Analytics Engineer
Role: Analytics Engineer Job Ref Id: JD-1320 Competence level: 5+ years Start date: 2026-10-26 End date: 2027-04-26 Extension option: Yes Scope: 100% Location: Stockholm Remote work: Remote Language: English Application deadline: 2026-11-15 Number of consultants: 1 Security clearance: No
About the assignment
We are looking for an Analytics Engineer. You'll own fraud forensics for our identity and verification platform, which verifies users through phone-number and OTP verification. We are seeing a surge in sophisticated fraud attacks on that flow, including SMS pumping campaigns targeting specific regions, while tuning critical anti-fraud thresholds where every rule change trades blocked attackers against legitimate users lost at signup. You'll investigate attacks, triage patterns, and turn findings into rules and monitoring our backend engineers can skip so they stay focused on core platform work. You'll own this space end to end while we hire a permanent team member, and leave behind detection the team can run without you.
Responsibilities
Fraud forensics: investigate active and past attacks on OTP and verification flows; quantify volume, cost and user impact; produce clear incident write-ups.
Attack triage: identify patterns across country, carrier, number range, device and attestation signals; separate SMS pumping, bot traffic and account abuse from legitimate spikes.
Threshold tuning: analyse and backtest anti-fraud rules and thresholds; quantify false positives (legitimate users blocked) against fraud prevented; recommend changes with evidence.
Detection and monitoring: turn recurring forensics into scheduled queries, dashboards and alerts so attacks are caught in hours, not after the provider invoice.
Engineering hand-off: give backend engineers precise, ready-to-implement rule proposals so they stay focused on platform delivery.
Knowledge transfer: document playbooks and coach our analytics engineer so capability stays in the team.
Requirements
Mandatory
5+ years in analytics engineering, data science or fraud analytics, with at least 2 years hands-on in fraud or abuse detection.
Expert SQL on BigQuery: large event tables, window functions, partition-aware and cost-efficient queries.
Strong Python (pandas, notebooks) for ad-hoc forensics and pattern mining.
Building scheduled pipelines in Airflow and dashboards in Looker (or equivalent BI).
Experience tuning rule- or threshold-based fraud controls, including backtesting and false-positive analysis.
Works independently from day one; communicates findings crisply to engineers and leadership.
Nice-to-have
Experience investigating telecom or SMS fraud (SMS pumping / artificially inflated traffic, IRSF) at scale.
Hands-on with CPaaS provider logs and billing data (Vonage, Twilio, Sinch, Infobip).
Identity and verification domain: OTP funnels, rate limiting, velocity rules, device attestation (Play Integrity, App Attest).
Experience with fraud in emerging markets (Africa, South Asia), where carrier and pricing patterns differ.
Event streams from Kafka; streaming anomaly detection (Dataflow/Flink).
Statistical anomaly detection or lightweight ML (BigQuery ML, isolation forests).
Additional info
We are committed to building a diverse and inclusive team. We believe a wide range of backgrounds, perspectives, and experiences strengthens our products and our culture. No matter where you're from, what language you speak, or how you identify, we value what makes you unique. This is an urgent contract engagement and we will move as soon as we find the right person, so please apply as soon as possible. As part of the recruitment process, client will conduct a background check. We only accept applications in English.
Originally posted on