Remote opportunity at
TRM LabsSenior / Staff Threat Intelligence Analyst, Hacks
TRM Labs is hiring a Senior or Staff Threat Intelligence Analyst to lead its hacks category end-to-end. In this role, you will take command when protocol…
Career Tools
About This Role
TRM Labs is hiring a Senior or Staff Threat Intelligence Analyst to lead its hacks category end-to-end. In this role, you will take command when protocol drains or exchange compromises occur, ensuring customers receive rapid visibility regarding blocked addresses and fund movements within hours. You will manage metrics, oversee the systems responsible for tracking hacks, and direct a small contractor team operating around the clock. The position involves collaborating closely…
Job Description
TRM Labs is hiring a Senior or Staff Threat Intelligence Analyst to lead its hacks category end-to-end. In this role, you will take command when protocol drains or exchange compromises occur, ensuring customers receive rapid visibility regarding blocked addresses and fund movements within hours. You will manage metrics, oversee the systems responsible for tracking hacks, and direct a small contractor team operating around the clock. The position involves collaborating closely with data science, engineering, and marketing units to trace stolen funds across major blockchain networks, build AI-assisted response agents, publish authoritative technical incident analysis, and develop proactive methods to identify vulnerable contracts before exploitation.
The role operates within TRM's Primary Intelligence organization. Candidates should expect a fast-paced, high-ownership environment characterized by frequent prioritization shifts, high ambiguity, and intense collaboration. TRM evaluates applicants on applied AI fluency, expecting team members to utilize AI tools as a daily force multiplier to accelerate and structure complex workflows. The interview process includes a recruiter introduction, a hiring manager deep dive, first-round technical interviews, a hands-on panel case study, and reference checks. TRM does not permit unauthorized third-party AI note-taking tools during interviews.
Responsibilities
- Lead incident response during major hacks, handling triage, cross-team coordination, internal and customer communications, and post-incident reporting
- Ensure major hacks are visible to customers rapidly following public reports, maintaining complete and accurate records of every incident
- Design downstream tracking systems alongside data science and engineering teams to follow stolen funds across networks
- Develop AI-powered tools and agents to automate portions of hacks analysis while maintaining human quality control
- Conduct root-cause investigations on major security breaches and publish technical analysis
- Build methodologies to identify vulnerable smart contracts prior to exploitation and integrate them into products
- Manage a small contractor team and direct operations around the clock
Requirements
- At least 5 years of professional background in blockchain intelligence, cryptocurrency investigations, cyber threat intelligence, incident response, or a related domain
- Prior ownership of incident response duties within a high-stakes setting such as an exchange, security firm, or CTI team
- Proficiency in blockchain tracing across major chains including Bitcoin, EVM, TRON, and Solana, as well as bridges, cross-chain swaps, and mixers
- Understanding of decentralized finance, bridge, and exchange exploit mechanics and post-theft attacker behaviors
- Demonstrated applied AI fluency with daily use of AI-assisted or agentic workflows and output validation
- Experience managing contractors or leading compact teams
- Clear written and verbal communication abilities ranging from technical deep-dives to executive summaries
Qualifications
- Smart-contract reverse-engineering skills in Solidity
- Prior background working at a security auditor or blockchain analytics organization
- Experience tracking specific, well-known hacker groups
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this a remote position?
Yes, the source states that the remote status for this role is remote.
What is the employment type?
The posting specifies that this is a full-time position.
What is the salary range for this role?
The salary is not stated in the job posting.
How can I apply for this position?
The posting instructs candidates to apply directly through TRM's application link, as applications sent directly to individuals are not guaranteed to reach the hiring team.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.