Senior All-Source Investigator, Severe Harms

Written by the T&S Network from TRM Labs's posting.

Investigation of sextortion and CSAM monetization through cryptocurrency, working inside TRM's Severe Harms pod within its Primary Intelligence organization. The pod fuses on-chain and off-chain intelligence to trace the financial rails behind this abuse, identify offenders and support victim identification for law enforcement and financial partners.

• Child sexual abuse material
• Child safety and grooming

What you'd do

• Take cases from referral to disruption, covering legal process, combined on-chain and off-chain analysis, and targeting.
• Collect across sources using open-source research, link analysis, and direct subject and source contact to attribute actors.
• Build attribution write-ups and legal-process returns that hold up under review by law enforcement, government partners, or a court.
• Map how criminal networks operate rather than cataloguing isolated indicators.
• Use AI to speed up casework while keeping human judgment in the loop for sensitive material.
• Coordinate with legal, engineering, and outside partners on the leads and referrals you hold.
• Handle evidence, escalations, and mandatory reports under TRM procedures, taking a victim-centered, trauma-informed approach.

What it asks for

• 3 to 5 years of investigative or casework experience in illicit finance, financial crime, cybercrime, trust and safety, all-source intelligence, OSINT, or human-source engagement, or a comparable law enforcement or intelligence background.
• Real collection capability, from building or adapting tools for open web, social, and forum sources, or direct engagement with subjects and sources.
• Track record co-running investigations or handing off cases cleanly.
• Experience delivering answers to partner or requester deadlines measured in hours or days.
• Interest in and some exposure to child exploitation, sextortion, or adjacent work such as counterterrorism or serious organized crime.
• AI fluency, required, with a clear view of where AI helps and where it doesn't.
• Working knowledge of subpoenas, warrants, and preservation requests, or willingness to learn them.

Worth knowing

• Exposure to disturbing sexual content involving minors as part of the regular caseload.
• Mandatory wellness check-ins and access to counseling and EAP resources.
• Surge availability expected during time-sensitive referral and disruption windows.
• Required enhanced background check as a condition of employment.

Terms in this role

CSAM.

Child sexual abuse material: images or video of the sexual abuse of children. Illegal to make, share or possess in nearly every country.

NCMEC.

The National Center for Missing & Exploited Children, a US nonprofit. It runs the CyberTipline, where US-based online services must report apparent child sexual abuse material they find.

Sextortion.

Threatening to share sexual images of someone unless they pay or send more. Teenagers are frequent targets.

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on TRM Labsnorth_east before you apply. If we got something wrong, report this listing.