Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

Overview

Lead cyber threat intelligence investigations into scam infrastructure, tracking threat actors and campaigns from technical indicators through on-chain activity. Deliver actionable intelligence and targeting packages to government and law-enforcement consumers.

What you'll do

• Pivot from domains, IPs, and certificates to map scam infrastructure across certificates, registrars, nameservers, hosting, and ASNs.
• Track scam campaigns through infrastructure changes, takedowns, and re-registration.
• Attribute threat actors using open-source and commercially available data.
• Connect infrastructure investigations to wallets, laundering paths, and cash-outs.
• Build clustering logic, detection rules, and automation to identify malicious infrastructure.
• Produce calibrated assessments and actionable targeting packages.
• Own the intelligence cycle and collaborate with scam specialists, data, engineering, and product teams.

What you'll need

• At least 5 years of experience in cyber threat intelligence or threat infrastructure analysis.
• Hands-on infrastructure pivoting and campaign tracking experience.
• Fluency with passive DNS, WHOIS, certificate or Shodan-style fingerprinting, and phishing monitoring.
• Experience building detection, clustering, rules, or automation.
• Experience attributing threat actors with open-source and commercial data.
• Experience producing actionable intelligence for government, law-enforcement, or equivalent consumers.
• Ability to work in the Washington, D.C., Maryland, or Virginia area.

Details

• Periodic in-person collaboration and travel may be required.
• Primary time zone overlap is US Eastern/Central.
• Surge availability is expected during time-sensitive disruption windows.