Senior / Staff Cyber Threat Response Advisor
TRM Labs · Remote · United States ·
COMPENSATION
$168k – $228k
Listed on the employer's job board (Ashby)
- Senior / Staff level
- US-based only
- Up to 50% travel
- AI-driven analysis
- Critical infrastructure focus
Join the Cybercrime team at TRM Labs to analyze threats against critical infrastructure sectors like energy, healthcare, and finance. You will fuse OSINT, exposure discovery, and threat actor collection to produce actionable intelligence for defenders and government partners.
This senior individual contributor role demands high autonomy and the ability to drive remediation from initial signal to final notification. You will leverage AI tools to scale your analytical impact while maintaining strict quality control over outputs.
What you'll do
- Analyze critical infrastructure sectors to identify high-value targets and vulnerabilities
- Combine OSINT, attack surface discovery, and threat actor collection to validate exposures
- Build and refine AI-assisted workflows to accelerate research and synthesis
- Map command and control infrastructure, malware families, and threat actor TTPs
- Triage large indicator sets into clear, defensible findings for immediate action
- Produce finished intelligence including actor profiles, campaign reports, and IOC packages
- