About Overwatch Data

Overwatch Data is building the intel and risk teams of the future. We combine reliable automation, AI agents, and a team of creative technical experts to make catching the known-knowns easier and uncovering the unknown-unknowns possible.

Our platform helps financial institutions, digital-facing companies, and other organizations identify and investigate cyber-enabled fraud across the open, deep, and dark web. We turn fragmented data into timely, evidence-backed intelligence that risk teams can act on.

About the Role

We are looking for a Fraud/Cyber Threat Intelligence Investigator who can turn complex and incomplete information into clear, actionable intelligence for customers.

The role combines responsive intelligence work, answering customer Requests for Information (RFIs), with proactive research into emerging fraud threats, actors, methods, and criminal ecosystems. You will also help discover valuable new sources, analyze fraud tactics, techniques, and procedures (TTPs), and produce high-quality intelligence reports.

This is primarily an intelligence research and production role, not a collections role. You will collaborate with collections, engineering, data science, product, and customer teams to answer important questions, anticipate emerging risks, and improve how intelligence is produced at scale.

What You’ll Do

RFIs, Research, and Analysis

Own customer RFIs from intake through delivery: clarify the question, define scope, conduct research, assess the evidence, and produce the response.
Conduct rapid-turnaround investigations and longer-term research into fraud schemes, threat actors, criminal communities, exposed data, suspicious infrastructure, and emerging campaigns.
Search, validate, and contextualize information from Overwatch’s own threat intelligence collections, and if needed, external open sources, social platforms, messaging applications, forums, marketplaces, breach data, stealer logs, domains, and other relevant sources.
Analyze how fraud schemes operate end to end, including actor roles, infrastructure, tools, victim targeting, monetization methods, and potential intervention points.
Track changes in fraud TTPs across areas such as account takeover, payment fraud, phishing, social engineering, scams, compromised data, identity abuse, and money-mule activity.
Correlate activity across sources and clearly distinguish confirmed facts, analytical judgments, hypotheses, intelligence gaps, and recommendations.

Source Discovery

Help identify and evaluate new open, deep, and dark-web sources relevant to customer requirements and emerging fraud trends.
Assess forums, marketplaces, messaging channels, websites, and online communities for their relevance, reliability, uniqueness, and intelligence value.
Map source migrations and relationships among communities, actors, administrators, and platforms.
Document source characteristics and coverage gaps, and work with collections and engineering teams to prioritize new coverage.
Support, but not primarily own, persistent access, persona management, or scaled collection infrastructure.

Reporting and Collaboration

Produce concise, client-ready RFI responses, executive summaries, flash reports, threat assessments, actor profiles, and longer-form research reports.
Turn raw posts, screenshots, files, logs, and indicators into findings that explain what happened, why it matters, and what customers should consider doing next.
Preserve source links, timestamps, evidence, confidence assessments, and investigative steps so findings are reproducible and defensible.
Identify indicators, TTPs, and detection or disruption opportunities that customers can use in fraud prevention and investigations.
Present findings in customer briefings and respond to follow-up questions with appropriate context and nuance.
Translate recurring customer questions and research findings into monitoring priorities, new collection requirements, and product improvements.
Review analyst- and AI-generated intelligence for accuracy, clarity, relevance, and sourcing.