Blockchain Intelligence Analyst, Ransomware

Job not on LinkedIn

🔥 0 minutes ago

🌐 United States, United Kingdom – Remote

🇺🇸 United States – Remote 🇬🇧 United Kingdom – Remote

💵 $115k - $150k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

🕵️ Threat Intelligence Specialist

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

TRM Labs

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2018

₿ Crypto

📋 Compliance

🤝 B2B

Crypto • Compliance • B2B

TRM Labs is a blockchain intelligence company that provides transaction-monitoring, forensics, and compliance solutions for businesses and public-sector organizations dealing with cryptocurrencies. Their platform and products (examples: Compliance360, Investigation360, Seizure360, Supervision360, BlockInt API, MCP, wallet screening, Know-Your-Asset) help banks, crypto firms, regulators, law enforcement, and tax authorities detect, investigate, and block illicit crypto activity, support seizures, and meet AML/CTF and supervision requirements. TRM also offers training and certification (TRM Academy) and professional services such as incident response and capacity development.

📋 Description

• Produce finished intelligence on ransomware actors, affiliates, facilitators, and laundering pathways • Lead complex end-to-end blockchain investigations from seed indicators through attribution and recovery or disruption opportunities • Trace ransomware funds across blockchains, bridges, mixers, peel chains, and nested services • Correlate on-chain activity with OSINT, threat intelligence, partner data, and off-chain identity or infrastructure signals • Own investigative workstreams from discovery through validation, escalation, and written production • Surface leads and seizure or freeze opportunities supporting ransomware asset recovery • Prioritize investigative work, maintain analytical standards, and mentor analysts without formal people management • Partner with investigators, threat intelligence teams, product teams, and public- and private-sector partners • Improve ransomware coverage, investigative methodologies, lead-generation workflows, and asset-recovery support • Support external briefings, customer engagements, and capability-building sessions • Participate in weekly team syncs and daily async Slack standups • Document output in Notion and TRM investigative tools • Provide surge availability during time-sensitive disruption windows

🎯 Requirements

• 3–5+ years of professional experience in blockchain intelligence, crypto investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a comparable senior analytical role • Deep hands-on blockchain tracing across multiple blockchains • Experience tracing laundering and obfuscation techniques including mixers, chain-hopping, bridges, peel chains, and layered cash-out behavior • Ability to independently conduct complex investigations and produce investigative assessments, lead packages, fund-flow analyses, and attribution reports • Deep ransomware domain expertise and understanding of ransomware operators, affiliates, initial access brokers, malware developers, laundering networks, and cash-out services • Excellent written and verbal communication skills • Strong judgment, curiosity, and execution in fast-moving, high-stakes environments • Experience using AI tools and large language models, with ability to critically evaluate AI-generated outputs • Familiarity with OSINT, cybercrime infrastructure research, and cross-domain analytical methods • Preferred: experience in government, national security, law enforcement, incident response, or mature investigative/threat-intelligence programs • Preferred: familiarity with TRM, Maltego, Palantir, or similar platforms • Preferred: HUMINT collection and engaging threat actors via dark web forums and encrypted messaging platforms • Preferred: mentoring peers and improving investigative workflows • Preferred: practitioner-level knowledge of manual demixing, smart contracts, bridges, Ethereum- and TRON-based investigations, and OSINT-based data extraction • Primary time-zone overlap with US Eastern/Central • Surge availability during time-sensitive disruption windows

🏖️ Benefits

• Equity plan eligibility • Competitive benefits • Wellness programs • Time away from work • Reasonable accommodations for applicants with disabilities • Distributed-first/remote work arrangement