Fraud Cyber Threat Intelligence Analyst

Описание

The Fraud Threat Intelligence function identifies attack methods, tooling, and targeting while adversaries are still planning, using dark web, Telegram, and fraudster-forum intelligence as an early warning signal.

Responsibilities

• Monitor dark web forums, Telegram channels, and other fraudster communities using approved tooling to identify chatter about Intuit products: account acquisition, attack manuals, and attack results.
• Find fraud manuals and step-by-step schemes targeting Intuit products, ideally while still in planning, and assess credibility, feasibility, and potential impact.
• Build and maintain a glossary of coded fraudster language and slang to find and interpret relevant conversations.
• Analyze fraudster bragging and shared artifacts (e.g., invoices, account data, screenshots) to identify affected customers and accounts and trigger mitigation within required timelines.
• Translate each discovered scheme into a defined action: policy change, detection rule, control, or product fix. Work with Trust & Safety, Fraud Policy, Data Science, Product, and Engineering to close the loop and track it to completion.
• Study Intuit products from the attacker's perspective and anticipate where fraudsters will probe next. Coordinate with the Fraud Red Team to validate suspected weaknesses.
• Produce clear intelligence products (early warnings, threat briefs, trend reports) for analysts, engineers, and leadership, with sourcing and confidence levels.
• Partner with Legal early to define what intelligence collection is permitted and under what conditions; operate strictly within those limits and document them.
• Deliver actionable intelligence to partners in Fraud Red Team, Incident Response, and fraud investigations.
• Manage the working relationship with intelligence vendors and request collection on emerging topics; assess vendor coverage gaps.
• Apply AI and automation to triage, translate, summarize, and cluster large volumes of forum and channel content, reducing manual toil.
• Use data and logs to correlate external intelligence with activity seen on our platforms (SQL/Python).

Requirements

• 10+ years in fraud analysis, threat intelligence, cyber threat intelligence, or OSINT (set to leveling guide).
• Demonstrated experience monitoring and analyzing underground forums, Telegram, or similar fraudster communities.
• Working knowledge of the intelligence cycle and tradecraft: collection, sourcing, confidence, reporting.
• Fraud domain knowledge: identity theft, account takeover, synthetic identity, first-party fraud, tax and payment fraud.
• Proficiency with SQL and Python and comfort with data analysis of logs and large text datasets.
• Experience operating within legal, privacy, and OpSec constraints when handling illicit content and stolen data.
• Strong written and verbal communication, able to brief both engineers and senior leaders and influence cross-team prioritization.
• Able to work independently in an ambiguous, fast-moving environment, and responsive during incidents.

We offer

• Intuit provides a competitive compensation package with a strong pay for performance rewards approach.
• This position may be eligible for a cash bonus, equity rewards, and benefits, in accordance with our applicable plans and programs.