TRM Labs

TRM Labs

Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

Washington D.C · Junior

Sponsorship not specifiedDetected 21 days ago
A/B TestingCybersecurityDNSLeadershipCommunicationCollaborationProblem SolvingMentoringAdaptability

Stay score

odds of building a lasting career here

30Risky
Cap-exempt (no lottery)0
Sponsors this role52
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Files H-1B transfers

4 transfer filings in the last year, covering 4 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • The Scam Disruption team is TRM's tip of the spear against pig butchering syndicates, romance fraud networks, and investment scam operations that steal billions from victims each year.
  • Start from one indicator - a scam domain, IP, or certificate - and pivot across shared certificates, registrars, nameservers, hosting, and ASNs to map the wider infrastructure behind Southeast Asia scam operations, clustering one-off indicators into campaigns.
  • Track campaigns as they evolve - new domains, hosting and registrar changes, certificate reuse - and stay on actors as they rebuild and re-register after takedowns and seizures, anticipating their next infrastructure.

Responsibilities

  • BUILD A SAFER WORLD.
  • TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks.
  • You'll track scam infrastructure as it evolves, fusing technical, open-source, and on-chain data to build the operational pictures that help dismantle scam operations.
  • Drive attribution of threat actors by leveraging open-source and commercially available data.
  • Build clustering logic, detection rules, and automation or tooling to surface malicious infrastructure proactively, rather than waiting on off-the-shelf feeds.
  • Own the intelligence cycle end to end with minimal supervision, partnering with the Scams SME team and with data, engineering, and product to sharpen TRM's collection capabilities.
  • We seek people whose work matters, who build with speed and rigor, and who take pride in protecting others through their craft.
  • Build to protect civilization.
  • We are building a safer world.
  • This environment is energizing for people who enjoy building, solving hard problems, and making progress in situations that are not always fully defined.

Requirements

  • 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles (this is not an entry-level position).
  • A track record of staying on an actor or campaign over time, including through takedowns and re-registration.
  • Demonstrated ability to produce actionable intelligence or targeting packages for a government, law-enforcement, or equivalent consumer who acted on them, and calibrated, defensible analytic judgment.
  • Must be located in the Washington, D.C./MD/VA area (periodic in-person collaboration and travel may be required)
  • Operating with a high degree of ambiguity

Nice to have

  • Distributed team with an async-first approach via Slack and Notion, plus structured syncs for alignment

Skills

  • All output documented in Notion and TRM's investigative tools

Compensation

  • Your recruiter will present the offer and compensation details.

Company info

  • The Scam Disruption team operates within TRM's Blockchain Intelligence organization, alongside threat intelligence analysts, on-chain investigators, and federal partners
  • All-Source Investigators and Cyber Threat Intelligence Analysts are the operational core, converting strategy and tooling into prosecutable, actionable intelligence
  • High autonomy, high standards, low bureaucracy - work directly with analysts, engineers, and customers who depend on your output
  • We are a high-velocity, high-ownership team that expects clarity, follow-through, and impact.
  • Impact-Oriented Trailblazer: We put customers first and move with speed, focus, and adaptability.
  • At TRM, we care deeply about our craft.
Apply directly at TRM Labs →Create a free account for alerts like thisView TRM Labs immigration profile

This listing is sourced directly from TRM Labs's careers page and normalized into a canonical job model.