Back to jobs
New

Senior Software Engineer: Ransomware Collections

Washington, DC

With 1,000+ intelligence professionals serving over 1,900 clients worldwide, Recorded Future is the world’s most advanced, and largest, intelligence company!

We are seeking a Senior Engineer to help advance the next generation of our ransomware collection capabilities. This role will be responsible for improving the depth, reliability, and differentiation of our existing ransomware collections while expanding beyond traditional threat-actor sites into the broader ecosystem of infrastructure, identities, communities, and relationships surrounding ransomware activity.

The ideal candidate combines strong collection engineering experience with an understanding of how technical collection decisions translate into higher-confidence intelligence for analysts and customers. This engineer will work closely with our ransomware analyst and broader collections organization to ensure that our automated access strategy evolves alongside changes in the ransomware ecosystem.

A central objective of this role is to build collection capabilities that consistently provide intelligence beyond what is readily available through open-source ransomware monitoring.

What You'll Do:

  • Own and improve engineering capabilities supporting ransomware collection, with an emphasis on reliability, coverage, timeliness, and intelligence value.
  • Expand ransomware collection beyond leak sites and other conventional sources into user-focused approaches that provide greater visibility into relevant actors and communities.
  • Partner closely with ransomware analysts to translate intelligence requirements and emerging investigative questions into scalable technical collection capabilities.
  • Develop and continuously refine automated access strategies for ransomware-related sources, particularly where authentication, anti-automation controls, infrastructure changes, or other access challenges make collection difficult.
  • Build infrastructure that enables the team to discover, access, monitor, and preserve difficult-to-collect ransomware intelligence at scale.
  • Improve the resilience and maintainability of existing ransomware collection systems while reducing manual intervention and operational overhead.
  • Establish engineering patterns that allow new ransomware sources and collection methodologies to move efficiently and reliably from experimentation into production.
  • Collaborate across engineering, collections, and analysis teams to ensure collected data is structured and delivered in ways that maximize downstream intelligence value.
  • Contribute technical leadership and mentorship within the collections organization, helping establish engineering standards and long-term architectural direction.

Technology & Engineering Environment:

Our collection systems operate across cloud infrastructure, distributed collection services, browser automation, and specialized network environments. Candidates do not need experience with every technology but should be comfortable learning and operating across the type of stack that includes:

  • Languages: Python, Go, JavaScript/TypeScript
  • Cloud & Infrastructure: AWS, Docker, Kubernetes, Terraform
  • Data & Storage: S3, PostgreSQL, Redis and distributed caching/storage systems
  • Collection & Automation: HTTP-based collectors, browser automation, headless browsers, Playwright/Selenium-style tooling, authenticated session management
  • Network & Access: TOR, proxies, SOCKS, VPNs, distributed egress and specialized collection infrastructure
  • Messaging & Processing: Queue- and event-driven processing architectures
  • Engineering: GitHub, CI/CD pipelines, automated testing, observability and production monitoring
  • Security & Intelligence: Dark-web and restricted-source collection, ransomware infrastructure, identity and entity resolution, and adversarial web environments

Experience building reliable systems against unstable or intentionally difficult-to-automate sources is particularly valuable.

What Success Looks Like:

Success in this role means that our ransomware collection capability becomes increasingly difficult to replicate through open-source monitoring alone. Analysts should have earlier access to relevant information, greater context surrounding threat-actor claims, and stronger evidence for understanding relationships between actors, infrastructure, identities, and ransomware operations. The engineer in this role should also materially improve our ability to adapt as ransomware actors change platforms, access controls, infrastructure, and operating practices. They will turn what would otherwise be recurring collection problems into durable engineering capabilities.

 

The base salary range for this full-time position is $129,000 - $193,500. Our salary ranges are determined by role, level, and location. The salary displayed reflects the range for new hire salaries for the position across all US locations. Within the range, individual pay is determined by state, work location and additional factors, including job-related skills, experience, and relevant education or training. This position may be eligible for incentive compensation, equity, and medical, dental, vision, life insurance and 401K. Your recruiter can share more about the specific details of the compensation and benefit package during the hiring process.

Why should you join Recorded Future?
Recorded Future employees (or “Futurists”), represent over 40 nationalities and embody our core values of having high standards, practicing inclusion, and acting ethically. Our dedication to empowering clients with intelligence to disrupt adversaries has earned us a 4.6-star user rating on G2 and more than 50% of Fortune 100 companies as customers.

Want more info? 
Blog & Podcast: Learn everything you want to know (and maybe some things you’d rather not know) about the world of cyber threat intelligence
Linkedin, Instagram & Twitter: What’s happening at Recorded Future
The Record: The Record is a cybersecurity news publication that explores the untold stories in this rapidly changing field
Timeline: History of Recorded Future
Recognition: Check out our awards and announcements

We are committed to maintaining an environment that attracts and retains talent from a diverse range of experiences, backgrounds and lifestyles.  By ensuring all feel included and respected for being unique and bringing their whole selves to work, Recorded Future is made a better place every day.

If you need any accommodation or special assistance to navigate our website or to complete your application, please send an e-mail with your request to our recruiting team at careers@recordedfuture.com 

Recorded Future is an equal opportunity and affirmative action employer and we encourage candidates from all backgrounds to apply. Recorded Future does not discriminate based on race, religion, color, national origin, gender including pregnancy, sexual orientation, gender identity, age, marital status, veteran status, disability or any other characteristic protected by law.

Recorded Future will not discharge, discipline or in any other manner discriminate against any employee or applicant for employment because such employee or applicant has inquired about, discussed, or disclosed the compensation of the employee or applicant or another employee or applicant.

