Full-Time
Posted on 8/13/2025
Threat intelligence and identity protection platform
No salary listed
No H1B Sponsorship
Austin, TX, USA
Hybrid
| , |
SpyCloud provides cyber threat intelligence and identity protection for businesses. Its Cybercrime Analytics Platform uses data recovered from the criminal underground to deliver actionable insights that help detect and prevent cyber threats such as malware, ransomware, and unauthorized access. The platform also supports de-anonymizing threat actors and linking them to crimes to aid incident response and threat attribution. Unlike many security tools that focus on one area, SpyCloud combines threat intelligence, credential monitoring, dark web monitoring, and incident response in a single platform to help enterprises protect digital assets and identities. The company's goal is to help businesses proactively prevent data breaches and other cybercrimes by continuously detecting compromised credentials, stopping unauthorized access, and monitoring the dark web for emerging threats.
Company Size
201-500
Company Stage
Growth Equity (Venture Capital)
Total Funding
$203.5M
Headquarters
Austin, Texas
Founded
2016
Help us improve and share your feedback! Did you find this helpful?
Health Insurance
Dental Insurance
Vision Insurance
401(k) Retirement Plan
Unlimited Paid Time Off
Meal Benefits
Flexible Work Hours
Remote Work Options
Cyber job moves: New appointments across threat intelligence, identity, and critical infrastructure. Trevor Hilligoss - SpyCloud Trevor Hilligoss has been promoted to chief intelligence officer at SpyCloud, where he will drive the company's global intelligence strategy and advance research into cybercriminal activity. In this role, he will lead efforts to collect exposed data, analyze threat actor tactics, and turn those insights into actionable defenses. Hilligoss continues to oversee SpyCloud Labs, the organization's security research team recognized for industry excellence. (source) Jason Lancaster - SpyCloud Jason Lancaster has been named chief investigations officer at SpyCloud, with responsibility for shaping the firm's global investigations strategy and methodologies. He will guide the team that uncovers hidden threats and accelerates attribution across complex cybercrime investigations. Lancaster has been with SpyCloud since 2017, where he helped build and scale the investigations and solution engineering organization. (source) Dan Mountstephen has taken on the role of senior vice president and general manager for Asia Pacific and Japan at Okta, overseeing regional strategy and sales execution from Singapore. Okta positions identity as a core security control as organizations adopt cloud services and artificial intelligence. (source) Jeremy O'Donohue has been appointed as the managing director for state government and critical infrastructure at Kinetic IT, to look after strategy and delivery across public sector and essential services customers. He joins from Capgemini, where he led public sector operations across Australia and New Zealand. O'Donohue brings more than 20 years of experience spanning government, health, education, and critical infrastructure environments. (source) Simon Ractliffe has taken on responsibility for Rapid7's Asia-Pacific and Japan business as general manager, leading regional operations and growth strategy. In the role, he will oversee execution across threat detection and exposure management offerings. Ractliffe brings more than 30 years of experience across cybersecurity, cloud, and enterprise technology. (source) Krissy Safi - Clearwater Krissy Safi has joined Clearwater as senior vice president of consulting services, leading delivery across the company's cybersecurity and compliance consulting practice. She brings over two decades of experience building and managing global security consulting teams. Safi previously served at the US Department of State, where she worked on securing and standardizing embassy and consulate infrastructure worldwide. (source) Dave Bailey - Clearwater Dave Bailey has moved into an expanded role as vice president of consulting solutions and strategy at Clearwater. In this position, he will guide development of consulting offerings and align solution strategy with evolving client and regulatory needs. Bailey has been a senior leader within Clearwater's security services organization and has contributed to shaping its consulting portfolio. (source) Derek Whigham - Acumen Cyber Derek Whigham has joined Acumen Cyber as a non-executive director and strategic advisor, supporting the company's expansion in the UK. He has over 28 years of experience in cybersecurity and technology, most recently serving in the Chief Security Office at Lloyds Banking Group. At Acumen Whingham will focus on growth, product direction, and intelligence-led security operations. (source) Richard Lau has taken on the role of chief information officer for the Government of Bermuda, overseeing the Information and Digital Technologies office. He will lead IT strategy, infrastructure modernization, and cybersecurity under the Cabinet Office and Digital Innovation portfolio. Lau brings more than 25 years of experience in IT, cybersecurity, and critical infrastructure. (source) William Bengtson has joined ConductorOne as chief information security officer, taking responsibility for the company's security strategy as identity expands to include human, non-human, and AI agents. He has more than two decades of experience in securing cloud platforms, identity systems, and developer infrastructure. (source) Mark Francetic - Onapsis Mark Francetic has joined Onapsis as global head of partners and alliances, taking responsibility for the company's partner strategy across SAP, systems integrators, and resellers. He brings over 25 years of experience building alliance-led growth programs in cybersecurity, identity, and cloud markets. His role