Senior Blockchain Intelligence Analyst, Ransomware

The role

You will trace ransomware proceeds and identify threat actor infrastructure using blockchain analytics and cyber threat intelligence. You will produce finished intelligence, lead complex investigations, and support asset recovery missions.

What you will do

• Produce finished intelligence on ransomware actors, affiliates, facilitators, and laundering pathways
• Lead complex end-to-end blockchain investigations
• Trace ransomware-related funds across multiple blockchains, bridges, mixers, and peel chains
• Correlate on-chain activity with OSINT, threat intelligence, and off-chain signals
• Own investigative workstreams from discovery through validation and written production
• Support ransomware asset recovery by surfacing leads and identifying seizure opportunities
• Drive analytical leadership and mentor other analysts
• Partner with internal and external stakeholders to support cross-functional operations
• Contribute new attribution and refine investigative methodologies

Required qualifications

• 5-8+ years of professional experience in blockchain intelligence, crypto investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a comparable senior analytical rol
• Blockchain tracing expertise including experience with mixers, chain-hopping, bridges, and peel chains
• Demonstrated ability to independently run complex investigations and synthesize findings into written intelligence
• Deep understanding of the cybercrime ecosystem including ransomware operators, affiliates, and laundering networks
• Excellent written and verbal communication
• Strong judgment and ability to operate in a fast-moving, high-stakes environment
• Experience leveraging AI tools and large language models (LLMs) to accelerate research and workflows

Nice to have

• Experience in government, national security, law enforcement, incident response, or mature private-sector investigative programs
• Familiarity with OSINT, cybercrime infrastructure research, and cross-domain analytical methods
• Comfort with modern investigative tooling including TRM, Maltego, Palantir, or similar platforms
• Experience conducting HUMINT collection and engaging threat actors via dark web forums and encrypted messaging platforms
• Experience mentoring peers, shaping analytical standards, or improving investigative workflows
• Advanced practitioner-level knowledge of crypto forensics concepts such as manual demixing, smart contracts, and Ethereum- and TRON-based investigations
• Track record of shaping methodology or high-priority investigative strategy

Before you apply

• Most interview processes include a case study, an AI skills assessment, and a Leadership Principles interview
• The use of AI tools of any kind during TRM interviews is not permitted without prior approval

About the company

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. The company is a Series C company headquartered in San Francisco.