Senior Threat Intelligence Analyst

Recorded Future•Washington, DC

10h•$129,000 - $193,500

About The Position

Recorded Future is hiring a Senior Threat Intelligence Analyst for the Advanced Cybercrime and Engagements Team within Insikt Group. The role researches and analyzes criminal activity on dark web and underground platforms, including forums, shops, marketplaces, and secure communication channels, to identify cybercrime trends and threat actors. The analyst identifies and maintains access to sources, interacts with threat actors to obtain nonpublic information, and conducts proactive research while responding to requests from colleagues and customers. The analyst uses open-source intelligence, Recorded Future's Intelligence Operations Platform, and artificial intelligence to provide timely, actionable insights into cybercriminal threats and trends. The role also collaborates with other Insikt Group teams and supports Recorded Future products, teams, services, initiatives, internal stakeholders, and customers.

Requirements

Strong knowledge and experience in analytic tradecraft, the intelligence cycle, OSINT gathering, and intelligence writing techniques and methodologies.
Ability to document and clearly explain research findings to customers, and confidence presenting research to customers and at conferences.
At least 3 years of professional experience in cyber intelligence, cybersecurity, cyber or cybercriminal investigations, or a related discipline.
Advanced knowledge of operational security procedures and practices.
Demonstrated experience operating on dark web sources, including forums, marketplaces, shops, and communication channels.
Experience engaging with cybercriminals and participating in covert operations involving sensitive information.
Knowledge of cybercriminal economy structures and trends in different or specific regions, including communication vectors, source locations, and operational security considerations.
Experience handling, transacting in, and tracing cryptocurrencies.
Knowledge of and ability to conduct blockchain and cryptocurrency investigations.
Knowledge of money laundering, fraud, and current cybercrime TTPs.
Ability to work collaboratively in a globally distributed environment.
Russian and Eastern European language fluency or professional proficiency.
Regular hands-on use of AI tools such as Claude or ChatGPT in research and writing, with an inclination to use them to speed up or automate tasks.
Ability to write clear, specific AI prompts, iterate as needed, and fact-check and edit AI output for validity and objectivity.

Nice To Haves

BA/BS or MA/MS degree, or equivalent experience, in Computer Science, International Relations, Security Studies, Regional Studies, Criminology, or a related discipline.
Knowledge and understanding of the cybercriminal ecosystem.
Knowledge and understanding of relationships between cybercriminal, hacktivist, extremist, and state-sponsored operations and organizations.
Technical knowledge of malware trends, including ransomware, its functionality and capabilities, and its impact on entities.
Practical experience integrating or leveraging LLMs such as GPT, Claude, or Gemini in real-world applications, tools, or workflows to improve intelligence-analysis efficiency.

Responsibilities

Research, track, and write finished intelligence reports on cybercriminal threat actors, malicious tools and services, source types, TTPs, campaigns, and related topics.
Identify, propose, and publish proactive Analyst Notes and reports on emerging threats, cybercriminal activities, and campaigns, including dark web threat actors, money laundering operations, hacktivists, and threat groups.
Drive the sourcing, collection, and curation of new data into the Recorded Future Intelligence Cloud, using AI-assisted triage.
Create and maintain access to underground sources and personas to obtain new intelligence.
Contribute ideas for automations and AI-assisted workflows to improve the speed and consistency of production, and share lessons learned and best practices.
Document and explain research findings to customers, and present findings to customers and at conferences.
Respond to requests from colleagues and customers concerning cybercriminal activity.