centers on strengthening joint go-to-market activity around SAP security. (source) John LoVerme - Onapsis John LoVerme has taken on the role of head of North America sales at Onapsis, overseeing regional sales execution and revenue growth. He brings experience scaling enterprise security businesses, including early leadership at Rapid7 and more than a decade leading global sales at Prevalent. LoVerme will focus on customer acquisition and partner-driven expansion across North America. (source) Nadine Rahman - Onapsis Nadine Rahman has joined Onapsis as head of international go-to-market, assuming responsibility for global field sales coordination, and international strategy. She brings over 20 years of experience in executive roles within SAP environments and industrial technology organizations. (source) Tim Britt has taken on the role of chief executive officer at Frontline Managed Services. He steps into the position with more than three decades of experience spanning consulting, systems integration, and managed services. At Frontline, his remit includes advancing tech-enabled services, cybersecurity capabilities, and AI-driven operations supporting law firms. (source) Arie Teter has joined DataGuard as chief product and technology officer, taking responsibility for product strategy and engineering. Based in London, he will oversee platform development. Teter brings senior product and engineering experience from cloud and cybersecurity companies. His background also includes engineering roles at Symantec and Check Point Software Technologies. (source) Rohan Pal has joined NCR Atleos as chief information officer, taking charge of the company's global technology strategy. In the role, Pal will oversee IT modernization, cybersecurity, cloud platforms, and digital product development. He has more than 25 years of technology experience in enterprise environments. Prior to Atleos, Pal served chief transformation officer at ServiceNow, with earlier senior roles spanning fintech, manufacturing, and retail organizations. (source) Dani Pickens has taken on the position of vice president of global channels at AgileBlue. Her remit covers the development of an enablement-first channel program supporting MSPs, resellers, distributors, and partners. Pickens brings a background in building and modernizing partner ecosystems within cybersecurity and cloud markets, with a focus on co-selling and execution at scale. (source) Patrick Rinski has taken on leadership of Unit 42 for Latin America at Palo Alto Networks, overseeing the company's threat intelligence and incident response operations. The role reflects increased focus on Latin America as cyber incidents grow in scale and sophistication. Rinski will guide regional response services, threat research, and advisory efforts tailored for local environments. He has over 20 years of experience in cybersecurity, risk management, and digital transformation. (source) Vinoo Srinivas Murali has taken on the position of chief revenue officer for data and AI at DigitalNet.ai, adding senior commercial leadership as the company expands adoption of its JanusAI platform and ATLAS autonomous cybersecurity system. Murali has over 25 years of enterprise sales and go-to-market experience in artificial intelligence, and cloud services. Murali previously spent 18 years at Microsoft in senior leadership roles covering Azure AI infrastructure, agentic AI, and global enterprise sales. (source)
SpyCloud appoints Trevor Hilligoss and Jason Lancaster to new executive roles. Company elevates longtime leaders to Chief Intelligence Officer and Chief Investigations Officer to advance identity threat protection and cybercrime disruption. January 29, 2026 08:00 ET | Source: SpyCloud AUSTIN, Texas, Jan. 29, 2026 (GLOBE NEWSWIRE) - SpyCloud, the leader in identity threat protection, marks the start of their 10th year of disrupting cybercrime by announcing the promotion of two tenured leaders to newly created executive roles, reflecting their sustained impact on the company's growth, innovation, and leadership in disrupting cybercrime. "Their teams consistently deliver the innovation our customers rely on to understand and disrupt identity-based threats at scale. These promotions recognize..." "Trevor and Jason have been foundational to SpyCloud's success and to our leadership in identity threat protection," "Their teams consistently deliver the innovation our customers rely on to understand and disrupt identity-based threats at scale. These promotions recognize..." "Trevor and Jason have been foundational to SpyCloud's success and to our leadership in identity threat protection," "Their teams consistently deliver the innovation our customers rely on to understand and disrupt identity-based threats at scale. These promotions recognize..." Trevor Hilligoss has been promoted to Chief Intelligence Officer, and Jason Lancaster has been named Chief Investigations Officer. Together, Hilligoss and Lancaster are instrumental in leading SpyCloud's most mission-critical data collection, cybercrime research, and threat actor attribution. Trevor Hilligoss, Chief Intelligence Officer Hilligoss oversees SpyCloud's global intelligence strategy, advancing research into cybercriminal tactics and driving the exposed data collection that fuels identity-based attacks. His distinguished background, including experience with the FBI and the U.S. Army, informs his approach to translating raw data into actionable insights that strengthen customer defenses, support responsible disclosures, and enable proactive identity threat prevention. Hilligoss also continues to lead SpyCloud Labs, SpyCloud's in-house security research team recently named Cyber Security Excellence Awards "Cybersecurity Team of the Year". In this capacity, he directs a world-class group of security researchers and analysts who analyze underground data, reverse-engineer