Recorded Future does not administer a lie detector test as a condition of employment or continued employment. This is in compliance with the law of the Commonwealth of Massachusetts, and in alignment with our hiring practices across all jurisdictions.

Recorded Future maintains a drug-free workplace.

Note: Our interview process for all final-round candidates requires a mandatory in-person interview or a live, scheduled video conference with the hiring manager. We do not conduct interviews via instant messaging or text. All communications during the application process will come from individuals within our HR department via their Recorded Future email address.

Notice to Agency and Search Firm Representatives: Recorded Future will not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to Recorded Future, including those sent to our employees or through our website, will become the property of Recorded Future. Recorded Future will not be liable for any fees related to unsolicited resumes.

Agencies must have a valid written agreement in place with Recorded Future's recruitment team and must receive written authorization before submitting resumes. Submissions made without such agreements and authorization will not be accepted and no fees will be paid.

Create a Job Alert

Interested in building your career at Recorded Future? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Select...
Select...
Select...

If No, enter "N/A". If Yes please provide: (1) the name of the Mastercard or Recorded Future employee you have a close personal relationship with, and (2) the nature of that relationship.

Examples of close personal relationships include relatives (parent, grandparent, child, sibling, spouse, significant other, domestic partner, common law spouse, aunt/uncle, niece/nephew, cousin, in-law, and step/half relative); current or previous romantic or dating partners (no matter how casual); and any other relationship that is likely to or creates an actual or perceived conflict of interest or appearance of favoritism (for example, roommates and close friends). Close personal relationships would generally not include any former co-workers or managers with whom you do not regularly socialize outside of work.

 If No, enter "N/A." If Yes, please provide: (1) the name of the entity for which you will be performing the outside activity and the entity’s website, if available; (2) a description of what the entity does and the industry in which it operates; (3) a description of your role at the entity; and (4) the number of hours you will devote to the activity each month.

Examples of outside employment/activities include paid employment or other lawful money-making (cash or cash equivalent) activity that will not be part of your official role at Recorded Future; service on the board of directors or an advisory board of any entity (including non-profit), even if the position is unpaid; and service (paid or unpaid) in any national, state, provincial, regional, or local government, including any government department, ministry, agency, authority, commission, legislature, council, other public body (such as the World Bank or other public international organization), or state-owned enterprise.

If No, enter "N/A". If Yes, please describe the contract(s), the nature of your involvement, and list the name(s) of the involved Mastercard or Recorded Future employee(s). 

If No, enter "N/A". If Yes, please state the name of the individual, his/her employer and the nature of your relationship to this individual. If you answered "No", enter N/A

If Yes, please describe. If No, enter "N/A"

If yes, state the name of the individual, his/her employer and the nature of your relationship to this individual. If No, enter "N/A"

Recorded Future – Candidate Privacy Notice *

This candidate privacy notice explains who we are, why and how we process personal data relating to candidates and, if you are the subject of any of the personal data concerned, your rights and our contact details if you want further information or help.

When you apply for a job on www.recordedfuture.com the personal data contained in your application will be collected and processed by Recorded Future, Inc. (“we, us, our”). For the purposes of European Economic Area data protection law, (the "Data Protection Law"), the data controller is: Recorded Future, Inc., 225 Franklin St, 13th Floor, Boston, MA 02110 recruiting@recordedfuture.com ("Controller"). Our data protection officer is Frederic Wolens, who can be contacted at privacy@recordedfuture.com

We may process personal data relating to you that we have either obtained from you, or obtained from a third party including your previous or existing employers or reference agencies.  

Personal data we may collect from you:

-Your name and contact information (home address, home phone number, personal mobile number, personal email address).
-Your country of residence, citizenship, passport information and information relevant to your right of residence or right to work.
-Your date of birth.
-Your national insurance or social security details, or other similar information that is used by the government to identify you.
-Your gender.
-Your bank account information or other related financial details.
-Details of your education and previous employment history.
-Your driver's license and related information
-Your photograph.

We may process special categories of information relating to you. The processing of this information is strictly controlled by applicable law and will only be processed in limited circumstances, and may include:

Information relating to your physical characteristics, health or any disabilities, where this is relevant to your occupation or employment (for example, for the purposes of occupational health).

Information relating to your marital status, racial characteristics or sexual orientation where this is relevant to, for example, diversity monitoring.  This will normally only be processed with your consent in which case you are free to choose to provide this information, or not.

Your personal data will be processed for our legitimate interests for the purpose of managing our recruitment related activities, which include the setting up and conducting of interviews and tests for applicants, evaluating and assessing the results thereto and the selection of applicants for employment. As part of the recruitment and hiring processes we will need to process your personal data for the performance of a contract where we have offered you a position with our company.

Your personal data will be shared with Greenhouse Software, Inc., a cloud services provider located in the United States of America and engaged by us to help manage our recruitment and hiring process on our behalf. Accordingly, if you are located outside of the United States, your personal data will be transferred to the United States once you submit it through this site. Because the European Union Commission has determined that United States data privacy laws do not ensure an adequate level of protection for personal data collected from EU data subjects, the transfer will be subject to appropriate additional safeguards under the EU-US Privacy Shield.

Your personal data will be retained by us for as long as we decide that it is necessary to evaluate your application and determine whether to make you an offer of employment. After which it will be deleted or archived except to the extent that it is necessary for us to continue to process it for the purpose of compliance with legal obligations to which we are subject or for another legitimate and lawful purpose.

Under the GDPR, you have the right to request (i) access to your personal data, (ii) that your personal data be rectified or erased; and (iii) that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with your local supervisory authority. The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Recorded Future’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...