Associate, Threat Intelligence

Kroll Cyber Threat Intelligence (CTI) is seeking a motivated and analytically minded Cyber Threat Intelligence Analyst based in India. The role focuses on identifying investigating and assessing cyber threats across open web deep web and dark web sources then translating fragmented information into clear defensible and actionable intelligence for global business clients. The successful candidate will support international engagements collaborate across regions and apply sound intelligence tradecraft to complex investigative questions.

Day-to-day responsibilities:

• Conduct targeted and exploratory investigations across open web deep web dark web and restricted-access sources to identify relevant threat activity exposed data fraud indicators brand abuse and emerging risk.
• Monitor underground forums marketplaces leak sites illicit communities messaging channels paste sites credential repositories and other relevant sources for client-specific threats and material changes in the threat landscape.
• Develop and refine collection plans search strategies source lists personas keywords and monitoring logic aligned to intelligence requirements and investigative objectives.
• Assess source reliability information credibility relevance and confidence; distinguish corroborated findings from unverified claims and clearly communicate analytical limitations.
• Analyze cybercrime ecosystems threat actors campaigns ransomware and extortion activity data-theft operations fraud schemes and associated tactics techniques and procedures.
• Correlate information from multiple sources to identify relationships patterns changes in behavior and implications for clients; maintain structured notes and an auditable evidentiary trail.
• Produce concise intelligence reports investigative updates threat assessments and executive briefings that communicate key judgments supporting evidence confidence and recommended actions.
• Provide focused investigative support during cyber incidents through threat actor research infrastructure and indicator enrichment leak-site monitoring and rapid assessment of external reporting.
• Conduct digital footprint and exposure monitoring to identify leaked credentials exposed information impersonation brand misuse third-party references and other indicators of potential risk.
• Participate in client communications including status updates investigative briefings and clarification of findings under the guidance of engagement leads.
• Track assigned workstreams document investigative steps meet delivery timelines and manage multiple concurrent tasks while maintaining quality responsiveness and professionalism.
• Collaborate with CTI peers incident response professionals engagement leads and regional stakeholders to deliver coordinated and intelligence-led client outcomes.

Essential Traits:

• Strong intelligence analytical skills including source evaluation corroboration hypothesis development structured analysis pattern recognition and the articulation of confidence and analytical gaps.
• Ability to synthesize large volumes of structured and unstructured information into clear key judgments and client-relevant implications.
• Understanding of cybercrime ecosystems threat actor behavior ransomware and extortion data theft fraud credential abuse brand exploitation and common threat actor TTPs.
• Ability to handle sensitive investigative information responsibly and maintain clear research notes source records and evidentiary documentation.
• Excellent written and verbal English communication skills with the ability to tailor analysis for technical and non-technical audiences.
• Ability to work independently exercise sound judgment and collaborate effectively within a distributed global team.
• Experience in a consulting managed intelligence investigations risk advisory or client services environment.
• Experience researching threat actors online aliases infrastructure malware campaigns victimology and relationships across underground ecosystems.
• Experience conducting both recurring monitoring and time-sensitive investigations against defined intelligence requirements.
• Experience preparing client-ready written products executive summaries investigative briefings or recurring monitoring reports.

Prerequisites:

• 1-3 years of experience in cyber threat intelligence dark web research cyber investigations OSINT fraud intelligence or a closely related analytical discipline.
• Demonstrated hands-on experience investigating and monitoring open web deep web and dark web sources including forums marketplaces leak sites illicit communities credential sources and breach data repositories.
• Familiarity with CTI OSINT dark web monitoring link-analysis breach-data cryptocurrency tracing and investigative case-management tools.
• Knowledge of intelligence frameworks and standards such as the intelligence cycle Structured Analytic Techniques MITRE ATT&CK STIX/TAXII and intelligence confidence language.
• Relevant certifications or training such as GCTI SANS FOR578 GIAC Open Source Intelligence or comparable CTI OSINT investigations or analytical tradecraft programs are a plus.
• Willingness to support global clients which may occasionally require flexible working hours that overlap with US or EMEA time zones.
• Strong sense of ownership discretion professionalism and commitment to high-quality client service.
• Comfort operating in a consulting model with multiple concurrent workstreams defined timelines and evolving investigative priorities.
• Continuous learning mindset and willingness to develop expertise across new sources tools threat actors and investigative methods.
• Brings disciplined curiosity strong analytical judgment and the ability to turn difficult-to-access information into clear intelligence that helps clients make informed decisions.

#LI-Hybrid
#LI-SP1