SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
TRM Labs is seeking a Blockchain Intelligence Analyst to drive collection, assessment, and reporting on threat actors and illicit networks using AI-powered intelligence solutions. The role combines national-security-grade tradecraft with blockchain and cryptocurrency expertise to help public and private sector agencies investigate and disrupt crime.
Key responsibilities include developing novel collection strategies and investigative methodologies to surface threat actor activity; conducting targeted threat hunting across on-chain and off-chain data sources; mapping financial networks used for sanctions evasion and connecting them to blockchain activity; tracking and assessing threat actors, campaigns, and illicit networks; identifying adversary tactics, techniques, and procedures (TTPs); leveraging open-source intelligence (OSINT) to uncover hidden threats; and producing high-quality intelligence reports for law enforcement and government partners.
Required qualifications: proven experience in threat intelligence, cyber intelligence, or blockchain intelligence roles; native-level fluency in Russian, Chinese, Korean, or Spanish strongly preferred; track record of generating original intelligence; background in sanctions enforcement, financial intelligence, or corporate investigations strongly preferred; working knowledge of blockchain and cryptocurrency; demonstrated ability to analyze corporate ownership structures and cross-border fund flows; experience tracking threat actors, nation-state activity, or sanctioned entities; strong research and communication skills; and comfort operating in ambiguous, low-signal environments with an ownership mindset.
The role sits at the intersection of intelligence production, investigations, and product-informed tradecraft. The team operates with high autonomy, high standards, and low bureaucracy, working directly with analysts, engineers, and customers. Team structure includes weekly syncs to align targeting priorities, daily async standups via Slack, primary time zone overlap in US Eastern/Central, and surge availability expected during time-sensitive disruption windows. TRM operates with a high-velocity, high-ownership culture where priorities change quickly, ambiguity is common, and personal accountability is paramount. AI fluency is a baseline expectation across the organization.
