SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
TRM Labs is seeking a Cyber Threat Intelligence Analyst to join the Scam Disruption team, which focuses on dismantling pig butchering syndicates, romance fraud networks, and investment scam operations. This role is infrastructure-driven investigative work centered on tracing illicit activity and building operational pictures of threat networks.
In this position, you will:
- Start from a single indicator (scam domain, IP, or certificate) and pivot across shared certificates, registrars, nameservers, hosting, and ASNs to map infrastructure behind Southeast Asia scam operations, clustering isolated indicators into campaigns.
- Track campaigns as they evolve through new domains, hosting changes, registrar shifts, and certificate reuse, staying on actors as they rebuild after takedowns and seizures.
- Drive attribution of threat actors by leveraging open-source and commercially available data.
- Fuse technical infrastructure with on-chain intelligence, carrying investigations from infrastructure through wallets, laundering paths, and cash-out points.
- Build clustering logic, detection rules, and automation to surface malicious infrastructure proactively rather than relying on off-the-shelf feeds.
- Produce defensible, calibrated assessments with confidence levels and evidence weighting for malicious-versus-benign determinations.
- Synthesize on-chain and off-chain intelligence (OSINT, technical, financial) into targeting packages for government and law-enforcement consumers.
- Own the intelligence cycle end-to-end with minimal supervision, partnering with the Scams SME team and collaborating with data, engineering, and product teams.
The Scam Disruption team operates within TRM's Blockchain Intelligence organization alongside threat intelligence analysts, on-chain investigators, and federal partners. The team uses an async-first approach via Slack and Notion with structured syncs for alignment. You will have high autonomy and high standards with low bureaucracy, working directly with analysts, engineers, and customers who depend on your output.
Team operating rhythms include weekly syncs to align targeting priorities, daily async standups on active work, and primary time zone overlap in US Eastern/Central. Surge availability is expected during time-sensitive disruption windows.
TRM is a Series C company with $220M in total funding, backed by Goldman Sachs, Bessemer, Y Combinator, and Thoma Bravo. The company is headquartered in San Francisco and operates as distributed-first with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore.
REQUIREMENTS:
- 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles (not entry-level)
- Hands-on infrastructure attribution: infrastructure pivoting and campaign tracking across shared certificates, registrars, nameservers, hosting, and ASNs; thinking in campaigns rather than isolated indicators
- Track record of staying on an actor or campaign over time, including through takedowns and re-registration
- Hands-on fluency with CTI tooling: passive DNS, WHOIS, certificate or Shodan-style fingerprinting, and phishing monitoring
- Experience building detection and clustering logic, rules, or automation yourself (not just configuring vendor tooling)
- Attribution tradecraft using open-source and commercially available data
- Demonstrated ability to produce actionable intelligence or targeting packages for government, law-enforcement, or equivalent consumers who acted on them, with calibrated and defensible analytic judgment
- Must be located in Washington D.C./MD/VA area (periodic in-person collaboration and travel may be required)
- AI fluency as a baseline expectation; ability to apply AI to accelerate workflows, structure problems, improve output quality, and increase speed and leverage
