Senior Software Engineer: Ransomware Collections

Description

The company has 1,000+ intelligence professionals serving over 1,900 clients worldwide.

Customers include more than 50% of Fortune 100 companies, and users rate the product 4.6 stars on G2.

Staff come from over 40 nationalities.

This senior engineering role focuses on upgrading ransomware collection. The aim is to improve depth, reliability and differentiation in current collections, and to widen coverage into the wider network of infrastructure, identities, communities and relationships tied to ransomware activity.

The ideal person has solid collection engineering experience and understands how technical collection choices affect the confidence analysts and customers can place in intelligence.

You will work with the ransomware analysts and the wider collections group so automated access keeps pace as the ransomware ecosystem changes.

The main goal is collection that delivers intelligence beyond what open-source ransomware monitoring provides.

Success means the team's ransomware collection becomes harder to match with open-source monitoring alone. Analysts get earlier access to relevant information, more context on threat-actor claims, and stronger evidence linking actors, infrastructure, identities and operations. The role also helps the team adapt when actors change platforms, access controls, infrastructure or practices, turning recurring collection problems into lasting engineering solutions.

Responsibilities

• Take ownership of the engineering behind ransomware collection, focusing on reliability, coverage, timeliness and intelligence value.
• Extend collection past leak sites and other conventional sources toward user-focused approaches that reveal more about relevant actors and communities.
• Work closely with ransomware analysts to turn intelligence requirements and new investigative questions into scalable collection capabilities.
• Design and keep refining automated access strategies for ransomware sources, especially where authentication, anti-automation controls, infrastructure changes or other barriers make collection hard.
• Build infrastructure that lets the team find, access, monitor and preserve hard-to-collect ransomware intelligence at scale.
• Make existing ransomware collection systems more resilient and easier to maintain, while cutting manual work and operational overhead.
• Set up engineering patterns so new ransomware sources and collection methods can move quickly and reliably from experiment to production.
• Work with engineering, collections and analysis teams so collected data is structured and delivered in ways that add the most downstream intelligence value.
• Provide technical leadership and mentoring across the collections organization, helping set engineering standards and long-term architecture direction.

Requirements

• Be comfortable learning and working across the team's stack, which includes Python, Go and JavaScript/TypeScript; AWS, Docker, Kubernetes and Terraform; S3, PostgreSQL, Redis and distributed caching or storage; HTTP-based collectors, browser automation, headless browsers, Playwright or Selenium-style tools and authenticated session management; TOR, proxies, SOCKS, VPNs, distributed egress and specialized collection infrastructure; queue- and event-driven processing; GitHub, CI/CD pipelines, automated testing, observability and production monitoring; and dark-web and restricted-source collection, ransomware infrastructure, identity and entity resolution, and adversarial web environments.
• You do not need experience with every tool listed.
• Experience building reliable systems against unstable or intentionally hard-to-automate sources is particularly valuable.

Conditions

Base salary for this full-time role is $129,000 - $193,500.

Pay ranges depend on role, level and location. The figure shown covers new hire salaries for the position across all US locations.

Individual pay within the range depends on state, work location and factors such as job-related skills, experience, and relevant education or training.

The company is an equal opportunity and affirmative action employer, runs a drug-free workplace, and does not use lie detector tests as a condition of employment.

Benefits

• The role may be eligible for incentive compensation and equity.
• Medical, dental, vision, life insurance and 401K are offered.
• A recruiter can share more detail on the full compensation and benefits package during hiring.