Threat Actor Engagement & Intelligence Consultant (Remote - US only)

IllTip; United States; Remote; USD 90,000 - 150,000; Full time

Job summary

IllTip is a remote, client-facing threat intelligence and digital forensics consulting role serving Fortune 500 firms and government agencies. You will engage with threat actors during ransomware and data extortion cases, gather intelligence, and advise victims on sound actions.

The position emphasizes turning engagement findings into operational threat intelligence. The role requires building automation, supporting DFIR investigations, and delivering clear engagement deliverables for technical

Qualifications

• 2–4 years experience communicating with threat actors
• At least 2 years in threat intelligence analysis or collection
• Experience building persona operations and working with dark web forums/ marketplaces
• Familiarity with DFIR workflows, processes and deliverables
• Prior consulting or client-facing professional services experience
• Experience using AI tools; U.S. residency required

Responsibilities

• Lead threat actor communications for ransomware and data extortion cases, advising clients, legal counsel and insurance carriers on risks and options
• Support active digital forensics and incident response investigations by identifying and sharing actionable intelligence
• Author clear engagement deliverables for both technical and executive audiences, including findings, business impact and realistic remediation steps
• Build automation and scripting that streamline intelligence workflows and expand team capabilities
• Contribute to the evaluation and integration of open-source and commercial threat intelligence tools
• Participate in a rotating on-call schedule, including occasional weekend work for emergencies

Skills

Threat actor communication

Threat intel analysis

Persona operations

Dark web research

DFIR workflows

Client-facing

AI tools

Job description

S.). This is a client-facing consulting role within the threat intelligence and digital forensics group of a large, profitable cybersecurity services company that serves Fortune 500 firms and government agencies. The core work is engaging with threat actors during ransomware and data extortion cases on behalf of clients, gathering intelligence, and advising victims on sound courses of action. The successful candidate will also turn engagement findings into operational threat intelligence. The position is remote and does not require travel.

Responsibilities

• Lead threat actor communications for ransomware and data extortion cases, advising clients, legal counsel and insurance carriers on risks and options
• Support active digital forensics and incident response investigations by identifying and sharing actionable intelligence
• Author clear engagement deliverables for both technical and executive audiences, including findings, business impact and realistic remediation steps
• Build automation and scripting that streamline intelligence workflows and expand team capabilities
• Contribute to the evaluation and integration of open-source and commercial threat intelligence tools
• Participate in a rotating on-call schedule, including occasional weekend work for emergencies

Requirements

• 2 to 4 years of experience communicating with threat actors, such as in ransomware negotiations or through virtual persona or sock puppet operations
• At least 2 years of threat intelligence analysis or collection experience
• Experience building persona operations and working with dark web forums and marketplaces, with an understanding of adversary behavior
• Familiarity with DFIR workflows, processes and deliverables
• Prior consulting or client-facing professional services experience, with the ability to stay calm under pressure
• Experience using AI tools to work more efficiently and solve problems; U.S. residency required

Applicants must be based in: United States.