Threat Intelligence Analyst, Special Projects & Investigations - Threat Intelligence

Amazon is hiring a Threat Intelligence Analyst, Special Projects & Investigations - Threat Intelligence in Singapore, Singapore. Level rates it ; you can apply on Amazon.

Level's read on this job

Level rates this cybersecurity role Works on AI ●●●○: the daily work is on AI products, without building the model.
Tools and skills the posting cites include Telegram, threat intelligence and fraud detection.
Level classifies it as a mid-level role.
Level lists 20,000+ other open roles at Amazon.

AI in this role

Hunt threat actors and build AI-augmented investigation workflows to protect Amazon sellers across the APAC region.

threat-intelligencefraud-detectioncybersecurityosint

Are you ready to own threat intelligence initiatives that protect millions of Amazon sellers worldwide? The Threat Intelligence team within Special Projects & Investigations (SPI) is obsessed with staying ahead of threat actors and defending our Selling Partners across the Asia-Pacific region. We dive deep into dark and clear web intelligence to uncover unknown abuse vectors, potential internal threats, and organized cyber fraud schemes before they impact our customers and platform.
As a Threat Intelligence Analyst based in Singapore, you will be a core member of our APAC intelligence operation, proactively hunting threat actors, running deep investigations into fraud schemes and abuse networks targeting Amazon, and leveraging AI-native tools and automation to scale your investigative reach across the region. This is not a reactive role. We are building a team that finds threats before they find us, with the goal of doing it with the most advanced AI-augmented intelligence workflows in the industry.

Key job responsibilities
• Proactively hunt threat actors and fraud networks operating across Mandarin-language and broader APAC online communities targeting Amazon's seller ecosystem
• Conduct deep investigations into organized abuse schemes including seller fraud, account takeover, counterfeit operations, and platform manipulation, from initial lead to actionable intelligence output
• Build, operate, and continuously improve AI-augmented investigation workflows that scale threat detection and intelligence production, reducing manual toil and expanding coverage velocity
• Produce clear, concise, and actionable finished intelligence that drives decisions by partner teams across enforcement, policy, and legal
• Apply structured analytic frameworks to map threat actor TTPs, build actor profiles, and contribute to the team's threat picture
• Collaborate with global partners SPI TI counterparts to integrate APAC intelligence findings into the worldwide threat picture and inform proactive detection models
• Support partner team requests, bringing investigative depth and regional expertise to complex, high-priority cases
• Identify intelligence gaps and develop collection requirements that strengthen the team's proactive posture

A day in the life
Your morning starts with a sweep of deep, dark web forums, Telegram channels, and Mandarin-language communities, looking for signals before they become incidents. When something surfaces, you investigate: mapping actors, reverse engineering the tactics used, building the picture. Your findings become finished intelligence that enforcement, policy, and legal teams act on. Between investigations, you're refining the automation and workflows that make tomorrow's work faster and wider in reach. No two days are identical, but the focus never shifts, find threats before they land.

About the team
We're a global threat intelligence team with a simple mission: find threats before they find us. We blend rigorous analytic tradecraft with AI-native tools to investigate fraud networks, track threat actors, and protect sellers across Amazon's marketplace. We work closely with enforcement, policy, and legal partners who act on what we produce. We're a small team that writes well, thinks critically, and genuinely geeks out on how threat actors operate. If you want to build the most advanced intelligence operation in e-commerce, and do it alongside people who care about doing it right, you'll fit in here.

Basic qualifications

- Bachelor's degree or equivalent
- 3+ years of experience in threat intelligence, fraud investigation, trust & safety, corporate intelligence, or a related investigative discipline
- High proficiency in Mandarin Chinese (speaking, reading and writing) for China market-focused research and communication purposes.
- Demonstrated experience conducting proactive OSINT investigations and threat actor tracking using professional-grade intelligence collection and analysis tooling
- Demonstrated use of AI tools, LLMs, or automation frameworks to accelerate or scale analytical and investigative workflows
- Experience producing finished intelligence products with clear analytical assessments and risk recommendations for non-technical stakeholders
- Familiarity with the threat landscape including regional fraud ecosystems, cybercrime forums, and threat actor communities
- Strong written and verbal communication skills; ability to communicate complex findings clearly to senior stakeholders

Preferred qualifications

- Background in e-commerce fraud, marketplace abuse, or platform integrity at a technology company, corporate intelligence, financial crime, or trust & safety experience is equally valued alongside government or military intelligence backgrounds
- Degree or coursework in Computer Science, Data Science, Data Analytics, Cybersecurity, or a related technical discipline
- Familiarity with APAC regional threat dynamics, fraud ecosystems, and the regulatory environment across Southeast Asia
- Experience with dark web intelligence collection, actor attribution, and structured analytic tradecraft
- Experience contributing to or building intelligence automation pipelines using scripting or workflow tooling
- Relevant certifications in intelligence analysis, cybersecurity, fraud, or data analysis

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

How we rate this

Threat Intelligence Analyst, Special Projects & Investigations - Threat Intelligence at Amazon rates 65 out of 100 for how much of the daily work is AI. That makes it Works on AI (AI Level 3 of 4). The level is about AI in the job, not seniority.

Classification

Works on AI. The daily work is on AI products, without building the model.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Read the description and count the AI tools, models and workflows it names.

Key facts

Threat Intelligence Analyst, Special Projects & Investigations - Threat Intelligence is an open job at Amazon.
Level rates this role AI Level 3 of 4: Works on AI.
The role is based in SG, Singapore.
The job was posted on July 14, 2026.
Seniority: mid.
Applications are handled by Amazon. Apply on Amazon

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

Threat IntelligenceFraud DetectionCybersecurityOsintTelegram

Also common in cybersecurity jobs at this level

Python AWS AI agents Google Cloud Kubernetes Azure

Pay

Typical cybersecurity job: $160k

This posting doesn't list pay. Use the typical cybersecurity figure when pay comes up. See cybersecurity jobs

Questions you could be asked

Tell me about a project where threat intelligence was part of your work. What did you do?
Tell me about a project where fraud detection was part of your work. What did you do?
Tell me about a project where cybersecurity was part of your work. What did you do?
Tell me about a project where osint was part of your work. What did you do?
Walk me through how you've used Telegram in your day-to-day work.

Adapt your resume

List these exact terms on your resume: Threat Intelligence, Fraud Detection, Cybersecurity, Osint, and Telegram. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.
Show where AI is part of your daily process, not a one-off project. This role expects it to be a running habit.

Get your CV reviewed before you apply

Send your CV and the role you want next. Your review arrives by email within 3 days.

Get a free CV review Check your resume with the ATS resume checker