malware, track and assess evolving phishing kits, and provide responsible disclosures to victim organizations. Under his leadership, SpyCloud leverages the industry's largest repository of recaptured darknet data - nearly a trillion identity assets - to publish proprietary research that exposes emerging threats and shapes the broader identity security landscape. Jason Lancaster, Chief Investigations Officer As Chief Investigations Officer, Lancaster leads SpyCloud's global investigations strategy, including the methodologies and tradecraft that enable organizations to uncover hidden threats and accelerate attribution. Since joining SpyCloud in 2017, Lancaster has played a pivotal role in building and scaling the SpyCloud Investigations and Solution Engineering team and fostering strong public-private partnerships to disrupt cybercriminal activity. Lancaster has led the creation of some of SpyCloud's most innovative technologies, including IDLink(TM), an advanced analytics capability built on decades of investigative tradecraft and team methodology that facilitates rapid identity resolution by correlating holistic identities across fragmented darknet exposures. He has also guided the development of AI Insights into SpyCloud's Investigations solution, enabling analysts of all experience levels to uncover critical findings, like potential insider threats, more quickly and reduce investigative dead ends. Beyond product innovation, Lancaster has built a mission-driven investigations culture focused on protecting organizations and individuals from harm. His team has supported high-impact initiatives ranging from major financial crime disruption to efforts protecting vulnerable populations, while also contributing to global cybercrime takedowns and international collaboration initiatives like SpyCloud's founding membership in the World Economic Forum's Cybercrime Atlas Project in 2021. In recognition of his leadership and innovation, Lancaster was recently named a recipient of the Tech Ascension Award for Industry Innovator of the Year. "Trevor and Jason have been foundational to SpyCloud's success and to our leadership in identity threat protection," said Ted Ross, CEO and Co-founder of SpyCloud. "Their teams consistently deliver the innovation our customers rely on to understand and disrupt identity-based threats at scale. These promotions recognize not only their individual leadership, but also the critical role their teams play in advancing our mission to stop cybercriminals from profiting off stolen identity data." In the past year, Hilligoss and Lancaster have been instrumental in producing insights and original research featured in several widely cited SpyCloud reports, including The Identity Security Reckoning: 2025 Lessons, 2026 Predictions, the 2025 SpyCloud Identity Threat Report, and the 2025 SpyCloud Identity Exposure Report. About SpyCloud SpyCloud transforms recaptured darknet data to disrupt cybercrime. Its automated identity threat protection solutions leverage advanced analytics and AI to proactively prevent ransomware and account takeover, detect insider threats, safeguard employee and consumer identities, and accelerate cybercrime investigations. SpyCloud's data from breaches, malware-infected devices, and successful phishes also powers many popular dark web monitoring and identity theft protection offerings. Customers include seven of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, TX, SpyCloud is home to more than 200 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now.
SpyCloud launches Supply Chain solution to combat rising third-party identity threats. New monitoring capability delivers unprecedented visibility into vendor identity exposures, moving enterprises and government agencies from static risk scoring to protecting against actual identity threats. SpyCloud, the leader in identity threat protection, today announced the launch of its Supply Chain Threat Protection solution, an advanced layer of defense that expands identity threat protection across the extended workforce, including organizations' entire vendor ecosystems. Unlike traditional third-party risk management platforms that rely on external surface indicators and static scoring, SpyCloud Supply Chain Threat Protection provides timely access to identity threats derived from billions of recaptured breach, malware, phished, and combolist data assets, empowering organizations - from enterprise security teams to public sector agencies - to act on credible threats rather than simply observe and accept risk. Supply Chain Threat Protection addresses a critical gap in enterprise security: the inability to maintain real-time awareness of identity exposures affecting third-party partners and vendors. According to the 2025 Verizon Data Breach Investigations Report, third-party involvement in breaches doubled year-over-year, jumping from 15% to 30% primarily due to software vulnerabilities and weak security practices. As supply chain compromises continue to escalate, security teams need intelligence that goes beyond questionnaires and external scans to reveal active threats like phishing campaigns targeting their trusted partners, confirmed credential theft, and malware-infected devices exposing critical business applications to criminals. For government agencies and critical infrastructure operators, supply chain threats present national security risks that demand heightened vigilance. Public sector organizations managing sensitive data and critical services increasingly rely on contractors and technology vendors whose compromised credentials could provide adversaries with pathways into classified systems or essential infrastructure. Last year alone, the top 98 Defense Industrial Base suppliers had over 11,000 dark web exposed credentials - an 81% increase from the previous year. SpyCloud Supply Chain Threat Protection enables federal, state, and