Opportunity at
TRM LabsSenior Blockchain Intelligence Analyst, Ransomware
TRM Labs is seeking a Senior Blockchain Intelligence Analyst, Ransomware to join the organization on an on-site basis. In this full-time individual contributor position, the specialist…
Career Tools
About This Role
TRM Labs is seeking a Senior Blockchain Intelligence Analyst, Ransomware to join the organization on an on-site basis. In this full-time individual contributor position, the specialist will focus on tracking ransomware proceeds, identifying threat infrastructure, and producing actionable intelligence. TRM Labs builds AI-powered intelligence solutions that assist public and private sector agencies with investigating and disrupting criminal activity. This role suits an independent investigator who can handle complex assignments, uncover…
Job Description
TRM Labs is seeking a Senior Blockchain Intelligence Analyst, Ransomware to join the organization on an on-site basis. In this full-time individual contributor position, the specialist will focus on tracking ransomware proceeds, identifying threat infrastructure, and producing actionable intelligence. TRM Labs builds AI-powered intelligence solutions that assist public and private sector agencies with investigating and disrupting criminal activity. This role suits an independent investigator who can handle complex assignments, uncover novel attribution, and mentor peers without engaging in people management.
The position requires tracking cryptocurrency across multiple ledgers, mixers, bridges, and peel chains while correlating blockchain data with open-source intelligence and threat feeds. Team members participate in weekly alignment syncs, daily asynchronous updates via Slack, and maintain documentation in Notion and company tools. Candidates should expect a fast-paced setting characterized by ambiguity, high ownership, and surge availability during time-sensitive disruption windows. The interview process includes a recruiter introduction, a hiring manager deep dive, initial round skill interviews, a hands-on case study panel, and reference checks.
Responsibilities
- Produce finished intelligence regarding ransomware actors, affiliates, laundering paths, lead packages, and attribution assessments
- Lead complex blockchain investigations from initial seed indicators through to full attribution and disruption opportunities
- Trace ransomware funds across multiple blockchains, bridges, mixers, and nested services to identify cash-out points and controllers
- Correlate on-chain metrics with open-source intelligence, threat data, and off-site identity signals
- Own investigative workflows from discovery to written production of source-cited and auditable intelligence products
- Support asset recovery by surfacing quality leads and identifying seizure opportunities before funds are off-ramped
- Guide analytical execution, maintain rigorous standards, and mentor colleagues without formal management duties
- Partner with internal teams and external stakeholders to ensure analytical outputs reflect accurate tradecraft
- Contribute new attribution and improve repeatable workflows for lead generation and asset recovery support
- Represent the organization in external briefings, customer engagements, and capability-building sessions
Requirements
- 5 to 8 or more years of professional background in blockchain intelligence, cryptocurrency investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a comparable senior analytical role
- Hands-on expertise tracing funds across multiple blockchains and obfuscation techniques like mixers, chain-hopping, bridges, and peel chains
- Demonstrated ability to independently conduct complex investigations and synthesize findings into clear written intelligence products
- Domain expertise in the cybercrime ecosystem, including relationships among ransomware operators, affiliates, brokers, and cash-out services
- Strong written and verbal communication skills to translate technical findings into actionable intelligence
- Strong judgment and capability to operate effectively in a fast-moving environment
- Fluency in leveraging AI tools and large language models to accelerate research while critically evaluating outputs for accuracy
Qualifications
- Background in government, national security, law enforcement, incident response, or mature private-sector investigative or threat intelligence programs
- Familiarity with open-source intelligence, cybercrime infrastructure research, and cross-domain analytical methods
- Proficiency with modern investigative tooling such as TRM, Maltego, Palantir, or structured data environments
- Experience conducting human intelligence collection and engaging threat actors via dark web forums and encrypted messaging platforms
- Experience mentoring peers, shaping analytical standards, or improving investigative workflows
- Advanced practitioner knowledge of crypto forensics concepts like manual demixing, smart contracts, bridges, and specific network investigations
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary for this position?
The salary ranges from USD 140,000 to 160,000 per year.
Is this a remote position?
No, the posting indicates that the role is on-site.
Does this role include people management responsibilities?
No, this is an individual contributor role, though it does involve mentoring other analysts and providing analytical leadership.
How should I apply for this job?
TRM Labs encourages candidates to apply directly through their site to ensure every application is reviewed by the talent team.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
