About BrandLock

BrandLock is a revenue-protection platform for e-commerce merchants. We stop unwanted browser extensions and injected scripts — ads, coupon overlays, competitor price comparisons — from hijacking our clients’ online stores and leaking their revenue.

The Role

This role has two sides, and we want to be upfront about both.

Roughly 70–80% of your time is threat research: identifying and classifying the adware, malware and unwanted extensions injecting content into our clients’ websites, and working out how to block them. You will investigate unfamiliar domains, inspect pages in browser developer tools, test extension behaviour, and work with QA to confirm what you found is genuinely blocked in production.

The remaining 20–30% is client-facing reporting and analytics. When clients need reporting, you will work in Google Analytics 4, verify that dashboards and tracking are correct, capture and package evidence of what we blocked, and communicate the findings to clients over email.

We do not expect you to arrive knowing how to classify malware — that is what we will teach you. What you need to bring is strong logical reasoning, the ability to draw sound analytical conclusions from data, and clear written English.

What You’ll Do

Threat research and classification — the majority of the role

- Analyse and categorise adware, malware and unwanted extensions by behaviour, type and risk level
- Classify resources collected from client sites at the domain and subdomain level — legitimate, unwanted, malicious or unknown
- Research unfamiliar domains in depth: who runs them, how they make money, and whether they belong on a client’s site
- Propose ways to block injected content — HTML/CSS selectors, DOM mutation detection, domain-level blocking, or new approaches you research yourself
- Investigate extensions that stop being blocked or start evading detection, and find the root cause




- Work with the QA team to validate every blocking rule before release
- Write scripts and queries to automate parts of the classification workflow, and document findings clearly

Client reporting and analytics — when client requirements come in

- Work in Google Analytics 4 to produce the analysis behind client reports
- Verify that tracking and dashboards are correct — events firing as expected, metrics defined properly, numbers reconciling
- Investigate discrepancies between GA4, our internal dashboards and client-side figures
- Capture, annotate and organise screenshot evidence of blocked injections for client reports
- Write transparent, professional emails to clients explaining findings and answering questions about their numbers
- Audit reports and dashboards before they reach a client

What You’ll Need
- 0–2 years of experience — freshers are encouraged to apply. Bachelor’s degree in any discipline
- Strong logical reasoning. You can reach a defensible conclusion from partial evidence and explain how you got there. This is the single most important requirement
- Analytical ability with data. You can look at a set of numbers, work out what they do and do not show, and notice when something looks wrong
- Clear written English. You will email clients directly; professional, jargon-free writing is essential
- Genuine research instinct and real attention to detail
- Fundamental knowledge of HTML, CSS and JavaScript
- Comfort with browser developer tools
- Working familiarity with Excel or Google Sheets

Nice to Have None of these are required. We will teach the domain knowledge.

- Any hands-on exposure to Google Analytics 4

Pay: ₹18,000.00 - ₹25,000.00 per month

Advantages

- Flexible schedule

Ability to commute/relocate:
- Mumbai, Maharashtra 400604: Reliably commute or planning to relocate before starting work (Required)

Location:
- Mumbai, Maharashtra 400604 (Preferred)

Work Location: In person

📌 Analyst — Threat Research & Client Reporting (Mumbai)
🏢 BrandLock
📍 Mumbai