Senior Cyber Fraud Threat Intelligence Investigator

About Overwatch Data

Overwatch Data is building the intel and risk teams of the future. We combine reliable automation, AI agents, and a team of creative technical experts to make catching the known-knowns easier and uncovering the unknown-unknowns possible.

Our platform helps financial institutions, digital-facing companies, and other organizations identify and investigate cyber-enabled fraud across the open, deep, and dark web. We turn fragmented data into timely, evidence-backed intelligence that risk teams can act on.

About the Role

We are looking for a Fraud/Cyber Threat Intelligence Investigator who can turn complex and incomplete information into clear, actionable intelligence for customers.

The role combines responsive intelligence work, answering customer Requests for Information (RFIs), with proactive research into emerging fraud threats, actors, methods, and criminal ecosystems. You will also help discover valuable new sources, analyze fraud tactics, techniques, and procedures (TTPs), and produce high-quality intelligence reports.

This is primarily an intelligence research and production role, not a collections role. You will collaborate with collections, engineering, data science, product, and customer teams to answer important questions, anticipate emerging risks, and improve how intelligence is produced at scale.

What You’ll Do

RFIs, Research, and Analysis

• Own customer RFIs from intake through delivery: clarify the question, define scope, conduct research, assess the evidence, and produce the response.
• Conduct rapid-turnaround investigations and longer-term research into fraud schemes, threat actors, criminal communities, exposed data, suspicious infrastructure, and emerging campaigns.
• Search, validate, and contextualize information from Overwatch’s own threat intelligence collections, and if needed, external open sources, social platforms, messaging applications, forums, marketplaces, breach data, stealer logs, domains, and other relevant sources.
• Analyze how fraud schemes operate end to end, including actor roles, infrastructure, tools, victim targeting, monetization methods, and potential intervention points.
• Track changes in fraud TTPs across areas such as account takeover, payment fraud, phishing, social engineering, scams, compromised data, identity abuse, and money-mule activity.
• Correlate activity across sources and clearly distinguish confirmed facts, analytical judgments, hypotheses, intelligence gaps, and recommendations.

Source Discovery

• Help identify and evaluate new open, deep, and dark-web sources relevant to customer requirements and emerging fraud trends.
• Assess forums, marketplaces, messaging channels, websites, and online communities for their relevance, reliability, uniqueness, and intelligence value.
• Map source migrations and relationships among communities, actors, administrators, and platforms.
• Document source characteristics and coverage gaps, and work with collections and engineering teams to prioritize new coverage.
• Support, but not primarily own, persistent access, persona management, or scaled collection infrastructure.

Reporting and Collaboration

• Produce concise, client-ready RFI responses, executive summaries, flash reports, threat assessments, actor profiles, and longer-form research reports.
• Turn raw posts, screenshots, files, logs, and indicators into findings that explain what happened, why it matters, and what customers should consider doing next.
• Preserve source links, timestamps, evidence, confidence assessments, and investigative steps so findings are reproducible and defensible.
• Identify indicators, TTPs, and detection or disruption opportunities that customers can use in fraud prevention and investigations.
• Present findings in customer briefings and respond to follow-up questions with appropriate context and nuance.
• Translate recurring customer questions and research findings into monitoring priorities, new collection requirements, and product improvements.
• Review analyst- and AI-generated intelligence for accuracy, clarity, relevance, and sourcing.

What We’re Looking For

• Experience in OSINT investigations, fraud intelligence, cyber threat intelligence, financial crime research, investigative journalism, law enforcement intelligence, or a related field.
• Excellent writing and editing skills, including experience producing clear, evidence-backed reports for technical and executive audiences.
• Strong knowledge of cyber-enabled fraud, such as account takeover, payment fraud, phishing, scams, compromised cards and credentials, check fraud, identity abuse, or money-mule activity.
• Ability to break fraud schemes into observable TTPs and explain how actors, tools, infrastructure, and monetization methods fit together.
• Experience working with fragmented and unstructured material, including posts, chats, screenshots, files, logs, domains, and technical indicators.
• Strong analytical judgment and the discipline to evaluate sources, communicate uncertainty, and avoid overstating conclusions.
• Ability to manage multiple investigations and deliver consistently under tight deadlines.
• High standards for documentation, evidence preservation, operational security, privacy, and handling sensitive information.

Nice to Have

• Experience supporting banks, card networks, fintech companies, payment processors, merchants, or other financial-services organizations.
• Familiarity with fraud operations and controls, including KYC/KYB, AML, merchant risk, authentication, transaction monitoring, or fraud detection.
• Familiarity with cyber threat intelligence, telegram, cybercrime forums, marketplaces, deep- and dark-web ecosystems, and compromised-data sources.
• Experience discovering or mapping new online sources and criminal communities.
• Familiarity with OSINT, link-analysis, domain-infrastructure, blockchain-analysis, stealer-log, or data-analysis tools.
• Relevant foreign-language capability, particularly Russian, Spanish, Portuguese, Chinese, Arabic, or another language used in fraud and cybercrime ecosystems.

What Success Looks Like

• Customers receive timely, accurate, and actionable answers to important intelligence questions.
• Research identifies meaningful fraud developments and clearly explains the underlying TTPs.
• Source discovery improves coverage of the communities and channels most relevant to customer risk.
• Reports earn trust because they are rigorous, well sourced, clearly written, and honest about uncertainty.

Originally posted on