Company Description Overwatch Data equips organizations with the visibility and context they need to stay ahead of emerging digital threats. The company’s platform monitors global signals across news, social media, alternative forums, and the dark web, using machine learning to filter noise and prioritize relevant insights. Overwatch Data supports fraud, cyber, and global intelligence teams in understanding fast-moving risks so they can protect products, portfolios, and people. By providing a unified view of the threat landscape, the platform enables teams to act faster, make smarter decisions, and operate with confidence. Applicants joining Overwatch Data will work at the intersection of intelligence, technology, and risk mitigation.

Role Description

Initial Access: Establish and maintain access to illicit ecosystems across deep/dark web environments (Telegram, forums, closed communities)
Persona Operations: Design, deploy, and lifecycle-manage credible personas to enable sustained access and collection
Access Resilience: Continuously test, refine, and re-establish access following bans, platform shifts, or ecosystem changes
Collection Strategy: Identify high-value sources, prioritize coverage, and guide collection based on client needs (financial institutions, fraud, cyber, brand abuse, etc.)
Ecosystem Mapping and Monitoring: Track platform migrations, admin/mod behavior, access controls, and trust mechanisms within cybercrime communities, and help engineering design monitoring systems
Platform Understanding: Develop a structural understanding of platforms, sites, and access flows to effectively support collections engineers in building and maintaining scalable access
Cross-Functional Collaboration: Work closely with collections engineers and investigators to translate access challenges, platform behaviors, and ecosystem insights into improved collection strategies and coverage

Investigation Support:

Responsibilities may include:

Threat Intelligence Research + Analysis: Validate and contextualize data from illicit sources (logs, leaks, chatter, screenshots, files) both in the Overwatch Data platform and externally
HUMINT Engagement: Conduct controlled interactions where requested or deemed necessary to validate actors, offerings, or access pathways; which may include conducting covert test purchases
Fraud & Threat Analysis: Identify TTPs across fraud ecosystems (account takeover, phishing, social engineering, bill pay abuse, IVR abuse, etc.)
Narrative & Campaign Tracking: Detect emerging fraud narratives, clustering of campaigns, and cross-channel activity
Client-Focused Reporting: Produce Overwatch-style deliverables (Executive Summaries, FYSAs, Flash Reports, RFIs) translating raw chatter into actionable intelligence
IOC / TTP Development: Extract indicators, behavioral patterns, and operational insights for client defense and detection
Cross-Source Correlation: Link activity across forums, Telegram, domains, stealer logs, and external signals to build complete threat pictures

Core Competencies

Operational Security & Persona Management: Advanced OPSEC discipline with demonstrated ability to operate undetected in illicit environments. Skilled in persona creation, behavioral consistency, and access preservation.
Technical & Platform Awareness: Understanding of dark web infrastructure, onion routing, messaging platforms, and platform mechanics. Ability to analyze how access is gained, restricted, and maintained.
Cybercrime Ecosystem Knowledge: Familiarity with fraud and cybercrime communities, including Telegram networks, marketplaces, and forum structures. Ability to identify signal vs. noise.
Intelligence Analysis Skills: Ability to transform fragmented, unstructured data into clear intelligence. Strong pattern recognition across actors, tooling, and campaigns.
Documentation & Precision: Maintain detailed logs of personas, access methods, engagements, payments, and findings to ensure repeatability and operational continuity.
Communication & Reporting: Translate complex, technical findings into concise, client-ready intelligence with clear impact and recommendations.

Nice to Have

Financial Services Experience: Understanding of banking/fraud environments (ATO, payments, KYC abuse, scams) to better align collection and analysis with client risk
Foreign Language Skills: Russian, Spanish, or other relevant languages to support deeper access and interpretation of global communities
Investigative Tooling Experience: Familiarity with OSINT and threat intelligence tools, stealer log platforms, domain intelligence, and data analysis workflows

Overwatch Data jobs

Collections Manager / OSINT-HUMINT Investigator

Never Miss a New Opportunity