> Markdown version of [/jobs/ext/1239072-ransomware-intelligence-analyst](https://www.wearedevelopers.com/jobs/ext/1239072-ransomware-intelligence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Ransomware Intelligence Analyst - **Company:** FRAMEWORK VENTURES, L.L.C. - **Location:** New York, NY, United States - **Experience:** Expert - **Salary:** $150,000.0 - $180,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Data Analysis, Cyber Security, Data Integration, Data Visualization, Digital Forensics, Intelligence Analysis, Python (Programming Language), NumPy, Open Source Technology, Open Source Intelligence, Blockchain, Technical Data Management Systems, Jupyter Notebook, Scripting, Mitre Att&ck, Malware, Pandas, Matplotlib, Information Technology, Plotly, Databricks - **Published:** July 11, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=40b365530b6c23d5 ## About the Role techniques.Produce high-impact finished intelligence and deliver briefings for a wide variety of audiences, including executives, information security personnel, customers, media, and the general public.Collaborate across security operations, incident response, and engineering teams to ensure effective integration of data and research into the Halcyon Anti-Ransomware Platform.Maintain working relationships with external partners, law enforcement, and intelligence-sharing alliances to support broader counter-ransomware efforts.Identify opportunities to degrade or disrupt ransomware operations through exposure, disruption, or legal/policy collaboration.Skills and Qualifications:5+ years of experience in cyber threat intelligence, cryptocurrency tracing, digital forensics, or a related role.Bachelor's degree in Computer Science, Cybersecurity, or Digital Forensics; or Intelligence Analysis, Data Analysis, Applied Math or Statistics, or related degrees with appropriate additional cyber coursework.Deep familiarity with ransomware-as-a-service (RaaS) models, affiliate structures, and the evolution of extortion and data leak tactics.Strong understanding of malware analysis workflows, underground forums, and ransomware payment infrastructure (e.g., crypto tracing, leak site activity).Proficiency with a scripting language (Python preferred) for data collection, transformation, and analysis.Fluency with common open source intelligence (OSINT), cyber threat intelligence, and/or blockchain research tools.Understanding of enrichment sources (e.g., VirusTotal, Shodan, AbuseIPDB, etc.).Proven ability to integrate intelligence (e.g., structure analytic techniques, Diamond Model) and tracking methodologies (e.g., Mitre ATT&CK, Cyber Kill Chain) to assess cyber threat activity.Strong research and writing skills with a track record of producing high-impact ransomware intelligence reports that connect patterns across technical and non-technical data and context.Exceptional communication skills - both written and verbal - with the ability to brief leadership and influence decision-making.Ability to research independently and then use that independent work to collaborate effectively with team members and external partners.Experience supporting or briefing law enforcement, government, or sector-wide ransomware initiatives.Bonus Skills and Qualifications:Familiarity with a Databricks environment, including notebooks, Delta tables, and job scheduling.SQL proficiency for querying structured data with Databricks and other databases.Experience with Pandas, NumPy, and other Python data analysis libraries.Comfort with Jupyter notebooks and data visualization libraries (Matplotlib, Seaborn, Plotly).Proficiency in a high-priority foreign language like Russian, Mandarin Chinese, Portuguese, or Farsi.Benefits:Comprehensive healthcare (medical, dental, and vision) with premiums paid in full for employees and dependents.401k plan with a generous employer, in tooling, access brokers, and extortion techniques.Produce high-impact finished intelligence and deliver briefings for a wide variety of audiences, including executives, information security personnel, customers, media, and the general public.Collaborate across security operations, incident response, and engineering teams to ensure effective integration of data and research into the Halcyon Anti-Ransomware Platform.Maintain working relationships with external partners, law enforcement, and intelligence-sharing alliances to support broader counter-ransomware efforts.Identify opportunities to degrade or disrupt ransomware operations through exposure, disruption, or legal/policy collaboration.Skills and Qualifications:5+ years of experience in cyber threat intelligence, cryptocurrency tracing, digital forensics, or a related role.Bachelor's degree in Computer Science, Cybersecurity, or Digital Forensics; or Intelligence Analysis, Data Analysis, Applied Math or Statistics, or related degrees with appropriate additional cyber coursework.Deep familiarity with ransomware-as-a-service (RaaS) models, affiliate structures, and the evolution of extortion and data leak tactics.Strong understanding of malware analysis workflows, underground forums, and ransomware payment infrastructure (e.g., crypto tracing, leak site activity).Proficiency with a scripting language (Python preferred) for data collection, transformation, and analysis.Fluency with common open source intelligence (OSINT), cyber threat intelligence, and/or blockchain research tools.Understanding of enrichment sources (e.g., VirusTotal, Shodan, AbuseIPDB, etc.).Proven ability to integrate intelligence (e.g., structure analytic techniques, Diamond Model) and tracking methodologies (e.g., Mitre ATT&CK, Cyber Kill Chain) to assess cyber threat activity.Strong research and writing skills with a track record of producing high-impact ransomware intelligence reports that connect patterns across technical and non-technical data and context.Exceptional communication skills - both written