Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)
TRM Labs · Remote · Washington DC ·
COMPENSATION
$115k – $160k
Listed on the employer's job board (Ashby)
- Hybrid (DC/MD/VA)
- Senior level
- Threat Intelligence
- OSINT & On-chain
- Law Enforcement focus
Join the Scam Disruption team to lead infrastructure-driven investigations against large-scale fraud operations. You will pivot from technical indicators to map criminal networks, fusing open-source and on-chain data to produce actionable intelligence for government partners.
What you'll do
- Pivot from domains, IPs, or certificates to map wider scam infrastructure
- Track campaign evolution through hosting changes and re-registrations
- Fuse technical infrastructure data with on-chain financial trails
- Build clustering logic and automation to detect malicious infrastructure
- Produce defensible assessments and targeting packages for law enforcement
- Manage the intelligence cycle with minimal supervision
What you'll need
- At least five years in cyber threat intelligence or infrastructure analysis
- Experience pivoting across certificates, registrars, nameservers, and ASNs
- Proficiency with CTI tools like passive DNS, WHOIS, and Shodan
- Ability to build custom detection rules and automation logic
- Track record of producing actionable intelligence for government consumers
- Must reside in the Washington D.C., Maryland, or Virginia area
Stack
- Notion
- Slack
- Passive DNS
- WHOIS
- Shodan
How you'll work
- Hybrid role requiring presence in DC, MD, or VA
- Asynchronous-first culture with structured syncs
- Primary time zone overlap is US Eastern or Central
- Surge availability expected during disruption windows
Hiring process
- Recruiter introductory call
- Hiring Manager deep dive interview
- First round focused on critical skills
- Final round with hands-on case study panel
- Reference checks
- Offer presentation