Threat Actor Engagement & Intelligence Consultant (Remote - US only)
S.). This is a client-facing consulting role within the threat intelligence and digital forensics group of a large, profitable cybersecurity services company that serves Fortune 500 firms and government agencies. The core work is engaging with threat actors during ransomware and data extortion cases on behalf of clients, gathering intelligence, and advising victims on sound courses of action. The successful candidate will also turn engagement findings into operational threat intelligence. The position is remote and does not require travel.
What you'll do
- Lead threat actor communications for ransomware and data extortion cases, advising clients, legal counsel and insurance carriers on risks and options
- Support active digital forensics and incident response investigations by identifying and sharing actionable intelligence
- Author clear engagement deliverables for both technical and executive audiences, including findings, business impact and realistic remediation steps
- Build automation and scripting that streamline intelligence workflows and expand team capabilities
- Contribute to the evaluation and integration of open-source and commercial threat intelligence tools
- Participate in a rotating on-call schedule, including occasional weekend work for emergencies
What you need
- 2 to 4 years of experience communicating with threat actors, such as in ransomware negotiations or through virtual persona or sock puppet operations
- At least 2 years of threat intelligence analysis or collection experience
- Experience building persona operations and working with dark web forums and marketplaces, with an understanding of adversary behavior
- Familiarity with DFIR workflows, processes and deliverables
- Prior consulting or client-facing professional services experience, with the ability to stay calm under pressure
- Experience using AI tools to work more efficiently and solve problems; U.S. residency required
Applicants must be based in: United States.
How to apply
Get the free i'llTip app to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.
Apply on i'llTipPrefer the website? Continue on illtip.comOr get the app: Android · iPhone
🔔 Get new jobs like this first: join i'llTip Jobs on Telegram · or get personal job alerts
More Cybersecurity & Data Protection jobs
CMMC Compliance Lead (Remote - US only)
A US-based company that builds secure software delivery solutions for federal and commercial customers is hiring a customer-facing lead for CMMC Level 1 and Level 2 engagements. The role owns NIST SP 800-171 interpretati…
Vulnerability Research Engineer (Remote - Worldwide)
A fast-growing software security company that helps developers and security teams find, audit and manage third-party open source code is hiring a engineer to build and scale its patching infrastructure. The work centers …
Senior Security Engineer, Data Pipeline & Observability (Remote - US only)
The team supports clients from a Mid-Atlantic practice, but the role itself is remote within the US. Some travel may be required (up to 15%). A privately held, fast-growing information security services firm is hiring a …
Load Balancer / WAF Engineer (Remote - US only)
Applicants must be authorized to work in the United States for any employer; no visa sponsorship is offered. A cybersecurity value-added reseller and services firm serving large enterprises and U.S. government agencies i…