The Senior Blockchain Intelligence Analyst, Ransomware role at TRM Labs is an exciting full-time remote opportunity based in the United States within the R&D department. This position suits an autonomous, high-judgment investigator who wants to specialize in disrupting ransomware actors and tracing crypto transactions.
Role Overview
TRM Labs is seeking an experienced individual contributor to operate as a Senior Blockchain Intelligence Analyst focusing on ransomware. In this role, you will leverage blockchain analytics, cyber threat intelligence, and cryptocurrency attribution to trace ransomware proceeds, identify threat actor infrastructure, and generate actionable intelligence. This is not a people-management position. Instead, it relies on your technical expertise to independently lead complex investigations, develop high-confidence assessments, uncover novel attribution, and elevate the broader team's tradecraft through mentorship and example.
Key Responsibilities
Produce finished intelligence on ransomware actors, affiliates, facilitators, and laundering pathways, including actor profiles, lead packages, and attribution assessments.
Lead complex end-to-end blockchain investigations from initial seed indicators to full attribution and actionable recovery or disruption opportunities.
Trace ransomware-related funds across multiple blockchains, bridges, mixers, peel chains, and nested services to identify controllers and counterparties.
Correlate on-chain activity with OSINT, threat intelligence, attribution partner data, and off-chain identity signals.
Own investigative workstreams from discovery through validation, escalation, and written production.
Support TRM’s ransomware asset recovery mission by surfacing high-quality leads and identifying seizure or freeze opportunities.
Drive analytical leadership by prioritizing work, maintaining rigorous standards, and mentoring peers without formal management duties.
Partner closely with internal and external stakeholders to ensure analytical outputs reflect real investigative tradecraft.
Strengthen TRM’s ransomware coverage by contributing new attribution and refining investigative methodologies.
Support external briefings, customer engagements, and capability-building sessions explaining ransomware tracing and recovery tradecraft.
Requirements
5 to 8+ years of professional experience in blockchain intelligence, crypto investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a comparable senior analytical role.
Deep hands-on experience tracing funds across multiple blockchains and through laundering or obfuscation techniques like mixers, chain-hopping, bridges, peel chains, and layered cash-out behavior.
Demonstrated ability to independently run complex investigations and synthesize findings into clear written intelligence products.
Deep understanding of the cybercrime ecosystem and the relationships among ransomware operators, affiliates, initial access brokers, malware developers, and cash-out services.
Excellent written and verbal communication skills, with the ability to turn technically complex tracing findings into actionable intelligence.
Strong judgment, curiosity, and ability to operate in a fast-moving, high-stakes environment.
Experience leveraging AI tools and large language models to accelerate research, surface insights, and augment analytical workflows.
Nice to Have
Experience in government, national security, law enforcement, incident response, or mature private-sector investigative or threat intelligence programs.
Familiarity with OSINT, cybercrime infrastructure research, and cross-domain analytical methods.
Comfort with modern investigative tooling, including TRM, Maltego, Palantir, or similar structured data environments.
Experience conducting HUMINT collection and engaging threat actors via dark web forums and encrypted messaging platforms.
Experience mentoring peers, shaping analytical standards, or improving investigative workflows.
Advanced practitioner-level knowledge of crypto forensics concepts like manual demixing, smart contracts, bridges, and Ethereum- and TRON-based investigations.
Recognized subject matter depth and a track record of shaping methodology or high-priority investigative strategy.
Skills and Tools
Blockchain analytics and cryptocurrency attribution
Multi-chain fund tracing across mixers, bridges, and peel chains
OSINT and threat intelligence correlation
AI tools and large language models (LLMs) for research augmentation
Investigative platforms such as TRM, Maltego, or Palantir
Written and verbal intelligence production for executive and technical audiences
Salary and Benefits
Annual Salary: $150,000 - $168,000 USD
About the Company
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure. The company values high velocity, high ownership, clarity, follow-through, and continuous feedback in an intense mission-driven environment.
How to Apply
To apply for this position, please visit the official TRM Labs careers page and submit your application directly. Ensure your resume and application questions highlight your relevant experience and qualifications for this role.
