Cybercrime Analytics Lead

Group 1001 is a consumer-centric, technology-driven family of insurance companies on a mission to deliver outstanding value and operational performance by combining financial strength and stability with deep insurance expertise and a can-do culture. Group1001’s culture emphasizes the importance of collaboration, communication, core business focus, risk management, and striving for outcomes. This goal extends to how we hire and onboard our most valuable assets – our employees.

Why This Role Matters:

The Group 1001 Security Team is building a Cyber Fraud Fusion Program that brings together intelligence, analytics, and operations to proactively disrupt cyber-enabled fraud. We are looking for a Cybercrime Analytics Lead to architect and operationalize the core analytics capabilities of this program, fusing technical expertise, cybercrime and fraud domain knowledge, and creative problem-solving to identify, prioritize, and mitigate threats to our customers and business.

How You’ll Contribute:

• Design and build scalable data pipelines to ingest, normalize, and enrich fraud intelligence and cybercrime indicators from internal and external sources (dark web, threat intel feeds, fraud signals, intelligence sharing organizations, etc.)
• Develop analytical frameworks to detect, assess, and mitigate customer-level risk of cyber-enabled fraud (e.g., identity theft, policy takeover, payment fraud) in collaboration with Fraud Operations team
• Collaborate with threat intelligence, fraud operations, and engineering teams to operationalize detection logic and build real-time alerting workflows
• Create models and heuristics that connect cyber TTPs (e.g., phishing, malware, impersonation) to existing customer data to disrupt the fraud cycle
• Lead root cause analysis and post-incident investigations to improve detection logic and close feedback loops for cyber-enabled incidents
• Champion data quality and integrity by building and monitoring pipelines for coverage, freshness, and consistency
• Perform analysis and support case triage and investigations

What We’re Looking For:

• 8+ years of experience in e-crime investigations, fraud analytics, threat intelligence, or related fields in financial services.
• Demonstrated knowledge of and proven successful experience working with financial crimes functions (i.e., cyber security, fraud operations, investigations, and compliance).
• Strong programming and database management skills
• Deep understanding of the business relationships that exist between hackers and fraudsters and the techniques used by each to facilitate the fraud cycle including malware, phishing, malicious proxies, credential replay attacks, synthetic identities, account takeovers, social engineering, money mules, and malicious money movement techniques. 
• Track record of creating scalable analytics to support fraud detection, alerting, or intelligence.
• Experience working with or integrating threat intel feeds to identify indicators of fraud compromises (IOFCs).
• Familiarity with SIEM, case management systems (e.g., Jira, ServiceNow, Elastic), and cloud-based data platforms (e.g., Snowflake)

Preferred Skills:

• Experience building fraud detection platforms or cybercrime analytics infrastructure at a fintech, insurer, or financial institution
• Knowledge of key tools: Feed ingestion platforms and anti-fraud tech and data
• Familiarity with MITRE ATT&CK, cyber kill chain, and similar frameworks
• Exposure to threat actor tracking, OSINT techniques, and underground marketplaces
• Ability to translate complex technical risks into business-relevant insights for non-technical stakeholders
• Passion for building from scratch, working across disciplines, and protecting customers from evolving threats

Compensation:  

Our compensation reflects the cost of labor across several U.S. geographic markets. The base pay for this position ranges from $175,000/year in our lowest geographic market up to $225,000/year in our highest geographic market.  Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience.

Benefits Highlights:  

Employees who meet benefit eligibility guidelines and work 30 hours or more weekly, have the ability to enroll in Group 1001’s benefits package. Employees (and their families) are eligible to participate in the Company’s comprehensive health, dental, and vision insurance plan options.  Employees are also eligible for Basic and Supplemental Life Insurance, Short and Long-Term Disability. All employees (regardless of hours worked) have immediate access to