Monitor dark web forums, marketplaces, Telegram channels, paste sites, and other underground sources for potential leaks related to our customers (credentials, PII, configs, access offers, etc.).

Identify and track threat actors, their aliases, activity patterns, and infrastructure.

Use OSINT tools and frameworks (e.g., Maltego, SpiderFoot, Shodan, Censys, whois, etc.) to gather intelligence on domains, IPs, email addresses, and infrastructure related to threats.

Correlate data from multiple sources (dark web, social media, news, public feeds) into meaningful intelligence.

Build and maintain Python scripts to automate data collection from open sources and dark web mirrors/APIs.

Clean, normalize, and enrich collected data (e.g., parsing stealer logs, extracting indicators of compromise, tagging entities).

Contribute to the design and improvement of our Threat Intelligence strategy, including data sources, workflows, and prioritization.

Create concise intelligence reports, dashboards, and alerts for internal teams and customers (what happened, who is behind it, impact, recommended actions).

Maintain structured repositories of Indicators of Compromise (IOCs), TTPs, and threat actor profiles.

Work with SOC / Incident Response teams to provide context for ongoing alerts and investigations.

Map collected intelligence to frameworks likeMITRE ATT&CKto understand and explain attacker behavior.

Track emerging threat trends, new ransomware groups, exploit kits, and data leak forums.

Document processes, tools, and findings so they can be reused by the wider team.

Monitor dark web forums, marketplaces, Telegram channels, paste sites, and other underground sources for potential leaks related to our customers (credentials, PII, configs, access offers, etc.).

Identify and track threat actors, their aliases, activity patterns, and infrastructure.

Use OSINT tools and frameworks (e.g., Maltego, SpiderFoot, Shodan, Censys, whois, etc.) to gather intelligence on domains, IPs, email addresses, and infrastructure related to threats.

Correlate data from multiple sources (dark web, social media, news, public feeds) into meaningful intelligence.

Build and maintain Python scripts to automate data collection from open sources and dark web mirrors/APIs.

Clean, normalize, and enrich collected data (e.g., parsing stealer logs, extracting indicators of compromise, tagging entities).

Contribute to the design and improvement of our Threat Intelligence strategy, including data sources, workflows, and prioritization.

Create concise intelligence reports, dashboards, and alerts for internal teams and customers (what happened, who is behind it, impact, recommended actions).

Maintain structured repositories of Indicators of Compromise (IOCs), TTPs, and threat actor profiles.

Work with SOC / Incident Response teams to provide context for ongoing alerts and investigations.

Map collected intelligence to frameworks likeMITRE ATT&CKto understand and explain attacker behavior.

Track emerging threat trends, new ransomware groups, exploit kits, and data leak forums.

Document processes, tools, and findings so they can be reused by the wider team.