SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
TRM Labs is seeking a Cyber Threat Intelligence Analyst to join the Scam Disruption team, which focuses on dismantling pig butchering syndicates, romance fraud networks, and investment scam operations. This role is based in the Washington DC area and involves infrastructure-driven investigative work to trace illicit activity and build operational pictures of threat networks.
In this position, you will lead investigations starting from single indicators—scam domains, IPs, or certificates—and pivot across shared certificates, registrars, nameservers, hosting, and ASNs to map wider infrastructure behind scam operations, particularly those originating from Southeast Asia. You will track campaigns as they evolve through new domains, hosting changes, and certificate reuse, staying on actors as they rebuild after takedowns and seizures.
Key responsibilities include:
- Pivoting from single indicators to map campaign infrastructure and cluster one-off indicators
- Tracking campaign evolution and anticipating actor infrastructure changes
- Driving attribution of threat actors using open-source and commercially available data
- Fusing technical infrastructure with on-chain data to trace investigations from infrastructure through wallets and laundering paths
- Building clustering logic, detection rules, and automation to surface malicious infrastructure proactively
- Producing defensible, calibrated assessments with confidence levels and evidence weighting
- Synthesizing on-chain and off-chain intelligence into targeting packages for government and law-enforcement consumers
- Owning the intelligence cycle end-to-end with minimal supervision, partnering across teams
The Scam Disruption team operates within TRM's Blockchain Intelligence organization alongside threat intelligence analysts, on-chain investigators, and federal partners. The team uses an async-first approach via Slack and Notion with structured syncs for alignment. You will have high autonomy and low bureaucracy, working directly with analysts, engineers, and customers who depend on your output. Weekly team syncs align targeting priorities, daily async standups track active work, and surge availability is expected during time-sensitive disruption windows.
TRM is a Series C company with $220M in funding, backed by Goldman Sachs, Bessemer, Y Combinator, and Thoma Bravo. The company is headquartered in San Francisco and operates as distributed-first with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore.
REQUIREMENTS:
- 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles (not entry-level)
- Hands-on infrastructure attribution: infrastructure pivoting and campaign tracking across shared certificates, registrars, nameservers, hosting, and ASNs; thinking in campaigns rather than isolated indicators
- Track record of staying on an actor or campaign over time, including through takedowns and re-registration
- Hands-on fluency with CTI tooling: passive DNS, WHOIS, certificate or Shodan-style fingerprinting, and phishing monitoring
- Experience building detection and clustering logic, rules, or automation yourself—not just configuring vendor tooling
- Attribution tradecraft: using open-source and commercially available data to drive threat actor attribution
- Demonstrated ability to produce actionable intelligence or targeting packages for government, law-enforcement, or equivalent consumers who acted on them, with calibrated and defensible analytic judgment
- Must be located in the Washington D.C./MD/VA area (periodic in-person collaboration and travel may be required)
- AI fluency expected as a baseline; ability to apply AI to accelerate workflows, structure problems, improve output quality, and increase speed and leverage