local agencies to identify when suppliers or contractors have been compromised - allowing them to take proactive measures before an identity exposure escalates into a matter of national security. "Third-party threats have evolved far beyond what traditional vendor assessment tools can detect," said Damon Fleury, Chief Product Officer at SpyCloud. "Public and private sector organizations need to know when their vendors' employees are actively compromised by malware or phishes, when authentication data is circulating on the dark web, and which partners pose the greatest real downstream threat to their business. Our new solution delivers those signals by transforming raw underground data into clear, prioritized actions that security teams use to protect their organization." Supply Chain Threat Protection enables organizations and agencies to continuously monitor thousands of suppliers, with each company's threats enumerated in detail, and also represented in an at-a-glance Identity Threat Index. The Index is a comprehensive and continuously updated analysis that quantifies vendor security posture through the lens of identity exposure, from both active and historical phishing, breach, and malware sources, and surfaces which partners pose the most significant risk based on verified dark web intelligence. * Real Evidence of Compromise: Timely recaptured identity data from breaches, malware, and successful phishes collected continuously from the criminal underground, with context that gives security teams enhanced visibility into the identity threats facing suppliers today. * Identity Threat Index: Aggregates multiple verified data sources weighted by the recency, volume, credibility, and severity of compromise, emphasizing verified identity data over static breach records for more robust and real-time visibility into vendor risk. * Compromised Applications: Identifies the internal and third-party business applications exposed on malware-infected supplier devices to support deeper investigation and risk assessment. * Enhanced Vendor Management and Communications: Facilitates sharing of actionable evidence and detailed executive-level reports directly with vendors to collaboratively improve security posture, transforming vendor relationships from adversarial scoring to collaborative protection. * Integrated Response: Leveraging SpyCloud's console, teams now have access to identity threat protection beyond the traditional employee perimeter with this extension to suppliers, allowing analysts to respond to workforce identity threats within a single tool. SpyCloud Supply Chain Threat Protection is designed to support multiple use cases across Security Operations, Infosec, Vendor Risk Management, and GRC teams. Organizations can leverage the solution for vendor due diligence during procurement and onboarding, continuous risk reviews to strengthen vendor relationships, and accelerated incident response when vendor exposures threaten their own environments. "Security teams and their counterparts across the business are overwhelmed with vendor assessments, questionnaires, and risk scores that often don't translate to real prevention," said Alex Greer, Group Product Manager at SpyCloud. "Our customers have often reported that when they're evaluating doing business with a new vendor, they lack the actionable data their legal and compliance teams need for evidence-based decision making. That's where SpyCloud stands out. Surfacing verified identity threats tied directly to vendor compromise, letting teams escalate to leadership when to restrict data access and prioritize efforts for the greatest impact on reducing organizational risk." Unlike existing solutions that rely on external surface indicators and static scoring, SpyCloud provides threat data derived from underground sources - the same recaptured darknet identity data that criminals actively use to target organizations and agencies. This fundamental difference enables SpyCloud customers to move from passive risk acceptance to proactive and holistic identity threat protection. To learn more about defending organizations from the exposures of vendors and suppliers, registration is open for SpyCloud's upcoming Live Virtual Event, Beyond Vendor Risk Scores: How to Solve the Hidden Identity Crisis in Your Supply Chain, on Thursday, January 22, 2026, at 11 am CT. About SpyCloud SpyCloud transforms recaptured darknet data to disrupt cybercrime. Its automated identity threat protection solutions leverage advanced analytics and AI to proactively prevent ransomware and account takeover, detect insider threats, safeguard employee and consumer identities, and accelerate cybercrime investigations. SpyCloud's data from breaches, malware-infected devices, and successful phishes also powers many popular dark web monitoring and identity theft protection offerings. Customers include seven of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, TX, SpyCloud is home to more than 200 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now. To learn more and see insights on your company's exposed data, users can visit spycloud.com. Media Specialist Phil Tortora REQ on behalf of SpyCloud [email protected]
SpyCloud, a start-up focused on identity analytics for digital protection, has raised $110 million in a growth round led by Riverwood Capital. The company specializes in analyzing criminal underground data to remediate exposed authentication and identity data, enhancing IAM, identity threat detection, and zero trust frameworks. Their latest solution, SpyCloud Compass, addresses malware exposures to prevent ransomware attacks. CEO Ted Ross emphasizes the importance of quick reactions to identity exposures.
SpyCloud released the Consumer IDLink solution, designed to help financial institutions and other consumer-facing organizations reduce risk and prevent fraud stemming from consumer identity exposures.