{"id":3776976,"url":"https://alion.io/job/intuit-fraud-cyber-threat-intelligence-analyst","title":"Fraud Cyber Threat Intelligence Analyst","company":{"id":16628,"name":"Intuit","domain":"intuit.com","url":"https://alion.io/company/intuit","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Radancy","truth_index":{"grade":"B","score":77,"open_postings":45,"ghost_share":0,"stale_share":0.911,"repost_share":0,"time_to_fill_p50_days":45,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Petah Tikva, Israel"],"countries":["IL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SQL","optional":false},{"name":"Telegram","optional":false}],"status":"live","first_seen_at":"2026-11-04T23:35:37Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-12T13:02:32Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"Fraud is easier to stop before it scales. The Fraud Threat Intelligence function finds attack methods, tooling and targeting while adversaries are still planning, using dark web, Telegram and fraudster-forum intelligence as an early warning signal rather than a post-incident explanation. In this role you will learn how fraudsters think, talk and probe our products, and turn what you find into defenses and policy changes before attacks show up in our traffic, protecting Intuit and millions of customers.\nResponsibilities\nMonitor dark web forums, Telegram channels and other fraudster communities using approved tooling to identify chatter about Intuit products: account acquisition, attack manuals and attack results.\n\nFind fraud manuals and step-by-step schemes targeting Intuit products, ideally while still in planning, and assess credibility, feasibility and potential impact.\n\nBuild and maintain a glossary of coded fraudster language and slang to find and interpret relevant conversations.\n\nAnalyze fraudster bragging and shared artifacts (e.g., invoices, account data, screenshots) to identify affected customers and accounts and trigger mitigation within required timelines.\n\nTranslate each discovered scheme into a defined action: policy change, detection rule, control or product fix. Work with Trust & Safety, Fraud Policy, Data Science, Product and Engineering to close the loop and track it to completion.\n\nStudy Intuit products from the attacker's perspective and anticipate where fraudsters will probe next. Coordinate with the Fraud Red Team to validate suspected weaknesses.\n\nProduce clear intelligence products (early warnings, threat briefs, trend reports) for analysts, engineers and leadership, with sourcing and confidence levels.\n\nPartner with Legal early to define what intelligence collection is permitted and under what conditions; operate strictly within those limits and document them.\n\nDeliver actionable intelligence to partners in Fraud Red Team, Incident Response, and fraud investigations\n\nManage the working relationship with intelligence vendors and request collection on emerging topics; assess vendor coverage gaps.\n\nApply AI and automation to triage, translate, summarize and cluster large volumes of forum and channel content, reducing manual toil.\n\nUse data and logs to correlate external intelligence with activity seen on our platforms (SQL/Python).\n\nQualifications\n10+ years in fraud analysis, threat intelligence, cyber threat intelligence, or OSINT (set to leveling guide).\n\nDemonstrated experience monitoring and analyzing underground forums, Telegram or similar fraudster communities.\n\nWorking knowledge of the intelligence cycle and tradecraft: collection, sourcing, confidence, reporting.\n\nFraud domain knowledge: identity theft, account takeover, synthetic identity, first-party fraud, tax and payment fraud.\n\nProficiency with SQL and Python and comfort with data analysis of logs and large text datasets.\n\nExperience operating within legal, privacy and OpSec constraints when handling illicit content and stolen data.\n\nStrong written and verbal communication, able to brief both engineers and senior leaders and influence cross-team prioritization.\n\nAble to work independently in an ambiguous, fast-moving environment, and responsive during incidents.\n\nIntuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.","description_format":"text","description_chars":3841,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Personal Finance Apps & Education","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-11-04T23:35:37Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.63,"p_room":1,"age_days":7,"expected_fill_days":45,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-12T10:38:37Z"},"pay":null,"html_url":"https://alion.io/job/intuit-fraud-cyber-threat-intelligence-analyst","json_url":"https://alion.io/job/intuit-fraud-cyber-threat-intelligence-analyst.json","meta":{"generated_at":"2026-11-12T14:30:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30156,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":16628},"rest":"https://alion.io/mcp/rest/get_company?id=16628"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fintuit-fraud-cyber-threat-intelligence-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fintuit-fraud-cyber-threat-intelligence-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fintuit-fraud-cyber-threat-intelligence-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/intuit-fraud-cyber-threat-intelligence-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fintuit-fraud-cyber-threat-intelligence-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3776976}},{"tool":"search_jobs","arguments":{"company":"intuit.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3776976},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}