Intelligence
Threat Intelligence Analyst (Dark Web)
Monitor dark-web markets, forums and leak sites for activity that affects customers. You will turn raw sightings into intelligence that is accurate, timely and actionable, and that a customer can act on without second-guessing.
About the role
Why this role exists
Prava AI's threat intelligence module includes dark-web monitoring. Customers want to know when their credentials, data or brand appear in criminal markets, and they want to know quickly. They also need to trust that an alert is real and not recycled noise.
This role sits between collection and the customer. You will review what monitoring surfaces, check whether it is genuine, new and relevant, and write it up with a clear confidence level and recommended actions. A good alert explains what was seen, where, how confident we are and what the customer should do next.
You will also improve the collection and enrichment behind the module: which sources matter, how sightings are matched to customer assets, and how the platform's models summarise and score them. Your judgement trains the system as much as it serves the customer.
Responsibilities
What you will do
- Review sightings from dark-web markets, forums, paste sites and leak sites, and assess whether they are genuine, new and relevant to a customer.
- Write intelligence alerts and reports with clear sourcing, confidence levels and recommended actions.
- Track ransomware and extortion groups, initial access brokers and data leak activity relevant to customer sectors and regions.
- Improve how sightings are matched to customer domains, brands and assets, and reduce false positives.
- Contribute indicators and context to the platform in structured formats such as STIX.
- Work with DFIR, detection engineering and customers when a sighting points to a live incident.
- Maintain source assessments and collection notes so the team's knowledge does not live in one person's head.
Requirements
What you will bring
We care about what you can do, not where or how you learned it. If you meet most of these, we would like to hear from you.
- Experience producing cyber threat intelligence for customers or an internal security team.
- Familiarity with the criminal ecosystem: markets, forums, leak sites, access brokers and extortion groups.
- Strong analytic discipline, including source evaluation, confidence language and separating fact from assessment.
- Clear, concise writing for readers who need to act quickly.
- Strict operational security habits and respect for legal and ethical limits on collection.
- Comfort with structured data, frameworks such as MITRE ATT&CK and basic scripting for enrichment.
- The ability to stay steady when working with distressing or sensitive material.
Nice to have
Helpful, not required
Languages
Regional languages
Reading ability in languages common on criminal forums, such as Russian.
Data
Leak analysis
Experience assessing the authenticity and scope of leaked datasets.
Tooling
Automation
Experience building scrapers, parsers or enrichment pipelines responsibly.
Context
Sector knowledge
Knowledge of threats to a particular sector, such as finance, health or manufacturing.
Your first months
What progress looks like
These are typical outcomes, not fixed targets. Your manager will agree goals with you when you join.
First month
Settle in
You have learned our collection sources, alerting workflow and legal and ethical guidelines, and reviewed alerts alongside the team.
First three months
Contribute
You are writing customer alerts independently and have proposed changes that reduce false positives or improve matching for a class of sightings.
First six months
Own
You own coverage of a threat area or set of sources, and your assessments shape how the module scores and presents dark-web findings.
Tools and environment
How you will work
You will work with tools such as threat intelligence platforms, STIX/TAXII feeds, isolated and monitored research environments, Tor-capable browsing within those environments, Maltego, and Python for parsing and enrichment. Much of the analysis also happens in Prava AI's own threat intelligence features.
Collection tooling and environments are covered during onboarding, together with the rules that govern their use.
Hiring process
How we hire for this role
This follows our usual hiring process, adapted to the role. We reply to every application and tell you in advance what each stage involves.
- Application. Your CV and a short note about the intelligence work you have done.
- Introductory call. Your experience, how you think about sources and what you want next.
- Technical conversation. A discussion of how you assessed a sighting or threat actor and communicated it.
- Practical exercise. A scoped exercise to assess a set of synthetic sightings and write a short alert. We do not use your work in our product.
- Final conversations and offer. Time with leadership, then a written offer from an @prava.dev address.
Security and ethics
Working responsibly
Note. Dark-web analysts never buy data, pay for access or engage with threat actors, and never use deception to obtain information. All collection is passive, from approved sources, under written authorisation and in line with our Acceptable Use Policy and applicable law. Because the role involves access to sensitive material, offers may be subject to background checks where the law allows.
We never ask candidates for payment, bank details or fees, and interviews and offers come only from @prava.dev addresses. Read more about recruitment fraud and how we handle your application data under our Privacy Policy.
Benefits
What we offer
Benefits vary by country and employing entity, and the specifics are set out in each offer. They include pay set for the role and location, health cover, paid leave, support for learning, the equipment you need and working arrangements that suit the role. See benefits on the careers page. We are an equal opportunity employer; if you need an adjustment at any stage, tell us at careers@prava.dev.
Other open roles
Explore the team
- Security Researcher (Offensive) · Research
- Machine Learning Engineer (Security LLM) · AI
- DFIR Analyst · Detection and response
- Backend Engineer (Platform) · Engineering
- Detection Engineer · Detection and response
- Solutions Engineer · Customers
- Compliance and GRC Specialist · Customers
Do not see the right fit? Send a general application.
Next step
Apply for this role
Send your CV and a short note about an assessment you made and how you reached your confidence level. Public reports or research are welcome; describe your part and credit collaborators fairly. The Apply button opens an email to careers@prava.dev with the role in the subject line.