Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

Written by the T&S Network from TRM Labs's posting.

Cyber threat intelligence work on scam infrastructure, targeting pig butchering, romance fraud and investment scam operations. The Scam Disruption team pivots from single domains, IPs or certificates to the networks behind them and traces the flow of funds, sitting within TRM's Blockchain Intelligence organization.

• Fraud and scams

What you'd do

• Start from a single scam domain, IP or certificate and map the wider network behind Southeast Asian scam groups.
• Track campaigns as domains, hosting, registrars and certificates change, and follow actors after takedowns and re-registrations.
• Attribute threat actors using open-source and commercially available data.
• Carry investigations from infrastructure through wallets, laundering paths and cash-out points.
• Build clustering logic, detection rules and tooling to surface malicious infrastructure proactively.
• Write calibrated assessments with confidence levels and targeting packages for government and law-enforcement partners.

What it asks for

• Five or more years in CTI or threat infrastructure analysis work.
• Hands-on infrastructure attribution across certificates, registrars, nameservers, hosting and ASNs.
• Track record of staying on an actor or campaign through takedowns and re-registration.
• Working knowledge of passive DNS, WHOIS, certificate and Shodan-style fingerprinting, plus phishing monitoring.
• Experience building your own detection, clustering logic or automation, not only configuring vendor tools.
• Demonstrated actionable intelligence delivered to a government or law-enforcement consumer who acted on it.
• Must be located in the Washington, D.C., Maryland or Virginia area; periodic in-person work and travel may be required.

Worth knowing

• Surge availability expected during time-sensitive disruption windows.
• Primary time zone overlap with US Eastern and Central.

Terms in this role

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on TRM Labsnorth_east before you apply. If we got something wrong, report this listing.