Senior Threat Intelligence Researcher

Alice; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

Alice in London is seeking a Senior Threat Intelligence Researcher to lead technical threat research, author analytical reports, and monitor ongoing and emerging threats to stay ahead of adversaries.

The role requires deep CTI expertise, experience with OSINT/WEBINT methods, darkweb intelligence, and proficiency in communicating complex findings to clients and stakeholders. Collaboration with analysts and client account leads is essential.

Qualifications

• Must have experience in technical CTI threat hunting and databases/IPv4/IPv6 intelligence
• Experience with threat hunting platforms: VirusTotal, UrlScan, Greyhat Warfare, Shodan
• Experience in analyzing threat groups and actors using OSINT, WEBINT methodologies
• Darkweb and Cybercrime intelligence experience
• Strong English communication skills: ability to clearly communicate intelligence by writing reports or briefing clients
• Proven ability to gather and evaluate internet information from social media, chats and darknet forums
• Great verbal and written communication skills

Responsibilities

• Hunting, detecting, monitoring, and researching threats against Alice clients
• Analysis of threat groups and TTPs across different fraudulent ecosystems
• Researching and monitoring multiple sources through the clear, deep, and the dark web
• Produce technical reports for clients describing threat actor TTPs, analysis and exploits relevant for Alice’s clients
• Review, enrich and provide analyst tradecraft for other team members as part of the delivery process

Skills

Threat hunting

OSINT/WEBINT

Darkweb intelligence

Strong communication

Tools

VirusTotal

UrlScan

Greyhat Warfare

Shodan

Intel471

Recorded Future

CyberSixgill

Flashpoint

Job description

At Alice, our Cyber Threat Intelligence group thrives on curiosity and deep technical dive capabilities. We are looking for a Senior Threat Intelligence Researcher with a passion for CTI and a background in proxy research/ anti-bot defense/ web-scraping /threat hunting, with a proven ability to take initiative and conduct independent research with a track record of high-level results. In other words, not just an individual contributor, but a true talent that is seeking to make a mark in the industry. You will lead technical threat research, author analytical reports, and proactively monitor ongoing and emerging threats to keep us steps ahead of adversaries.

Responsibilities

• Hunting, detecting, monitoring, and researching threats against Alice clients.
• Analysis of threat groups and TTPs across different fraudulent ecosystems.
• Researching and monitoring multiple sources through the clear, deep, and the dark web.
• Produce technical reports for clients describing threat actor TTPs, analysis and exploits relevant for Alice’s clients. Work closely with client account leads and stakeholders, as well as collaborating with fellow analysts to produce intelligence reports.
• Review, enrich and provide analyst tradecraft for other team members as part of the delivery process. Prepare assessments of current threats and trends based on collection, research and analysis of classified intelligence collected by the teams.

Requirements

Must Have

• Experience in one of the following fields:
• Experience in technical CTI threat hunting - databases, IPv4/IPv6 intelligence,
• Experience with threat hunting platforms: VirusTotal, UrlScan, Greyhat Warfare, Shodan
• Experience in analyzing threat groups and actors using OSINT, WEBINT methodologies
• Darkweb and Cybercrime intelligence experience
• Strong English communication skills: ability to clearly communicate intelligence by writing reports, or briefing clients and other stakeholders
• Must have demonstrated experience in gathering and evaluating internet information from social media, chats and darknet forums
• Great verbal and written communication skills

Nice to Have

• Scripting (Python, BASH, and/or equivalent)
• Experience in operating threat intelligence collection platforms: Intel471, Recorded Future, CyberSixgill, Flashpoint and/or equivalent

About Alice

Alice is a trust, safety, and security company built for the AI era. We safeguard the communicative technologies people use to create, collaborate, and interact- whether with each other or with machines.

In a world where AI has fundamentally changed the nature of risk, Alice provides end-to-end coverage across the entire AI lifecycle. We support frontier model labs, enterprises, and UGC platforms with a comprehensive suite of solutions: from model hardening evaluations and pre-deployment red-teaming to runtime guardrails and ongoing drift detection.

Alice is widely considered a global leader in online safety and AI security. We have some of the most forward-thinking and passionate minds in the world working to safeguard over 3 billion users across the largest AI and tech platforms.

About the Position

At Alice, our Cyber Threat Intelligence group thrives on curiosity and deep technical dive capabilities. We are looking for a Senior Threat Intelligence Researcher with a passion for CTI and a background in proxy research/ anti-bot defense/ web-scraping /threat hunting, with a proven ability to take initiative and conduct independent research with a track record of high-level results. In other words, not just an individual contributor, but a true talent that is seeking to make a mark in the industry. You will lead technical threat research, author analytical reports, and proactively monitor ongoing and emerging threats to keep us steps ahead of adversaries.

Responsibilities

• Hunting, detecting, monitoring, and researching threats against Alice clients.
• Analysis of threat groups and TTPs across different fraudulent ecosystems.
• Researching and monitoring multiple sources through the clear, deep, and the dark web.
• Produce technical reports for clients describing threat actor TTPs, analysis and exploits relevant for Alice’s clients. Work closely with client account leads and stakeholders, as well as collaborating with fellow analysts to produce intelligence reports.
• Review, enrich and provide analyst tradecraft for other team members as part of the delivery process. Prepare assessments of current threats and trends based on collection, research and analysis of classified intelligence collected by the teams.

Requirements

Must Have

• Experience in one of the following fields:
• Experience in technical CTI threat hunting - databases, IPv4/IPv6 intelligence,
• Experience with threat hunting platforms: VirusTotal, UrlScan, Greyhat Warfare, Shodan
• Experience in analyzing threat groups and actors using OSINT, WEBINT methodologies
• Darkweb and Cybercrime intelligence experience
• Strong English communication skills: ability to clearly communicate intelligence by writing reports, or briefing clients and other stakeholders
• Must have demonstrated experience in gathering and evaluating internet information from social media, chats and darknet forums
• Great verbal and written communication skills

Nice to Have

• Scripting (Python, BASH, and/or equivalent)
• Experience in operating threat intelligence collection platforms: Intel471, Recorded Future, CyberSixgill, Flashpoint and/or equivalent

THE CHALLENGES ALONG THE WAY

1. Being Both Strategist and Executioner

One of the hardest parts of this role is that you’re both the visionary and the builder; the one drawing the mapandpaving the road.
That means switching between high-level strategy and hands-on experimentation daily, and doing it while bringing others along with you. There’s no playbook for this kind of work. You’re paving an unpaved road, one small experiment at a time.

2. Balancing Security and Innovation

ActiveFence is the leading provider of security and safety solutions for online experiences, safeguarding more than 3 billion users, top foundation models, and the world’s largest enterprises and tech platforms every day.
As a trusted ally to major technology firms and Fortune 500 brands that build user-generated and GenAI products, ActiveFence empowers security, AI, and policy teams with low-latency Real-Time Guardrails and a continuous Red Teaming program that pressure-tests systems with adversarial prompts and emerging threat techniques. Powered by deep threat intelligence, unmatched harmful-content detection, and coverage of 117+ languages, ActiveFence enables organizations to deliver engaging and trustworthy experiences at global scale while operating safely and responsibly across all threat landscapes.