and verbal - with the ability to brief leadership and influence decision-making.Ability to research independently and then use that independent work to collaborate effectively with team members and external partners.Experience supporting or briefing law enforcement, government, or sector-wide ransomware initiatives.Bonus Skills and Qualifications:Familiarity with a Databricks environment, including notebooks, Delta tables, and job scheduling.SQL proficiency for querying structured data with Databricks and other databases.Experience with Pandas, NumPy, and other Python data analysis libraries.Comfort with Jupyter notebooks and data visualization libraries (Matplotlib, Seaborn, Plotly).Proficiency in a high-priority foreign language like Russian, Mandarin Chinese, Portuguese, or Farsi.Benefits:Comprehensive healthcare (medical, dental, and vision) with premiums paid in full for ## Description What we do:Halcyon is the industry's first dedicated, adaptive security platform that combines multiple proprietary advanced prevention engines along with AI models focused specifically on stopping ransomware.Who we are:Halcyon was formed in 2021 by a team of cyber industry veterans after battling the scourge of ransomware (and advanced threats) for years at some of the largest global security vendors. Comprised of leaders from Cylance (now Blackberry), Accuvant (now Optiv), Fireye and ISS X-Force (now IBM), Halcyon is focused on building products and solutions for mid-market and enterprise customers. As a remote-native, completely distributed global team, we recognize great talent can exist anywhere.The Role:Our newly created Ransomware Research Center is looking for a curious and driven Ransomware Intelligence Analyst to conduct ransomware-focused intelligence and research efforts. In this role, you will track threat actors, understand their tradecraft, map affiliate operations, and analyze cryptocurrency transactions to produce intelligence that protects organizations from extortion, data theft, and operational disruption. This isn't a role where you'll be handed a playbook and told to color inside the lines. You'll have the autonomy and trust to shape this position and deliverables for success. The role is ideal for an experienced intelligence or threat analyst who is ready to take ownership, bring bold ideas to the table, and see them through to real-world impact.Responsibilities:Conduct proactive research on Monitor open-source, underground, technical data, and proprietary intelligence sources to track ransomware operations, leaks, and affiliate activity.Drive strategic and operational intelligence analysis of ransomware groups, including actor motivations, affiliate networks, victim targeting, and revenue models.Hunt for threat actor infrastructure, map evolving TTPs for high-impact ransomware families, and track shifts in tooling, access brokers, and extortion, What we do:Halcyon is the industry's first dedicated, adaptive security platform that combines multiple proprietary advanced prevention engines along with AI models focused specifically on stopping ransomware.Who we are:Halcyon was formed in 2021 by a team of cyber industry veterans after battling the scourge of ransomware (and advanced threats) for years at some of the largest global security vendors. Comprised of leaders from Cylance (now Blackberry), Accuvant (now Optiv), Fireye and ISS X-Force (now IBM), Halcyon is focused on building products and solutions for mid-market and enterprise customers. As a remote-native, completely distributed global team, we recognize great talent can exist anywhere.The Role:Our newly created Ransomware Research Center is looking for a curious and driven Ransomware Intelligence Analyst to conduct ransomware-focused intelligence and research efforts. In this role, you will track threat actors, understand their tradecraft, map affiliate operations, and analyze cryptocurrency transactions to produce intelligence that protects organizations from extortion, data theft, and operational disruption. This isn't a role where you'll be handed a playbook and told to color inside the lines. You'll have the autonomy and trust to shape this position and deliverables for success. The role is ideal for an experienced intelligence or threat analyst who is ready to take ownership, bring bold ideas to the table, and see them through to real-world impact.Responsibilities:Conduct proactive research on Monitor open-source, underground, technical data, and proprietary intelligence sources to track ransomware operations, leaks, and affiliate activity.Drive strategic and operational intelligence analysis of ransomware groups, including actor motivations, affiliate networks, victim targeting, and revenue models.Hunt for threat actor infrastructure, map evolving TTPs for high-impact ransomware families, and track shifts ## Related Videos - [Python Data Visualization @ Deepnote (w/ PyViz overview)](https://www.wearedevelopers.com/videos/113-python-data-visualization-deepnote-w-pyviz-overview) - [Vectorize all the things! Using linear algebra and NumPy to make your Python code lightning fast.](https://www.wearedevelopers.com/videos/562-vectorize-all-the-things-using-linear-algebra-and-numpy-to-make-your-python-code-lightning-fast) - [Advanced Typing in TypeScript](https://www.wearedevelopers.com/videos/496-advanced-typing-in-typescript) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Getting to Know Your Legacy (System) with AI-Driven Software Archeology](https://www.wearedevelopers.com/videos/1437-getting-to-know-your-legacy-system-with-ai-driven-software-archeology) - [How to implement convenient Python bindings to C++](https://www.wearedevelopers.com/videos/618-how-to-implement-convenient-python-bindings-to-c) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [13 AI Tools You Have to Try](https://www.wearedevelopers.com/magazine/219-13-ai-tools-you-have-to-try)