TRM Labs

Senior Cyber Threat Intelligence Analyst

United States · Senior

Sponsorship not specifiedDetected 25 days ago

A/B TestingCybersecurityResearchLeadershipCommunicationCollaborationProblem SolvingMentoringAdaptability

About the role

Produce finished cyber threat intelligence, including actor profiles, campaign reports, IOC packages, infrastructure attributions, and evidence-ready analytical outputs.
Triage large indicator sets, cluster infrastructure, and turn fragmented signals into clear, defensible findings that stakeholders can act on immediately.
Help evaluate new analytical tooling by pressure-testing it on real workflows and identifying where it meaningfully reduces analyst effort or improves output quality.

BUILD A SAFER WORLD.
TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks.
We balance speed with high standards, own outcomes end‑to‑end, and invest in getting better everyday.
You will collaborate closely with blockchain intelligence experts, engineers, and data scientists to deliver high-confidence analytical support to TRM's partners and internal teams.
Act as a senior analyst across multiple active actors and campaigns at once, helping improve quality, share tradecraft, and informally support other analysts through strong analytical execution.
Correlate technical indicators with OSINT, identity signals, infrastructure patterns, and financial-rail activity to build a fuller understanding of adversary behavior.
Support incident responders, threat hunters, investigators, and partner-facing teams with timely, high-confidence intelligence products and briefings.
We are building a safer world.
This environment is energizing for people who enjoy building, solving hard problems, and making progress in situations that are not always fully defined.

5+ years of experience in cyber threat intelligence, intelligence analysis, incident-driven investigations, or a closely related analytical field.
Strong OSINT instincts and the ability to resolve identities, aliases, and behavior across fragmented sources.
A track record of independently driving complex investigations, improving workflows, and elevating the quality of analytical work around you.
Excellent written and verbal communication skills, with the ability to package findings for technical and non-technical audiences alike.
Comfort operating in a fast-paced environment where priorities can change quickly and ambiguity is normal.
AI fluency is required.
Work that often requires operating with a high degree of ambiguity

Distributed team with an async-first approach via Slack and Notion, plus structured syncs for alignment

TRM's intelligence and investigations work combines national-security-grade tradecraft with deep analytical workflows across cyber, OSINT, and blockchain-enabled threat activity.
This role sits at the intersection of intelligence production, investigations, and product-informed tradecraft, helping ensure TRM's analytical capabilities remain operationally relevant, scalable, and high-quality across multiple use cases and stakeholders.
The team is best suited for someone who can independently drive complex analytical work, collaborate effectively across functions, and take a long-term, intentional approach to improving how investigations are done across the broader organization.
High autonomy, high standards, low bureaucracy - work directly with analysts, engineers, and customers who depend on your output
Weekly team syncs to align targeting priorities and review disruption opportunities
Daily async standups via Slack on active work, returns, and target packages in flight
Primary time zone overlap: US Eastern / Central
That promise shows up in how we work every day.
TRM moves quickly.
We are a high velocity, high ownership team that expects clarity, follow-through, and impact.

This listing is sourced directly from TRM Labs's careers page and normalized into a canonical job model.