Senior Blockchain Intelligence Analyst – Ransomware

About the role

TRM Labs is seeking a senior analyst to lead high‑autonomy investigations into ransomware‑related cryptocurrency activity. The role focuses on tracing funds, attributing actors, and delivering actionable intelligence for disruption and asset recovery.

Key responsibilities

• Conduct end‑to‑end blockchain investigations from initial indicators to full attribution and recovery opportunities.
• Trace ransomware proceeds across multiple blockchains, mixers, bridges, and cash‑out services.
• Correlate on‑chain data with OSINT, threat‑intel, and off‑chain signals to build comprehensive adversary profiles.
• Produce finished intelligence products—actor profiles, lead packages, attribution assessments—for internal and external partners.
• Mentor junior analysts and improve investigative workflows without formal people‑management duties.

Required profile

• 5‑8+ years of experience in blockchain intelligence, crypto investigations, cybercrime or financial‑crime analysis.
• Proven ability to run complex investigations independently and produce auditable, defensible intelligence reports.
• Deep knowledge of ransomware ecosystems, including affiliates, laundering networks and cash‑out infrastructure.
• Strong judgment, curiosity and ability to operate in fast‑moving, high‑stakes environments.

Required skills

• Hands‑on blockchain tracing across multiple chains, mixers, bridges and peel chains.
• Proficiency with AI tools and large language models to accelerate research.
• Experience with OSINT, Maltego, Palantir or similar investigative platforms.
• Excellent written and verbal communication for technical findings to diverse audiences.