Threat Hunter (OSINT and DARKINT)

Specialist Threat Hunter (OSINT and DARKINT)

1. Location: Tallinn, Estonia. Stingbase Lab, Valukoja 10, Ülemiste City. On-site, full-time.
2. Employer: Sting Unit, LLC (a wholly-owned subsidiary of Stingbase, Ltd.)
3. Reports to: Sting Unit investigations lead, in daily collaboration with the Stingbase product and engineering leads.
4. Engagement: Permanent, full-time, on-site. Minimum two-year on-site commitment; after that, some remote or hybrid working may become possible.
5. Because of character limitations, the full job description cannot fit here, it will be posted at https://stingbase.com/job-threat-hunter/ soon.

We would rather be upfront now than waste your time, so please do not apply if:

1. You are not willing to relocate to Tallinn, Estonia and be on-site for at least two years. After that, once the team and platform are established, some remote or hybrid working may well become possible. At the start, being in the room is the whole point.
2. English is not your first language, unless your English is genuinely exceptional. You will write investigation briefs that law enforcement and prosecutors rely on, so near-native written and spoken fluency is essential. English is the official working language of the team.
3. You think this is a dream job, but you don't have the experience and track record that we need.

About Stingbase, Sting Unit, and Stingforce

Stingbase, Ltd. is building an investigation platform purpose-built for transnational, cyber-enabled crime. The mission is Justice at Scale: lifting the resolution rate of cybercrime cases by orders of magnitude using the same or fewer resources than traditional law enforcement.

Sting Unit, LLC is Stingbase's wholly-owned, Texas-incorporated services subsidiary: the in-house investigations team that runs real cases on the platform every day and feeds insight straight back to the engineering team in Tallinn. Much of its work is delivered pro bono, supporting NGOs that disrupt human trafficking and financial crime, and supporting special operators, many of them ex-military, who coordinate and execute rescue operations for trafficking victims. Commercial fee-service work exists, but the mission comes first.

Stingforce is the global public-private consortium Stingbase convenes: law enforcement, prosecutors, bank fraud and AML teams, crypto exchange investigators, telecoms fraud teams, platforms, private investigators, and NGOs, working to shorten the path from victim impact to attribution, asset recovery, and prosecution. (It is being established as a consortium and is not yet incorporated.)

You are here to dogfood the platform

Your investigations matter enormously to the victims they serve. But the strategic reason this seat exists is to dogfood the Stingbase SaaS platform. By running real OSINT, DARKINT, and threat-hunting casework on the product every day, you become the sharpest possible source of feedback on what works, what is clumsy, and what is missing. Your daily friction is the engineering team's roadmap.

The goal is to get a genuinely useful minimum viable product to market in the shortest possible time, then keep refining it. You sit beside the developers so that when you hit a wall at 3pm, the person who can fix it is a few meters away, not a calendar invite for next week. The feedback loop is measured in hours, not sprints.

How you will work: in the room, and in the sprint:

You will sit face to face, in the same room, with the Stingbase development team and the scrum master, every working day. The team runs on agile, using Scrum. You will not be asked to run Scrum yourself, but you will live inside its rhythm:

1. Sprints: short, timeboxed cycles (typically one to two weeks), each aimed at a clear goal.
2. Sprint planning: the team agrees what to build next; your real-world casework is a primary input.
3. Daily scrum (standup): a roughly fifteen-minute daily sync to inspect progress and surface blockers.
4. Backlog refinement: your friction points and feature ideas get shaped into buildable work.
5. Sprint review: the team demonstrates finished work to stakeholders; you are a central stakeholder voice, the platform's most demanding power-user.
6. Sprint retrospective: the team improves how it works together.
7. The roles around you: the product owner prioritises, the scrum master facilitates and clears obstacles, and the developers build. You work alongside them as the embedded domain expert and lead user.

You do not need to be a programmer, but a good working understanding of agile and the application development lifecycle helps your insights land as usable requirements. You will also have regular, direct communication with co-founder and lead investigator Michael Roberts, who stays close to this work. The loop only works if you give feedback constantly, take it gracefully, and keep your ego out of the room.

