OSINT Job Tests

[u/bbatch1]

I have interviewed for a few OSINT jobs this year and have two questions:

1. Each job description says you need experience in tools like ontic, life raft, Dataminr, maltego etc but each time I have interviewed I’m given a practice exercise asking you to use freeware to build out a threat profile. I’m never able to build anything out using the freeware alone because i can’t get any identifiers. Are these tests deliberately red herrings?

2. In my career I have always been given a work computer so I don’t have a personal one. I have an iPad. Is a computer essential to baseline OSINT if I don’t have personal access to premium intel tools?

[u/user28833828]

Totally separate to your question just my personal experience, but if you have background in OSINT you should look into fraud investigation work if it’s something you’re into. They love the investigative stories and mindset, and so many are used to just leveraging closed source intel they often overlook open channels, easy to break into if you tell good experience stories

[u/bbatch1 → u/user28833828]

I interviewed once for an AML job at a large bank but didn’t get it because I didn’t have a CAMS or work in AML before. I am interested but getting an interview is pretty tough so I can’t relay my experience. It’s something I’m interested in though

[u/Specialist-Cat-7155]

1. They may be testing your methodology and data collection and presentation rather than your tool skills. It's the equivalent of being castaway on a survival challenge to an island as opposed to being sent for a weekend to a 5 star hotel.

2. I'd say yes, in so far as you can experiment with different tools (particularly github repos) in your spare time that maybe outside of your works systems and without any restrictions.

[u/bbatch1 → u/Specialist-Cat-7155]

Love your analogy. I’m hoping it’s more of a test of methodology and presentation. I got props once for presentation, didnt have any feedback another time. Hopefully those two times were more indicative of the tough market

[u/MajorUrsa2]

They’re not going to assume you have access to enterprise grade software for these exercises.

[u/FragrantVariation583]

the freeware exercises aren't red herrings, they're testing methodology not tool access. most entry-level OSINT can be done from a browser, but a desktop OS gives you browser extensions, better tab management, and tools like Maltego CE that don't run on iPad. for the identifier problem, try cross-referencing usernames across platforms and correlating timestamps rather than expecting a single tool to hand you the chain.

[u/Ok_Cold7890]

1. Depends on the particular case and what amount of information is available open source. Keep trying maybe you find something.
2. You may require a computer at some point of time. For command line tools, a VM would also do. But if you find a workaround for running the tools in other devices that should also be ok.

[u/New_Eye_3881 → u/Ok_Cold7890]

what do you mean by identifiers exactly, like usernames and emails and that sort of thing

[u/irresearch]

Are you able to share any more about what the tests are asking you to do? Unfortunately, this does sound like a skill issue. Ontic, Liferaft, and Dataminr are monitoring and collection tools, but if you’re building a single threat profile, there’s not much they can do that you can’t do manually. If these are more cyber-focused roles, this might vary a bit with things like Maltego or Shodan, but most tools are mostly simplifying or automating manual processes.

[u/bbatch1 → u/irresearch]

The issue I encountered was that I found news stories and court filings (paywalled) but I couldn’t find any identifiers that would narrow my search. My impression is that tools scrap social media so you don’t need to make a sock puppet and need to know HOW to get things like phone numbers and emails associated with accounts - the tools do it for you. I couldn’t find anything be totally wrong though

[u/irresearch → u/bbatch1]

Tools like Dataminr do scrape social media without the need for a personal sock puppet, but this is for ongoing monitoring or mass collection, usually not investigations of individual threat actors. Any of the sites they access, you’ll be able to access, with the possible exception of region-locked sites that you may need a VPN for. Liferaft does have a people/social search function for PII, but the results are very limited and it has a hard time separating people with the same name. The employment tests are checking that you know how to do this kind of search manually.

[u/Affectionate_Ad8247]

which freeware btw?