborate across engineering, collections, and analysis teams to structure and deliver data for downstream intelligence use.
Provide technical leadership and mentorship within the collections organization, helping establish engineering standards and long-term architectural direction.