Staff Security Analyst, Threat Intelligence

Robinhood Robinhood · Fintech · Ljubljana, Slovenia, Menlo Park, CA +1 · Security Division

Robinhood is seeking a Staff Security Analyst, Threat Intelligence to join their elite team. This role involves proactively hunting for and mapping criminal ecosystems targeting the company and its customers, translating intelligence into scalable systems and defenses, and building comprehensive threat universes. The analyst will establish and mature a threat intelligence lifecycle, investigate attacker infrastructure, coordinate takedowns, and design automated intelligence workflows. The role requires strong analytical skills, experience with OSINT tooling and data analysis, and the ability to communicate complex threats to various stakeholders.

What you'd actually do

  1. Proactively hunt and map criminal ecosystems targeting Robinhood and its customers, then translate intelligence into scalable systems and coordinated defenses that disrupt adversaries before they cause harm.
  2. Build and operationalize a comprehensive “Universe of Threats” by identifying, tracking, and prioritizing adversaries across phishing, scams, impersonation, fraud, and infrastructure abuse.
  3. Establish and mature a proactive threat intelligence lifecycle by developing industry partnerships, collaborating with trusted peers and federal authorities, and cultivating online personas to generate early warning capabilities that protect Robinhood’s business operations.
  4. Investigate attacker infrastructure across domains, DNS, certificate transparency logs, cloud providers, and telecom platforms, and convert findings into concrete detections, controls, and customer protections.
  5. Coordinate threat actor infrastructure takedowns with hosting providers, domain registrars, cloud platforms, and other infrastructure partners to disrupt adversary operations at scale.

Skills

Required

  • 8–12+ years of total experience, including 3–5+ years operating at a senior or staff-level scope in threat intelligence, brand protection, or cyber investigations.
  • Hands-on experience tracking criminal ecosystems tied to phishing, scams, impersonation, fraud, and infrastructure abuse, and the ability to move from isolated indicators to campaign- and actor-level analysis.
  • Deep familiarity with domain registration patterns, DNS and certificate transparency analysis, cloud and hosting abuse across providers (e.g., AWS, GCP, Azure, VPS), and attacker monetization methods.
  • Experience using OSINT tooling, SQL, Python, notebooks, SIEM or SOAR platforms, OpenCTI, and case management systems to analyze data and automate workflows.
  • Ability to translate complex technical threats into clear business risk for technical teams and executive audiences through strong written and verbal communication.
  • Experience mentoring others or leading initiatives across teams, with a high level of accountability and sound risk judgment in ambiguous situations.

Nice to have

  • Experience with crypto investigations or on-chain analysis.
  • Background in highly regulated industries such as fintech, financial services, payments, crypto, healthcare, or government.

What the JD emphasized

  • Hands-on experience tracking criminal ecosystems tied to phishing, scams, impersonation, fraud, and infrastructure abuse
  • Deep familiarity with domain registration patterns, DNS and certificate transparency analysis, cloud and hosting abuse across providers (e.g., AWS, GCP, Azure, VPS), and attacker monetization methods.