Opportunity at
TRM LabsSenior / Staff Threat Intelligence Analyst, Hacks
TRM Labs is looking for a Senior or Staff Threat Intelligence Analyst to lead its hacks function. TRM makes intelligence software that helps government and private…
Career Tools
About This Role
TRM Labs is looking for a Senior or Staff Threat Intelligence Analyst to lead its hacks function. TRM makes intelligence software that helps government and private sector clients trace illicit activity. The person hired becomes the owner of the company's response to large theft events. After a theft from a protocol or exchange, customers want to know quickly which wallets to freeze and where the proceeds are moving. The role…
Job Description
TRM Labs is looking for a Senior or Staff Threat Intelligence Analyst to lead its hacks function. TRM makes intelligence software that helps government and private sector clients trace illicit activity. The person hired becomes the owner of the company's response to large theft events. After a theft from a protocol or exchange, customers want to know quickly which wallets to freeze and where the proceeds are moving.
The role carries full ownership of that work. It covers the metrics used to measure hack coverage, the detection system that captures incidents, and a small contractor group that monitors around the clock.
Day-to-day duties include leading the response when a major incident happens, which means setting priorities, coordinating teams, handling internal and customer messaging, and writing the post-incident review. The analyst makes sure significant incidents reach TRM's data within hours and that each one is logged with its entity, stolen-fund addresses, date, amount and category. Working with data science and engineering colleagues, the analyst designs how attribution follows stolen funds as they move. The role also covers root-cause analysis of important incidents, public technical research, and methods for spotting weak smart contracts before attackers exploit them.
Candidates should bring at least five years in on-chain analysis, digital asset investigations, cyber threat work, incident handling or a neighboring discipline. Proficiency in following funds across BTC, EVM, TRON and Solana, including bridge transfers, cross-chain swaps and mixing services, is required. The person should understand how attacks on DeFi protocols, bridges and exchanges unfold and what attackers typically do once they hold funds. Practical AI skill is also expected, meaning the ability to build AI-assisted workflows and explain how their outputs are checked. Experience managing contractors or a small team completes the profile.
Compensation is listed at USD 140,000 to 180,000 per year. The process described includes a recruiter conversation, a hiring manager interview, one to two skills interviews, a panel round and reference checks. No specific work location for this role is named.
Responsibilities
- Lead the response to major incidents, covering triage, cross-team coordination, messaging and the post-incident report
- Get significant incidents into TRM's data quickly so customers can act within hours
- Keep incident records complete and accurate, with entity, addresses, date, amount and category
- Co-design with data science and engineering how attribution follows stolen funds
- Build AI-assisted tools and agents for incident analysis, with human review of every output
- Produce root-cause analyses and public technical research on major incidents
- Develop methods to flag vulnerable smart contracts before they are exploited
- Oversee the contractor team that monitors incidents around the clock
Requirements
- Five-plus years of hands-on work in on-chain analysis, digital asset investigations, cyber threat intelligence, incident handling or a nearby field
- Hands-on ownership of incident handling in high-pressure settings
- Skilled fund tracing on BTC, EVM, TRON and Solana, covering bridge transfers, cross-chain swaps and mixers
- Working knowledge of DeFi, bridge and exchange exploits and attacker behavior after a theft
- Practical AI fluency, including validating outputs and spotting where they fail
- Track record of running contractor staff or a small group
- Able to write clearly, from technical write-ups to short executive briefings
Qualifications
- Smart-contract reverse-engineering experience with Solidity
- Background at a smart-contract auditing company or an on-chain analytics provider
- Experience tracking specific, well-known hacker groups
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary for this TRM Labs role?
The posting lists a base salary of USD 140,000 to 180,000 per year.
How many years of experience does the role require?
The posting asks for five-plus years in on-chain analysis, digital asset investigations, cyber threat intelligence, incident handling or a nearby field.
Does the posting state where this role is located?
No. The posting does not specify a work location for this role.
What does the hiring process involve?
The posting describes a recruiter conversation, a hiring manager interview, one to two skills interviews, a panel round and reference checks.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
