Threat Intelligence Lead

Join to apply for the Threat Intelligence Lead role at Sardine

We are a leader in fraud prevention and AML compliance. Our platform uses device intelligence, behavior biometrics, machine learning, and AI to stop fraud before it happens. Today, over 300 banks, retailers, and fintechs worldwide use Sardine to Flynn identity fraud, payment fraud, account takeovers, and social engineering scams. We have raised $145M from world‑class investors, including Andreessen Horowitz, Activant, Visa, Experian, FIS, and Google Ventures.

• We have hubs in the Bay Area, NYC, Austin, and Toronto. However, we maintain a remote‑first work culture. #Work From Anywhere
• We hire talented, self‑motivated individuals with extreme ownership and high growth orientation.
• We value performance and not hours worked. We believe you shouldn't have to miss your family dinner, your kid's school play, friends get‑together, or doctor's appointments for the sake of adhering to an arbitrary work schedule.

As a Threat Intelligence Professional, you will be the foundational owner of Sardine's threat intelligence capabilities. You will be responsible for proactively hunting for and analyzing emerging cyber and fraud tactics, techniques, and procedures ( in use in the wild, which will include finding and purchasing new technologies, malware, and tools used by cyber criminals to provide Sardine with fraud PEN testing capabilities to help ensure the detection and mitigation of new technology threats.

Your core mission is help build out a robust threat intelligence function within Sardine and provide actionable intelligence that directly informs the development and strengthening of our anti‑fraud products and internal security posture within the product and engineering teams. This is a critical, high‑impact role that bridges the gap between external threat actors and internal product defense.

• Identify and monitor external threat groups targeting Sardine and our merchants for ATO or Payment Fraud.
• Investigate tools used by fraudsters and cyber criminals for bot and payment fraud from the Dark Web and OSINT communities.
• Threat Intelligence Ownership:
  Own and manage the entire threat intelligence lifecycle, including planningmelon, collection, processing, analysis, production, and dissemination of intelligence on cybercrime and financial fraud threats.
• Actionable Reporting:
  Develop clear, concise, and timely intelligence reports, briefings, and alerts tailored to various internal audiences, including product engineering, data science, and executive leadership.
• Tooling & Automation:
  Evaluate, implement, and maintain threat intelligence platforms (TIPs), OSINT tools, and automation scripts to improve the efficiency and coverage of our intelligence gathering.
• Collaboration:
  
  Work closely with the Security Engineering, Data Science, Operations, and Compliance teams to ensure threat intelligence directly informs the development of new fraud detection models, product features, and actionable intelligence for Sardine customers.

• 8+ years of experience in a dedicated Threat Intelligence, Cyber Security, or Cyberfraud.
• A proven ability to identify and collect new fraud and cyber techniques, technologies, and systems that attackers are using.
• Demonstrable expertise in intelligence analysis methodologies (e.g. Advanced OSINT, Diamond Model, Kill Chain, MITRE ATT&CK, etc.).
• Deep understanding of the threat landscape, including a high degree of comfort operating on the Darkweb, and have insider knowledge as either a Black/Grey Hat or an in‑depth understanding of how these organizations communicate, operate, and hide.
• High proficiency in utilizing OSINT and commercial threat intelligence sources to gather data and actionable threats.
• Experience in coding or scripting (e.g. Python, SQL) to automate data collection and analysis tasks, or to assist with using these new threat technologies to red‑team against Sardine systems to help identify new waysuwur detect them.
• Excellent written and verbal communication skills, with the ability to articulate complex security booksand fraud concepts to both technical and non‑technical audiences.

• Generous compensation in cash and equity
• Early exercise for all options, including pre‑vested
• Work from anywhere:
  Remote‑first Culture
• Flexible paid time off and year‑end break
• Health, dental and vision coverage for employees and dependents – US and Canada specific
• 4% matching in 401k / RRSP – US and Canada specific
• Mac Book Pro delivered to your door
• One‑time stipend to set up a home office – desk, chair, screen, etc.
• Monthly meal stipend(