TRM Labs
Senior Cyber Threat Intelligence Analyst
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Senior Cyber Threat Intelligence Analyst
Build a Safer World.
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. Our platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on us to make the world safer and more secure.
About the Role
As a Senior Cyber Threat Intelligence Analyst, you will conduct ad hoc investigations, time-sensitive blockchain analysis for our partners, and contribute to investigative methods and workflows that help TRM scale rapidly and effectively.
You will collaborate closely with blockchain intelligence experts, engineers, and data scientists to deliver high-confidence analytical support to TRM’s partners and internal teams.
The Impact You Will Have
- Produce finished cyber threat intelligence, including:
- Actor profiles
- Campaign reports
- IOC packages
- Infrastructure attributions
- Evidence-ready analytical outputs
- Act as a senior analyst across multiple active actors and campaigns simultaneously, improving quality, sharing tradecraft, and informally supporting other analysts.
- Lead complex investigations from seed indicators (such as domains, IPs, hashes, aliases, or wallets) through to attributed actors, clusters, or campaign pictures.
- Correlate technical indicators with OSINT, identity signals, infrastructure patterns, and financial-railing activity to build a fuller understanding of adversary behavior.
- Triage large indicator sets, cluster infrastructure, and turn fragmented signals into clear, defensible findings that stakeholders can act on immediately.
- Support incident responders, threat hunters, investigators, and partner-facing teams with timely, high-confidence intelligence products and briefings.
- Help evaluate new analytical tooling by testing it on real workflows and identifying where it reduces analyst effort or improves output quality.
- Contribute to stronger investigation workflows, analytical standards, and repeatable methods that improve analyst throughput without sacrificing rigor.
What We’re Looking For
- 5+ years of experience in:
- Cyber threat intelligence
- Intelligence analysis
- Incident-driven investigations
- A closely related analytical field
- Demonstrated experience producing finished intelligence products such as:
- Actor profiles
- Campaign reports
- Attribution assessments
- Infrastructure mapping
- Deep familiarity with:
- Cyber investigations
- Infrastructure attribution
- Campaign analysis
- Actor profiling
- Strong OSINT instincts and the ability to resolve identities, aliases, and behavior across fragmented sources.
- Ability to connect technical findings to financial infrastructure, including:
- Wallets
- Laundering paths
- Sanctions exposure
- Identity-linked leads (when relevant)
- Excellent judgment about:
- Analytical confidence
- Evidentiary strength
- What can be defended in reports, referrals, or operational settings
- Track record of:
- Independently driving complex investigations
- Improving workflows
- Elevating the quality of analytical work
- Excellent written and verbal communication skills, with the ability to package findings for both technical and non-technical audiences.
- Comfort operating in a fast-paced, ambiguous environment where priorities shift quickly.
- AI fluency is required—AI tools must meaningfully accelerate research, synthesis, and workflows with strong human oversight.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
About the Team
TRM’s intelligence and investigations work combines national-security-grade tradecraft with deep analytical workflows across cyber, OSINT, and blockchain-enabled threat activity.
This role sits at the intersection of intelligence production, investigations, and product-informed tradecraft, ensuring TRM’s capabilities stay operationally relevant, scalable, and high-quality across multiple use cases and stakeholders.
The team is best suited for someone who can:
- Independently drive complex analytical work
- Collaborate effectively across functions
- Focus on long-term improvement of investigative methods
Team Operating Model
- Distributed with an async-first approach (Slack + Notion)
- Structured syncs for alignment
- High autonomy, high standards, low bureaucracy
- Works directly with analysts, engineers, and customers who depend on your output
Weekly Structure
- Weekly team syncs for prioritization and disruption reviews
- Daily async standups via Slack on active work and returns
- Primary time zones: US Eastern / Central
- Output documented in Notion and TRM’s investigative tools
- Surge availability required during critical disruption windows
Life at TRM
We’re building a safer world—a mission that shapes how we work every day.
TRM's Operating Style
- High velocity, high ownership: Work moves quickly, with clarity, follow-through, and impact expected.
- Hard problems, experimentation, continuous feedback: Exciting for those who thrive on ambitious goals and creative problem-solving.
- Ambiguity is normal: Comfort navigating unclear situations and adjusting priorities is key.
What to Expect
✔️ Fast-paced priorities shifting quickly ✔️ High ambiguity in investigations ✔️ High ownership and accountability ✔️ Frequent collaboration across teams ✔️ Creative problem-solving in dynamic environments
Get help with your application
Your very own career expert that helps elevate your application to the next level.
This environment is energizing for those who love building and solving complex challenges—but it’s not for everyone. If you prefer predictability or a stable workload, assess where you fit before applying.
AI Fluency at TRM
Basic AI fluency is a non-negotiable expectation at TRM.
We believe AI transforms how top performers work—expect every team member to use AI to accelerate, restructure, and elevate their craft, not just automate tasks.
With AI Fluency, You’ll Be Among the Top 10% of Operators in Your Function by:
- Accelerating repeatable workflows
- Structuring and solving problems
- Improving output quality
- Increasing speed and leverage
You’ll be evaluated on AI fluency during interviews.
Leadership Principles
We lead by three key principles:
- Impact-Oriented Trailblazer: Move fast, focus, and adapt. Treat every plan as an experiment—test, ship, learn, and iterate.
- Master Craftsperson: Balance speed with high standards. Own outcomes end-to-end and invest in daily improvement.
- Inspiring Colleague: Add clarity and energy over noise. Act with humility, candor, and a one-team mindset—giving and receiving feedback to strengthen the team.
Join Our Mission
At TRM, we care deeply about our craft. We’re looking for individuals who want their work to matter, experiment with speed and rigor, and take pride in building a safer world.
If you align with our mission—even if you don’t check every box—apply. We hire for slope, judgment, and the will to learn fast quickly.
Company Background
- Series C, with $220M in funding (backed by Blockchain Capital, Goldman Sachs, Bessemer, Y Combinator, Thoma Bravo, etc.)
- Headquartered in San Francisco, with global hubs in Los Angeles, New York, Washington D.C., London, and Singapore
Privacy & Information
By applying, you agree to let TRM process your data per our Privacy Policy.
- Data is collected solely to assess your candidacy.
- Retention period: 36 months (unless legally required).
- If based in the EU, UK, or another jurisdiction with data protection laws, you may request access, correction, or deletion before the 36-month period via privacy@trmlabs.com.
Further Notes
- AI tools (e.g., notetakers, interview assistants) are not permitted without prior TRM approval.
- Accommodations available for applicants with disabilities—contact via this form.
- No agency resumes accepted; unsolicited resumes will not be considered.
Learn more: Company Values | Interviewing | FAQs
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location