Fraud Analyst

Role Overview

Join Recorded Future’s Threat Intelligence team as a Fraud Analyst. You will research and analyze emerging cyber threats and financially motivated activity, producing actionable intelligence for internal and external stakeholders.

What You’ll Do

• Research emerging cyber threats, adversary activity, and global threat trends
• Collect, analyze, and synthesize data from technical and open sources to produce intelligence
• Track threat actor infrastructure, campaigns, and evolving TTPs (tactics, techniques, and procedures)
• Monitor and assess Chinese-language sources to identify relevant threat activity and insights
• Produce high-quality intelligence reporting for diverse stakeholders
• Identify and develop indicators and detection opportunities
• Collaborate with cross-functional teams across intelligence, engineering, and data science
• Continuously build technical expertise and stay current on evolving threat landscapes and tradecraft

What You’ll Bring

• BA/BS (or equivalent) in Computer Science, Information Security, Intelligence, Security Studies, or a related field
• 1–2 years of experience in Threat Intelligence, Cybersecurity, or related discipline (internships/academic research count)
• Foundational knowledge of cyber threat analysis and intelligence methodologies
• Basic networking concepts (e.g., TCP/IP, DNS, internet infrastructure)
• Experience/familiarity analyzing technical artifacts (domains, IP addresses, and related metadata)
• Familiarity with OSINT collection and analysis
• Exposure to CTI tools/workflows such as Jupyter Notebook, Maltego, Elastic Stack (or similar)
• Knowledge of structured analytic frameworks such as MITRE ATT&CK, Cyber Kill Chain, or Diamond Model
• Strong analytical and critical thinking skills
• Excellent written and verbal communication skills
• Ability to work collaboratively in a fast-paced, globally distributed team

Required / Preferred Qualifications

• Required: Professional working proficiency in Chinese (read, analyze, synthesize native-language sources)
• Preferred: Experience analyzing financially motivated cyber activity (phishing, scams, account compromise)
• Preferred: Basic scripting/programming experience (Python preferred) for analysis/automation
• Preferred: Familiarity with underground ecosystems (e.g., forums/marketplaces/messaging such as Telegram)
• Preferred: Understanding of payment systems, cryptocurrency usage, or fraud typologies
• Preferred: Experience with threat intelligence datasets / large-scale data analysis
• Preferred: Experience with detection development or identifying malicious/suspicious indicators
• Plus: Working knowledge of Russian