TRM Labs

Lead Cyber Threat Intelligence Analyst

United States

Sponsorship not specifiedDetected 25 days ago

A/B TestingCybersecurityResearchLeadershipCommunicationCollaborationProblem SolvingMentoringAdaptability

About the role

Produce finished cyber threat intelligence, including actor profiles, campaign reports, IOC packages, infrastructure attributions, and evidence-ready analytical outputs.
Triage large indicator sets, cluster infrastructure, and turn fragmented signals into clear, defensible findings that stakeholders can act on immediately.
Help evaluate and operationalize new analytical tooling by pressure-testing it on real workflows and identifying where it meaningfully reduces analyst effort.

BUILD A SAFER WORLD.
TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks.
Move quickly from a single lead or indicator to an initial analytical picture while the signal is still operationally useful.
Support partners and internal teams on time-sensitive issues where fast, defensible judgment matters more than perfect information.
We balance speed with high standards, own outcomes end‑to‑end, and invest in getting better everyday.
As a Lead Cyber Threat Intelligence Analyst, you will conduct ad hoc investigations, time sensitive blockchain analysis for our partners, and develop solutions that allow TRM to scale rapidly and effectively.
You will collaborate with an experienced team of blockchain intelligence experts, engineers, and data scientists to deliver cutting-edge support to TRM's clients.
Correlate technical indicators with OSINT, identity signals, infrastructure patterns, and financial-rail activity to build a fuller understanding of adversary behavior.
We are building a safer world.
This environment is energizing for people who enjoy building, solving hard problems, and making progress in situations that are not always fully defined.

8+ years of experience in cyber threat intelligence, intelligence analysis, incident-driven investigations, or a closely related analytical field, with at least 1+ years of experience in a people lead/manager role.
Strong OSINT instincts and the ability to resolve identities, aliases, and behavior across fragmented sources.
A track record of leading complex investigations, improving workflows, and helping other analysts do better work.
Excellent written and verbal communication skills, with the ability to package findings for technical and non-technical audiences alike.
Comfort operating in a fast-paced environment where priorities can change quickly and ambiguity is normal.
AI fluency is required.
Work that often requires operating with a high degree of ambiguity

Distributed team with an async-first approach via Slack and Notion, plus structured syncs for alignment

TRM's intelligence and investigations work combines national-security-grade tradecraft with deep analytical workflows across cyber, OSINT, and blockchain-enabled threat activity.
This role sits at the intersection of intelligence production, investigations, and product-informed tradecraft, helping ensure TRM's analytical capabilities remain operationally relevant, scalable, and high-quality across multiple use cases and stakeholders.
High autonomy, high standards, low bureaucracy - work directly with analysts, engineers, and customers who depend on your output
Weekly team syncs to align targeting priorities and review disruption opportunities
Daily async standups via Slack on active work, returns, and target packages in flight
Primary time zone overlap: US Eastern / Central
Continuously adapt your tradecraft as adversaries, data sources, and analytical tooling evolve.
That promise shows up in how we work every day.

This listing is sourced directly from TRM Labs's careers page and normalized into a canonical job model.