SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
TRM Labs is seeking a Blockchain Intelligence Analyst specializing in ransomware investigations. This is a high-autonomy individual contributor role focused on tracing ransomware proceeds, identifying threat actor infrastructure, and generating actionable intelligence for law enforcement and private sector partners.
You will lead complex end-to-end blockchain investigations from initial indicators through full attribution and recovery opportunities. Key responsibilities include: producing finished intelligence on ransomware actors and laundering pathways; tracing funds across multiple blockchains, mixers, bridges, and cash-out services; correlating on-chain activity with OSINT and threat intelligence to build complete adversary profiles; owning investigative workstreams from discovery through written production; supporting asset recovery missions by surfacing high-quality leads and seizure opportunities; and driving analytical leadership by mentoring peers and refining investigative methodologies.
You will partner closely with internal teams, law enforcement, and private-sector partners to ensure analytical outputs reflect rigorous tradecraft and support operational decision-making. Success means generating meaningful attribution and investigative leads in complex cases where financial trails are deliberately obscured, consistently producing intelligence that partners trust and use operationally, and improving team capability through mentorship and methodology refinement.
Required qualifications: 3-5+ years in blockchain intelligence, crypto investigations, cybercrime analysis, threat intelligence, or comparable senior analytical role. Deep hands-on experience tracing funds across blockchains through laundering techniques (mixers, chain-hopping, bridges, peel chains). Demonstrated ability to independently run complex investigations and synthesize findings into clear written intelligence products. Deep understanding of the ransomware ecosystem, including operators, affiliates, initial access brokers, malware developers, and laundering networks. Excellent written and verbal communication skills, particularly translating technical findings into actionable intelligence for government and private-sector audiences.
