Intelligence Analyst II, Buyer Threat Intelligence Unit

Written by the T&S Network from Amazon's posting.

Buyer threat intelligence work inside Amazon's Buyer Risk Prevention group, identifying and disrupting buyer-related fraud threats through dark web, encrypted channel and fraud-as-a-service collection. The Buyer Threat Intelligence Unit works upstream of detection teams, finding threats in criminal communities before they reach scale, and passes attribution to Legal and methodology to detection teams.

• Fraud and scams

What you'd do

• Watch dark web markets, carding forums, private Telegram and Discord groups and paste sites for exploits aimed at Amazon.
• Find, profile and follow threat actors, fraud-as-a-service sellers and organized rings going after buyers.
• Set investigation methodology, OPSEC standards and tooling workflows for the team.
• Walk ML and engineering partners through fraud decision points to turn findings into detection rules and model features.
• Send real-time warnings when live exploitation against buyers is spotted.
• Write at least one monthly fraud MO report for Legal covering attribution and likely impact.
• Write collection scripts and enrichment pipelines, and keep up referral channels with Legal and police.

What it asks for

• Bring 5+ years in threat intel, fraud work, risk analysis or cybercrime research.
• Know open-source investigation methods and research tradecraft well.
• Understand fraud ecosystems such as carding, account takeover, synthetic identity, refund abuse, phishing or fraud-as-a-service.
• Understand payment rails, e-commerce fraud vectors or chargeback patterns.
• Experience handling confidential information with discretion.
• Experience building partnerships with internal and external teams.
• Dark web and encrypted channel collection experience (preferred).

Terms in this role

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on Amazonnorth_east before you apply. If we got something wrong, report this listing.