{"id":284036,"url":"https://alion.io/job/cyble-senior-researcher-dark-web-threat-intelligence","title":"Senior Researcher - Dark Web & Threat Intelligence","company":{"id":2698,"name":"Cyble","domain":"cyble.com","url":"https://alion.io/company/cyble","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Work at a Startup","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":15000,"max":35000,"currency":"USD","period":"year","gross":null,"usd_annual":35000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Telegram","optional":false},{"name":"MITRE ATT&CK","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-09-05T13:45:40Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-11-02T11:24:28Z","board_verified":true,"closed_at":null,"days_open":58,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":58},"description":"About The Team\nThe Pursuits team produces dark web and threat intelligence on prospects, the companies Cyble's sales and presales teams are trying to win. Early, validated intelligence shows a prospect what's exposed about it (access for sale, leaks, vulnerable assets) and demonstrates Cyble's offering in action. Our internal customers are sales and presales, and our work directly supports new-client growth.\nWe cover the dark web (access sales, leaks, malicious tools, marketplaces) and threats from ransomware groups, extortion crews, hacktivists, and APTs, plus cloud storage exposures and other vulnerabilities. Our work is both proactive and driven by collaboration with other teams.\nAbout The Role:\nYou take on the hardest collection and the highest-stakes reporting, and you help run the function. You own the request queue, set the quality bar, and guide less experienced researchers. You also still do the work: run sources and threat-actor engagements, deanonymize actors, and write the advisories that reach prospects.\nWhat You’ll Do at Cyble:\nCollection & intelligence\nMonitor dark web forums, Telegram channels, and ransomware/extortion group sites daily for intelligence on prospects and notable events.\nEngage threat actors (TA engagement / HUMINT) to gather intel on private data leaks; target several successful engagements per week.\nValidate data leaks and TA claims to determine whether they're legitimate.\nDeanonymize threat actors: link aliases, accounts, and personas to real-world identities.\nAnalysis & reporting\nProduce advisories and flash alerts for significant leads, and contribute blogs and quarterly reports (for example, ransomware and regional dark web roundups).\nMap a prospect's real attack surface (subsidiaries, parent companies, subdomains, and vulnerable login portals) when scope isn't fully specified.\nAnalyze raw breach datasets and corroborate findings before anything is published.\nTeam ownership & coordination\nOwn the request queue: triage incoming requests, confirm scope, route them, and track deliverables against due dates.\nReview and quality-check the team's findings and reports before they reach stakeholders.\nMentor junior researchers and raise the bar on tradecraft and writing.\nRun daily async standups and the weekly team review, and keep stakeholders informed.\nCoordinate with sales and relationship managers on what each account needs (report depth, scope, timelines).\nWhat You’ll Need:\n4+ years in threat intelligence, dark web research, OSINT, or intelligence operations, including senior or lead-level work.\nDeep hands-on familiarity with dark web forums, marketplaces, and Telegram-based trading of compromised data.\nStrong TA engagement / HUMINT experience, with sound operational security and source-handling discipline.\nSolid OSINT tradecraft: people and entity research, social media and search-operator (dork) techniques, and corroboration.\nComfort with raw breach data: structure, validation, and victim mapping.\nA track record of impactful findings.\nExperience guiding or mentoring other researchers and owning a quality bar.\nDriven to keep learning and stay current on the latest research techniques and tools.\nAble to use AI tools effectively to speed up research, analysis, and writing.\nStrong communication, within the team, across other teams, and in writing. You can turn technical findings into clear, defensible analysis that makes both technical and executive stakeholders see the business impact.\nBonus Points If You Have:\nFamiliarity with intelligence frameworks (MITRE ATT&CK, the intelligence cycle, analytic standards).\nExperience supporting a SaaS CTI platform or a sales/POV motion.\nBasic scripting (Python/regex) for parsing and cleaning leaked datasets.\nReading knowledge of a second language common in cybercrime forums (for example, Russian).\nHow The Role Is Measured?\nConsistently deliver impactful findings each week (team baseline: 2 to 3 weekly; aim for about 80% high-impact).\nThe team's output meets the quality bar: validated, well-scoped, defensible.\nTimely turnaround on requests.\nIf you like working in an inclusive environment, you want to advance your career quickly, and your opinion is valued, look no further than Cyble, Inc. We are young, hungry, and ready to impact the cyber security landscape!\nCyble, Inc. takes into consideration an individual’s skillset, experience and location in making final salary determination.\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected Veteran status age, or genetics, or any other characteristic protected by law.\nCV Shortlist by the Hiring Panel\n\nCognitive Assessment via a platform called Xobin - It’s a 50-minute assessment, which is a mandatory step in our recruitment process for all roles.\n\nPanel Discussions - Typically comprising a minimum of three interview rounds, along with a role-based assignment.","description_format":"text","description_chars":5000,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Russian","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Cybersecurity AI"],"lifecycle":[{"event":"open","at":"2026-09-05T13:45:40Z"}],"visa":[],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.681,"p_room":0.45,"age_days":57,"expected_fill_days":35,"reasons":["conf:3","win:tail"],"computed_at":"2026-11-02T06:13:15Z"},"pay":{"stated_usd_annual":35000,"is_top_pay":false},"html_url":"https://alion.io/job/cyble-senior-researcher-dark-web-threat-intelligence","json_url":"https://alion.io/job/cyble-senior-researcher-dark-web-threat-intelligence.json","meta":{"generated_at":"2026-11-02T14:15:39Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19635,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2698},"rest":"https://alion.io/mcp/rest/get_company?id=2698"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcyble-senior-researcher-dark-web-threat-intelligence"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcyble-senior-researcher-dark-web-threat-intelligence"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcyble-senior-researcher-dark-web-threat-intelligence"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cyble-senior-researcher-dark-web-threat-intelligence\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcyble-senior-researcher-dark-web-threat-intelligence"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":284036}},{"tool":"search_jobs","arguments":{"company":"cyble.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":284036},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}