What the work looks like
You own one source in our research data warehouse, such as newly registered domains, phishing feeds or honeypot data, and query it regularly with SQL and Metabase. You might spot a wave of new domains imitating a bank that people have started reporting to us, or a phishing kit from last month coming back. When something looks real, you investigate it yourself: confirm it against reports and other sources, work out how far it reaches, and write it up with the queries and numbers behind it and what they do and do not prove.
What you’ll do
- Work one data source on a regular schedule
- Spot new and recurring scam patterns in the data
- Investigate the patterns yourself and confirm them against reports and other sources
- Write up and publish what you find, with the queries and numbers behind every claim
- Spend about 20–30 minutes a day reviewing incoming reports with the rest of the team, and flag promising leads to your team lead.
What you’ll bring
- Comfort with data: SQL or a willingness to learn it
- Scepticism — a pattern isn't proof until it survives checking
What you’ll get
- Published work with your name on it
- Hands-on time with real investigation tooling and data
- A path to running your own investigations