TRM Labs
Senior Blockchain Intelligence Analyst, Ransomware
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Senior Blockchain Intelligence Analyst, Ransomware
# Senior Blockchain Intelligence Analyst (Ransomware) – Build a Safer World
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. Its platforms enable investigators to trace illicit activity, build cases, and construct threat network operating pictures. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure.
About The Role
We’re seeking a Senior Blockchain Intelligence Analyst dedicated to ransomware, a high-judgment, high-autonomy independent contributor who specializes in: ✔ Blockchain analytics & cyber threat intelligence ✔ Cryptocurrency attribution to disrupt malicious actors ✔ Tracing ransomware proceeds, identifying threat actor infrastructure, and generating actionable intelligence for investigations and disruption.
Not a people-management role. This position requires an experienced analyst capable of:
- Independently leading complex blockchain investigations
- Developing high-confidence attributions while mentoring peers by example
- Correlating technical, financial, and behavioral signals into defensible intelligence
- Collaborating with internal/external stakeholders across investigative tradecraft.
You must combine skills in cross-blockchain tracing, infrastructure laundering, and surfacing operational disruption opportunities—ensuring outputs hit the mark in investigative, executive, and partner contexts.
The Impact You’ll Have
- Produce finished ransomware intelligence (actor profiles, lead packages, attributions, and reports) for investigations, recovery, or recovery operations.
- End-to-end blockchain investigations from seed indicators (e.g., victim payment addresses → collapses, deprecated services, or IP-linked activity) to "irreversible conclusions".
- Trace **ransomware funds across:
- Multiple blockchains
- Bridges, mixers, peel chains, or nested obfuscation
- Physical cash-out touchpoints**
- Correlate on-chain activity with OSINT, threat intelligence, and off-chain identities.
- Own workstreams from discovery to validation, escalation, and written production, including source-cited, auditable intelligence for internal/externalsector partners.
- Boost ransomware asset recovery by identifying freezing/seizure opportunities in real time.
- Elevate team capability by shaping priorities, refining methodologies, and improving workflows—without formal management responsibility.
- Partner with investigators, threat intel, product teams, and client stakeholders to ensure insights align with real-time investigative needs.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
What Success Looks Like
✅ Material contributions, solving underdetermined cases where funds are purposefully obscured. ✅ Trusted intelligence: Work trusted and operationalized in daily law enforcement actions. ✅ Agile speed: Balancing rigour with rapid-response outcomes before funds or evidence disappear. ✅ Capability growth: Mentoring peers, reinforcing best practices, and boosting team consistency in lead generation/recovery support.
Through these efforts, you’ll enhance how TRM disrupts cybercrime via blockchain intelligence.
Requirements
Core
- 5–8+ years experience in:
- Blockchain intelligence, cryptocurrency investigations, threat intelligence, financial crime, or comparable senior analysis roles.
- Advanced blockchain tracing skills:
- Tracing across cross-chain obfuscation (mixers, bridges, chain popping, nested services).
- Hands-on experience tracing funds under multiple obfuscation layers.
- Investigative expertise:
- Independently running complex investigations and articulating results in clear intelligence products (assignments, laundering timelines, attribution reports).
- Ransomware domain expertise:
- Deep understanding of the ransomware ecosystem and relationships among:
- Ransomware operators & affiliates
- Initial access brokers (IABs)
- Malware devs
- Laundering networks & cash-out services.
- Deep understanding of the ransomware ecosystem and relationships among:
- Communication skills:
- Turning highly technical findings into actionable, digestible intelligence for executives, government, and private-sector audiences.
- Judgment & adaptability:
- Thriving in ambiguous, fast-paced environments with stakes requiring ruthless follow-through and scrutiny-resisting rigor.
- AI literacy:
- Experience leverage AI for research (e.g., LLMs, LLTF tools) while evaluating outputs critically for accuracy/relevance.
Preferred
- Government/national security, incident response or organisational investigative expertise.
- Experience on OSINT, correlating on-chain activity with off-chain adversary behavior.
- Working with modern investigative tooling (e.g., TRM, Maltego, Palantir, Lumeta).
- Engaging threat actors via dark web forums or encrypted communication channels.
- Mentorship/leadership informal context or shaping investigative standards.
- Advanced forensics knowledge:
- Manual demixing, Ethereum/TRON smart contract deep dives, PEEL strategy exposure.
- Public sector analytical influence—effectively shaping methodologies or high-priority case strategy.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Our Culture & Expectations
TRM operates with mission-driven speed and urgency. Expect: 🔥 Dynamic priorities shifting frequently; ambiguity is a constant. 🔥 Daytime collaborate rigor with constant follow-up, real-time decision-making. 🔥 High ownership—your defensibility, prioritisation, and impact matter. 🔥 Legacy-independent problem-solving to outthink adversaries.
Is This Right For You? Call it "yes" if: ✔️ You love complexity and are evangelistic about unlocking cheap/obscured value chains. ✔️ You’re driven to call out crime, secure full chains of evidence. ✔️ You adapt quickly, learn with curiosity, and lead through execution. ✔️ You view AI augmentation as a differentiator, not a crutch.
If you thrive with speed, clarity, creativity, value-creation, the uncertainty here will energise you. Meanwhile, consistency professionals, stablifiers: actively vet your fit in interviews.
Do Our Values Align? Our leadership principles:
- Impact-Oriented Trailblazer: Test → Ship → Measure → Iterate.
- Master Craftsperson: Deep dive, obsessive problem-solving, continuous improvement.
- Inspiring Colleague: Humility, candid collaboration, shared learning.
Embody these, and join our collective to stamp out cybercrime.
Final Notes
🔒 Privacy & Legal: By applying, you agree to TRM’s Privacy Policy—data stored 36 months for hiring, then purged (or longer if required by law).
🚩 **No agents **[⚠]TRM does not entertain unsolicited agency submissions.
🌍 Locations: Remote (USET/EDT-centric, but distributed-flex), HQ/Hubs: SF, DW, D.C, NYC, London, Singapore.
⚡ Next Step: Interview AI fluency is evaluated candidly—Aging in a stack of high-velocity—are you ready?
Apply now. Together we’ll seize the chains.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location