Fraud Cyber Threat Intelligence Analyst

Overview

Fraud is easier to stop before it scales. The Fraud Threat Intelligence function finds attack methods, tooling and targeting while adversaries are still planning, using dark web, Telegram and fraudster-forum intelligence as an early warning signal rather than a post-incident explanation. In this role you will learn how fraudsters think, talk and probe our products, and turn what you find into defenses and policy changes before attacks show up in our traffic, protecting Intuit and millions of customers.

Responsibilities

• Monitor dark web forums, Telegram channels and other fraudster communities using approved tooling to identify chatter about Intuit products: account acquisition, attack manuals and attack results.
• Find fraud manuals and step-by-step schemes targeting Intuit products, ideally while still in planning, and assess credibility, feasibility and potential impact.
• Build and maintain a glossary of coded fraudster language and slang to find and interpret relevant conversations.
• Analyze fraudster bragging and shared artifacts (e.g., invoices, account data, screenshots) to identify affected customers and accounts and trigger mitigation within required timelines.
• Translate each discovered scheme into a defined action: policy change, detection rule, control or product fix. Work with Trust & Safety, Fraud Policy, Data Science, Product and Engineering to close the loop and track it to completion.
• Study Intuit products from the attacker's perspective and anticipate where fraudsters will probe next. Coordinate with the Fraud Red Team to validate suspected weaknesses.
• Produce clear intelligence products (early warnings, threat briefs, trend reports) for analysts, engineers and leadership, with sourcing and confidence levels.
• Partner with Legal early to define what intelligence collection is permitted and under what conditions; operate strictly within those limits and document them.
• Deliver actionable intelligence to partners in Fraud Red Team, Incident Response, and fraud investigations
• Manage the working relationship with intelligence vendors and request collection on emerging topics; assess vendor coverage gaps.
• Apply AI and automation to triage, translate, summarize and cluster large volumes of forum and channel content, reducing manual toil.
• Use data and logs to correlate external intelligence with activity seen on our platforms (SQL/Python).
  
  

• 10+ years in fraud analysis, threat intelligence, cyber threat intelligence, or OSINT (set to leveling guide).
• Demonstrated experience monitoring and analyzing underground forums, Telegram or similar fraudster communities.
• Working knowledge of the intelligence cycle and tradecraft: collection, sourcing, confidence, reporting.
• Fraud domain knowledge: identity theft, account takeover, synthetic identity, first-party fraud, tax and payment fraud.
• Proficiency with SQL and Python and comfort with data analysis of logs and large text datasets.
• Experience operating within legal, privacy and OpSec constraints when handling illicit content and stolen data.
• Strong written and verbal communication, able to brief both engineers and senior leaders and influence cross-team prioritization.
• Able to work independently in an ambiguous, fast-moving environment, and responsive during incidents.