Senior Threat Intelligence Analyst

Recorded Future•Boston, MA

11h•$129,000 - $193,500•Hybrid

About The Position

Recorded Future is hiring a Senior Threat Intelligence Analyst for the Advanced Cybercrime and Engagements Team in Insikt Group. The role focuses on researching and analyzing criminal activity on dark web and underground platforms, including forums, shops, marketplaces, and secure communication channels, to identify cybercrime trends and threat actors. The analyst will identify and maintain access to sources, interact with threat actors to obtain nonpublic information, and conduct proactive research while responding to requests from colleagues and customers. The analyst will use open-source intelligence, Recorded Future’s Intelligence Operations Platform, and artificial intelligence to provide timely, actionable insight into cybercriminal activity and trends. The position collaborates with the Advanced Cybercrime and Engagement team, other Insikt Group teams, internal stakeholders, and customers. It also contributes to the Recorded Future Intelligence Cloud and to improving team workflows through automation and AI-assisted processes.

Requirements

Strong knowledge and experience with analytic tradecraft, the intelligence cycle, and open-source intelligence gathering techniques.
Strong intelligence writing skills, techniques, and methodologies.
Ability to document and clearly explain research findings to customers, and confidence presenting findings to customers and at conferences.
At least 3 years of professional experience in cyber intelligence, cybersecurity, cyber or cybercriminal investigations, or a related discipline.
Advanced knowledge of operational security procedures and practices.
Demonstrated experience operating on dark web sources, including forums, marketplaces, and shops, and on communication platforms.
Experience engaging with cybercriminals and participating in covert operations involving sensitive information.
Knowledge of the structure and trends of the cybercriminal economy and landscape in different or specific regions, including communication vectors, source locations, and operational security considerations.
Experience handling, transacting in, and tracing cryptocurrencies.
Knowledge of and ability to conduct blockchain and cryptocurrency investigations.
Knowledge of money laundering, fraud, and current cybercrime TTPs.
Ability to collaborate in a globally distributed environment.
Russian and Eastern European language fluency or professional proficiency.
Regular, hands-on use of AI tools such as Claude or ChatGPT in research and writing, with the ability to use them to accelerate or automate tasks.
Ability to write specific AI prompts, iterate as needed, and fact-check and edit AI output for validity and objectivity.

Nice To Haves

BA/BS or MA/MS degree, or equivalent experience, in Computer Science, International Relations, Security Studies, Regional Studies, Criminology, or a related discipline.
Knowledge and understanding of the cybercriminal ecosystem.
Knowledge and understanding of links and relationships among cybercriminal, hacktivist, extremist, and state-sponsored operations and organizations.
Technical knowledge of malware trends, including ransomware, its functionality and capabilities, and its impact on entities.
Practical experience integrating or leveraging LLMs such as GPT, Claude, or Gemini in real-world applications, tools, or workflows to improve intelligence-analysis efficiency.

Responsibilities

Research, track, and write finished intelligence reports on cybercriminal threat actors, malicious tools and services, source types, TTPs, campaigns, and other cybercrime topics.
Identify, propose, and publish proactive Analyst Notes and reports on emerging threats, cybercriminal activities, and campaigns, including dark web threat actors, money laundering operations, hacktivists, and threat groups.
Drive the sourcing, collection, and curation of new data into the Recorded Future Intelligence Cloud, using AI-assisted triage to review information efficiently.
Create and maintain access to underground sources and personas to obtain new intelligence.
Contribute ideas for automation and AI-assisted workflows that improve the speed and consistency of team production, and share lessons learned and best practices.
Respond to requests from Recorded Future colleagues and customers related to cybercriminal activity.
Document research findings and present them to customers and at conferences.