Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

Role overview Investigate scam operations by tracing technical infrastructure from an initial domain, IP address, or certificate to related campaigns, actors, and financial activity. The role combines cyber threat intelligence, open-source research, and on-chain analysis to produce actionable assessments for government and law-enforcement partners.

Responsibilities - Map connections among domains, certificates, registrars, nameservers, hosting providers, and network operators to identify scam infrastructure and campaigns. - Track infrastructure changes over time, including activity after takedowns, and assess how campaigns may reappear. - Use open-source and commercial information to support actor attribution. - Connect infrastructure findings to wallets, laundering routes, and cash-out activity. - Develop clustering methods, detection rules, and automation to identify malicious infrastructure proactively. - Deliver evidence-based assessments and intelligence packages, coordinating with subject-matter, data, engineering, and product colleagues.

Requirements - At least five years of experience in cyber threat intelligence or threat infrastructure analysis. - Practical experience tracing infrastructure and tracking campaigns across shared certificates, registrars, nameservers, hosting, and network operators. - Experience following actors or campaigns over time, including through takedowns and re-registration. - Working knowledge of tools and methods such as passive DNS, WHOIS, certificate analysis, Shodan-style fingerprinting, and phishing monitoring. - Ability to build detection or clustering logic, rules, or automation, and to make calibrated, defensible attribution judgments. - Track record of producing intelligence or targeting packages used by government, law enforcement, or an equivalent audience. - Must be based in the Washington, D.C., Maryland, or Virginia area; periodic in-person collaboration and travel may be required.