Senior Blockchain Intelligence Analyst, Ransomware
TRM Labs · Remote · United States · United Kingdom ·
COMPENSATION
$140k – $160k
Listed on the employer's job board (Ashby)
- Senior level role
- Fully remote
- Ransomware focus
- Blockchain forensics
- US time zone overlap
Join TRM Labs as an individual contributor focused on disrupting ransomware networks. You will leverage blockchain analytics and threat intelligence to trace proceeds, identify infrastructure, and support asset recovery efforts.
The position requires high autonomy in leading complex investigations without people management duties. You will synthesize technical and financial data into defensible intelligence that aids investigators and law enforcement agencies globally.
What you'll do
- Produce finished intelligence on ransomware actors and laundering pathways
- Lead end-to-end blockchain investigations from initial indicators to attribution
- Trace funds across multiple chains, mixers, bridges, and peel chains
- Correlate on-chain activity with OSINT and off-chain identity signals
- Support asset recovery by identifying seizure or freeze opportunities
- Mentor peers and refine investigative methodologies without managing staff
- Partner with internal teams and external agencies to support operations
What you'll need
- 5-8+ years in blockchain intelligence or cybercrime analysis
- Deep expertise in tracing funds through obfuscation techniques
- Strong ability to synthesize findings into clear written reports
- Knowledge of ransomware ecosystem operators and affiliates
- Excellent communication skills for technical and non-technical audiences
- Experience using AI tools to accelerate research and workflows
- Ability to operate effectively in fast-paced, high-stakes environments
Nice to have
- Background in government, law enforcement, or incident response
- Familiarity with tools like Maltego, Palantir, or TRM platforms
- Experience engaging threat actors via dark web forums
- Advanced knowledge of Ethereum and TRON-based investigations
- Track record of shaping analytical standards or strategy
Stack
- TRM
- Maltego
- Palantir
- Notion
- Slack
How you'll work
- Distributed-first company with global hubs
- Primary time zone overlap: US Eastern or Central
- Weekly team syncs and daily async standups
- Surge availability expected during disruption windows
- All output documented in Notion and investigative tools
Hiring process
- Recruiter intro call
- Hiring manager deep dive
- First round skills interviews
- Final round hands-on case study
- Reference checks
- Offer presentation