Senior / Staff Cyber Threat Response Advisor

The role

You will analyze critical-infrastructure sectors to identify and surface vulnerabilities and exposures. You will run end-to-end all-source analysis using OSINT, external exposure discovery, and threat-actor collection to produce actionable intelligence.

What you will do

• Analyze critical-infrastructure sectors to identify organizations to protect and surface vulnerabilities
• Run cyber threat collection using OSINT, external attack-surface discovery, and threat-actor collection
• Leverage AI to build tools and workflows for remediation
• Map C2 infrastructure, malware families, TTPs, and actors
• Triage large indicator and exposure sets into defensible findings
• Produce finished intelligence including actor profiles, campaign reporting, and IOC packages
• Act as a senior advisor across multiple active threats
• Partner with critical-infrastructure entities, government partners, ISACs, and internal teams

Required qualifications

• 5-8+ years in cyber threat intelligence, incident response, or a closely related analytical field
• Experience as the primary point of contact for an outside organization during a live incident or remediation
• Track record of driving complex analysis independently
• Ability to deliver answers under RFI-style pressure
• Applied AI fluency including building AI-assisted or agentic workflows
• Real collection capability in open web, social, forum sources, external attack-surface discovery, or direct threat-actor collection
• Experience producing finished intelligence such as actor profiles, campaign reporting, attribution assessments, exposure notifications, or infrastructure mapping
• Strong OSINT instincts
• Excellent judgment about analytical confidence and evidentiary strength
• Excellent written and verbal communication
• Comfort operating in a fast-paced environment with changing priorities and ambiguity
• Must be based in the United States

Nice to have

• Direct familiarity with one or more critical-infrastructure sectors (e.g., ICS/OT/SCADA, healthcare, energy, or financial-sector security)
• Experience working with or delivering intelligence to government partners, ISACs, or sector coordinating bodies
• Working proficiency in a language heavily used by cyber actors
• A public presence: conference talks, published research, or invite-only sharing circles

Before you apply

• U.S. citizenship is required
• Must be based in the United States
• Interview process includes a case study, an AI skills assessment, and a Leadership Principles interview
• Use of AI tools during interviews is not permitted without prior approval

About the company

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. The company is a Series C company with $220M in total funding.