Senior Threat Intelligence Analyst

Recorded Future•Boston, MA

7d•Hybrid

About The Position

The Senior Threat Intelligence Analyst will research and analyze criminal activity on dark web and underground platforms, including forums, shops, marketplaces, and secure communication channels, to identify cybercrime trends and threat actors. The role includes identifying intelligence sources, maintaining persistent access to them, and interacting with threat actors to obtain information that is not publicly available. The analyst conducts proactive research while remaining responsive to requests from Recorded Future colleagues and customers about cybercriminal activity. Using open-source intelligence, the Recorded Future Intelligence Operations Platform, and artificial intelligence, the analyst produces timely, actionable insights for customers and internal stakeholders. The position is part of the Advanced Cybercrime and Engagements Team in Insikt Group, which tracks and helps mitigate cybercriminal threat actors and supports Recorded Future products, teams, services, and initiatives. The analyst also collaborates with other Insikt Group teams on research and customer requests.

Requirements

Russian and Eastern European language fluency or professional proficiency.
Strong knowledge and experience with analytic tradecraft, the intelligence cycle, and open-source intelligence gathering techniques.
Strong intelligence writing skills, techniques, and methodologies; ability to document and clearly explain research findings to customers.
Confidence presenting research findings to customers and at conferences.
At least 3 years of professional experience in cyber intelligence, cybersecurity, cyber or cybercriminal investigations, or a related discipline.
Advanced knowledge of operational security (OPSEC) procedures and practices.
Demonstrated experience operating on dark web sources, including forums, marketplaces, shops, and communication mediums.
Experience engaging with cybercriminals and participating in covert operations involving sensitive information.
Knowledge of the structure and trends of the cybercriminal economy and landscape in different or specific regions, including communication vectors, source locations, and operational security considerations.
Experience handling, transacting in, and tracing cryptocurrencies.
Knowledge of and ability to conduct blockchain and cryptocurrency investigations.
Knowledge of money laundering, fraud, and current cybercrime TTPs.
Ability to work collaboratively in a globally distributed environment.
Regular hands-on use of AI tools such as Claude or ChatGPT in research and writing, with the ability to use them to accelerate or automate tasks.
Ability to write clear, specific AI prompts, iterate as needed, and fact-check and edit AI output for validity and objectivity.

Nice To Haves

BA/BS or MA/MS degree, or equivalent experience, in Computer Science, International Relations, Security Studies, Regional Studies, Criminology, or a related discipline.
Knowledge and understanding of the cybercriminal ecosystem.
Knowledge and understanding of the relationships between cybercriminal, hacktivist, extremist, and state-sponsored operations and organizations.
Technical knowledge of malware trends, including ransomware, its functionality and capabilities, and its impact on entities.
Practical experience integrating or leveraging large language models such as GPT, Claude, or Gemini in real-world applications, tools, or workflows to improve intelligence analysis efficiency.

Responsibilities

Research, track, and author finished intelligence reports on cybercriminal threat actors, malicious tools and services, source types, Tactics, Techniques, and Procedures (TTPs), campaigns, and related topics.
Identify, propose, and publish proactive Analyst Notes and reports on emerging threats, cybercriminal activities, and campaigns, including dark web threat actors, money laundering operations, hacktivists, and threat groups associated with cybercrime.
Drive the sourcing, collection, and curation of new data into the Recorded Future Intelligence Cloud, using AI-assisted triage to review information more efficiently.
Create and maintain access to underground sources and personas to obtain new intelligence.
Contribute ideas for automations and AI-assisted workflows that improve the speed and consistency of the team’s production process, and share lessons learned and best practices.
Respond to requests from colleagues and customers concerning cybercriminal activity.
Present research findings to customers and at conferences.