Job Description

The Senior Threat Researcher will specialize in monitoring, collecting, and analysing intelligence from underground forums, darknet markets, encrypted messaging platforms, and closed communities. This role complements the Threat Intelligence researchers by

providing raw and contextual underground data

that feeds into adversary profiling, enrichment pipelines, and client deliverables. The researcher will also help shape automation strategies for dark web monitoring within the CTI platform, working closely with analysts, AI/ML engineers, and incident responders.

Requirements

Underground Monitoring & Collection

+ Identify and infiltrate dark web marketplaces, forums, and closed channels (Telegram, IRC, Discord, etc.). + Track threat actors' chatter related to exploits, malware, credentials, and attack tools.
+ Conduct HUMINT-style engagement when permissible and safe.

Threat Data Harvesting

+ Extract and validate IOCs (hashes, domains, wallet addresses, C2 servers). + Correlate underground findings with OSINT, malware telemetry, and CTI feeds.
+ Provide early warning on data leaks, ransomware negotiations, and credential dumps.

Collaboration with CTI & AI Teams

+ Feed structured underground intelligence into the CTI platform for enrichment and scoring. + Partner with ML engineers to train NLP models for dark web text mining.
+ Work with TI analysts to transform raw chatter into

tactical and strategic intelligence

.

Reporting & Dissemination

+ Produce periodic dark web monitoring reports and client-specific alerts. + Contribute to

threat actor profiles, campaign tracking, and risk advisories

.
+ Provide insights to incident response and red team exercises.

Desired Skills

Technical Expertise

+ Deep knowledge of

Tor, I2P, Freenet, and underground marketplaces

. + Familiarity with

cryptocurrency ecosystems

(Bitcoin, Monero, mixers, blockchain tracing).
+ Proficiency in harvesting IOCs and mapping to frameworks like

MITRE ATT&CK

.
+ Understanding of

STIX/TAXII, MISP, and TI platform ingestion formats

.

Research & Intelligence

+ Strong OSINT/HUMINT tradecraft, ability to pivot from dark web to surface intel. + Experience monitoring

ransomware leak sites, carding forums, and exploit brokers

.
+ Analytical ability to contextualize underground activity in geopolitical/cybercrime terms.

Tooling & Automation

+ Hands-on with dark web monitoring tools (Flashpoint, KELA, DarkOwl, CyberSixgill, custom scrapers). + Scripting for data extraction (Python, Scrapy, APIs).
+ Familiarity with data visualization tools (Maltego, Kibana, Power BI).

Soft Skills

+ Ability to communicate

highly technical underground findings

in executive-friendly language. + Discretion, OPSEC awareness, and strong ethical boundaries.
+ Collaborative mindset with TI analysts, IR, and platform engineers.

Experience Required

7-10 years in cybersecurity/cyber threat intelligence

, with

5+ years focused on dark web research or underground monitoring

. Demonstrated experience infiltrating and monitoring dark web communities. Strong record of correlating dark web findings with

threat intelligence and incident response cases

. Hands-on exposure to CTI platforms (MISP, Anomali, ThreatConnect, Recorded Future, etc.). Familiarity with

malware ecosystems, data leaks, and exploit sales

. * Certifications desirable:

GCTI, GIAC Cyber Threat Intelligence, OSINT-specific certifications (Bellingcat, SANS OSINT), blockchain tracing certifications

.