Staff Cyber Threat Intelligence Analyst

Written by the T&S Network from TRM Labs's posting.

Investigations work on cyber threat actors and financial crime, run on TRM's AI Investigations platform for law enforcement and financial institutions. The Intelligence Team tracks cyber, OSINT, and blockchain-enabled threat activity, and this senior analyst role takes the highest-complexity cases and sets the team's analytical standard.

What you'd do

• Run complex investigations from a single seed indicator to an attributed actor, cluster, or campaign picture.
• Trace hostile infrastructure, malware, tactics, and the operators behind them to build actor networks.
• Connect technical leads with open-source and identity research, then trace money flows when the case calls for it.
• Work with engineers and data scientists to package investigative methods into tools the whole team can use.
• Review team confidence judgments and coach analysts on rigor and tradecraft.
• Write finished reports and briefings for incident responders, hunters, investigators, executives, and outside partners.
• Identify new CTI collection opportunities and act on them quickly.

What it asks for

• Eight or more years in threat intel, intelligence analysis, incident investigations, or similar analytic work.
• Required AI fluency, including building tools and agentic workflows with AI tools and validating their output.
• Track record of raising standards and workflows beyond your own cases.
• Past work with engineers, data scientists, or product teams to make an investigative method repeatable.
• Experience producing finished intelligence such as actor profiles, campaign reporting, and attribution assessments.
• Strong combined direct collection and OSINT skills for resolving identities and aliases across fragmented sources.
• Working fluency in Russian, Chinese, or another language common among cyber actors (preferred).

Worth knowing

• Surge availability expected during time-sensitive disruption windows.
• Primary time zone overlap with US Eastern and Central.

Terms in this role

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on TRM Labsnorth_east before you apply. If we got something wrong, report this listing.