Director of Global Security Operations
MongoDB
We’re looking for a Cyber Threat Intelligence (CTI) Research Intern to help us track, analyze, and report on emerging cyber threats — with a strong focus on dark web and open-source intelligence (OSINT).
You’ll use OSINT tooling, scripts, and automation to discover leaked data, identify threat actors, track stealer logs, and support our overall Threat Intelligence strategy.
Monitor dark web forums, marketplaces, Telegram channels, paste sites, and other underground sources for potential leaks related to our customers (credentials, PII, configs, access offers, etc.).
Identify and track threat actors, their aliases, activity patterns, and infrastructure.
Use OSINT tools and frameworks (e.g., Maltego, SpiderFoot, Shodan, Censys, whois, etc.) to gather intelligence on domains, IPs, email addresses, and infrastructure related to threats.
Correlate data from multiple sources (dark web, social media, news, public feeds) into meaningful intelligence.
Build and maintain Python scripts to automate data collection from open sources and dark web mirrors/APIs.
Clean, normalize, and enrich collected data (e.g., parsing stealer logs, extracting indicators of compromise, tagging entities).
Contribute to the design and improvement of our Threat Intelligence strategy, including data sources, workflows, and prioritization.
Create concise intelligence reports, dashboards, and alerts for internal teams and customers (what happened, who is behind it, impact, recommended actions).
Maintain structured repositories of Indicators of Compromise (IOCs), TTPs, and threat actor profiles.
Work with SOC / Incident Response teams to provide context for ongoing alerts and investigations.
Map collected intelligence to frameworks likeMITRE ATT&CKto understand and explain attacker behavior.
Track emerging threat trends, new ransomware groups, exploit kits, and data leak forums.
Document processes, tools, and findings so they can be reused by the wider team.
Dark web vs deep web, Tor, and common underground ecosystems.
Hands-on experience withPythonfor:
Writing small scripts for data collection and parsing (web scraping, API calls, regex, etc.).
Basic data handling (JSON, CSV, simple data analysis).
Basic networking concepts (IP, DNS, ports, HTTP/S).
Common attack types (phishing, credential stuffing, ransomware, data breaches).
Ability to read & interpret breach data (usernames, passwords, hashes, stealer logs) with a strong sense of confidentiality and ethics.
Strong written communication skills to convert technical findings into clear summaries.
Real-world exposure todark web intelligence, stealer logs, and breach dataworkflows.
Experience in building repeatablethreat intel processes and automations.
Mentorship from security engineers / analysts and a chance to influence how our Threat Intel function evolves.
You don’t need to know everything on day one, but you should be curious, comfortable experimenting with tools and scripts, and serious about responsible handling of sensitive data.
Originally posted on Himalayas
MongoDB
MongoDB
GitLab
Figma
Datadog
OpenSesame
Salesforce
4126 Skechers USA France S.A.S.
Appen Butler Hill Inc
Tech Talent International
VulnCheck Inc.
Akamai Technologies
Globalization Partners
Cloud Counselage Pvt Ltd
TheHiveCareers
mercor
MARGO
DUIT
Banner Health
RÖDER Group
Easy Dynamics Corporation
Axonius
Akamai Technologies
TwinStream
TheHiveCareers
ITMates
Language Bear
Fullscript
Coalition
Wongdoody
We’re looking for a Cyber Threat Intelligence (CTI) Research Intern to help us track, analyze, and report on emerging cyber threats — with a strong focus on dark web and open-source intelligence (OSINT).
You’ll use OSINT tooling, scripts, and automation to discover leaked data, identify threat actors, track stealer logs, and support our overall Threat Intelligence strategy.
Monitor dark web forums, marketplaces, Telegram channels, paste sites, and other underground sources for potential leaks related to our customers (credentials, PII, configs, access offers, etc.).
Identify and track threat actors, their aliases, activity patterns, and infrastructure.
Use OSINT tools and frameworks (e.g., Maltego, SpiderFoot, Shodan, Censys, whois, etc.) to gather intelligence on domains, IPs, email addresses, and infrastructure related to threats.
Correlate data from multiple sources (dark web, social media, news, public feeds) into meaningful intelligence.
Build and maintain Python scripts to automate data collection from open sources and dark web mirrors/APIs.
Clean, normalize, and enrich collected data (e.g., parsing stealer logs, extracting indicators of compromise, tagging entities).
Contribute to the design and improvement of our Threat Intelligence strategy, including data sources, workflows, and prioritization.
Create concise intelligence reports, dashboards, and alerts for internal teams and customers (what happened, who is behind it, impact, recommended actions).
Maintain structured repositories of Indicators of Compromise (IOCs), TTPs, and threat actor profiles.
Work with SOC / Incident Response teams to provide context for ongoing alerts and investigations.
Map collected intelligence to frameworks likeMITRE ATT&CKto understand and explain attacker behavior.
Track emerging threat trends, new ransomware groups, exploit kits, and data leak forums.
Document processes, tools, and findings so they can be reused by the wider team.
Dark web vs deep web, Tor, and common underground ecosystems.
Hands-on experience withPythonfor:
Writing small scripts for data collection and parsing (web scraping, API calls, regex, etc.).
Basic data handling (JSON, CSV, simple data analysis).
Basic networking concepts (IP, DNS, ports, HTTP/S).
Common attack types (phishing, credential stuffing, ransomware, data breaches).
Ability to read & interpret breach data (usernames, passwords, hashes, stealer logs) with a strong sense of confidentiality and ethics.
Strong written communication skills to convert technical findings into clear summaries.
Real-world exposure todark web intelligence, stealer logs, and breach dataworkflows.
Experience in building repeatablethreat intel processes and automations.
Mentorship from security engineers / analysts and a chance to influence how our Threat Intel function evolves.
You don’t need to know everything on day one, but you should be curious, comfortable experimenting with tools and scripts, and serious about responsible handling of sensitive data.
Originally posted on Himalayas