Staff Cyber Threat Intelligence Analyst

About the role

TRM Labs is seeking a Staff Cyber Threat Intelligence Analyst to lead high‑complexity investigations, support time‑sensitive blockchain analysis, and shape investigative methods that enable rapid scaling of its intelligence capabilities.

Key responsibilities

• Produce finished intelligence products such as actor profiles, campaign reports, IOC packages, and infrastructure attributions.
• Lead multiple active investigations, set analytical standards, and coach analysts on tradecraft and judgment.
• Drive investigations from seed indicators (domains, IPs, hashes, wallets) to attributed actors and campaign pictures, codifying reusable methods.
• Correlate technical indicators with OSINT, identity signals, infrastructure patterns, and financial‑rail activity.
• Support incident responders, threat hunters, investigators, and external partners with timely, high‑confidence briefings.
• Evaluate and operationalize new analytical tooling to improve analyst efficiency and output quality.

Required profile

• 8+ years of experience in cyber threat intelligence, intelligence analysis, or incident‑driven investigations.
• Proven track record producing finished intelligence products and leading complex investigations.
• Strong OSINT instincts and ability to resolve fragmented identities and aliases.
• Excellent judgment on analytical confidence, evidentiary strength, and defensibility of findings.
• Comfort operating in fast‑paced, ambiguous environments and delivering high‑quality work under pressure.

Required skills

• Deep expertise in cyber investigations, infrastructure attribution, and actor profiling.
• Proficiency with blockchain analysis and linking technical findings to financial infrastructure.
• Advanced OSINT techniques and tools.
• Fluency with AI tools as part of research, synthesis, and workflow acceleration.