What you will do:

1. Run end-to-end OSINT and DARKINT investigations: collection planning, surface and deep-web collection, social media intelligence, geolocation and imagery, technical OSINT on infrastructure, and dark-web market, forum, and leak-site monitoring, all under disciplined managed attribution and OPSEC.
2. Recognise the crime nexus in each case (where the money goes, where the infrastructure sits, where victims and offenders are) and prepare compelling, evidence-grade investigation briefs for referral to the right law enforcement agency, anywhere in the world, packaged so a receiving officer or prosecutor can act on and lawfully reproduce the work.
3. Work hand in glove with our crypto-specialist investigators: you need not be the deepest blockchain tracer in the building, but you must understand crypto crime and money laundering well enough to hand off cleanly and weave on-chain findings into a coherent brief.
4. Support the pro bono and NGO mission: provide investigative support and methodology to anti-trafficking and anti-fraud partners, and supply timely, actionable intelligence to the special operators running victim-rescue operations.
5. Dogfood the platform relentlessly: capture friction and ideas, turn them into clear, prioritised feedback for product and engineering, and help drive the platform toward a market-ready MVP.
6. Maintain rigorous evidentiary discipline suitable for criminal complaint, civil recovery, and expert-witness contexts across jurisdictions.

What we are looking for

Core specialism, deep skill expected:

1. OSINT: advanced search, person-of-interest and selector pivoting (email, username, phone, image), social media intelligence (Meta, X, TikTok, Telegram, Discord, LinkedIn, WhatsApp and regional platforms), geolocation and chronolocation, image and video verification, and technical OSINT on domains, DNS, certificates, and infrastructure. Fluency with the working toolset (for example Maltego, SpiderFoot, Shodan, Censys, Intelx.io, whoisxmlapi.com/, Hunchly).
2. DARKINT: confident operation across Tor and I2P, hidden-service discovery, marketplace, forum, carding-shop and ransomware-leak monitoring, vendor and infrastructure attribution, and lawful exploitation of actor OPSEC failures.
3. Threat hunting focused on cyber-enabled financial crime: deep familiarity with the social-engineering playbooks that drive our caseload, above all business email compromise (BEC), romance and pig-butchering scams, and investment fraud. You track the actors, infrastructure, and money behind these schemes with a hypothesis-driven, structured approach (for example the Diamond Model for case analysis, and MITRE ATT&CK where it fits) to anticipate and attribute, not just react.
4. Managed attribution and OPSEC as a baseline discipline, with a clean personal public footprint.
5. Working knowledge expected, depth welcome:
6. Crypto crime: blockchain tracing fundamentals, how mixers, bridges, and stablecoins are abused, and enough fluency with tools like Chainalysis, TRM, or Elliptic to collaborate well with the specialists.
7. Money laundering and financial crime: the placement-layering-integration model, the typologies that matter (business email compromise, romance and pig-butchering scams, investment fraud, money mules), and how crypto and fiat laundering connect.
8. Brief and report writing for prosecutors and law enforcement, including chain of custody and what makes evidence admissible and reproducible across borders.

How you work, this matters as much as the skills:

1. You follow fast-paced direction efficiently and thrive in a fast-moving team, switching context and reprioritising without needing everything spelled out twice.
2. You are not afraid to give constant, candid feedback on processes and the product. A teammate who stays quiet to be polite is of no use to a dogfooding loop.
3. You receive constructive criticism graciously: you can be challenged, change your mind, and move on without it becoming personal.
4. You carry no big ego: you know your strengths and your limits, and you lean on teammates where they are stronger so that the sum is greater than the parts. This is the one trait we will not compromise on.
5. You bring a builder's instinct; we are early, and you will help shape methodology, tooling, and culture.

What we offer:

1. Generous stock options in Stingbase, Ltd., meaningful equity in the company you are helping to build, plus other benefits.
2. Salary commensurate with experience; we do not publish a fixed band, so please state your expectations.
3. Full relocation support: our in-house admin team handles residency and work-permit paperwork and provides hands-on help with housing and the practical realities of an international move.
4. A seat in the Stingbase Lab, a modern facility in Ülemiste City, alongside the multinational engineering and product team you will work with every day.
5. A genuinely meaningful mission: your work helps free trafficking victims, recover stolen money for people with nowhere else to turn, and build the tool that lets the world do the same at scale.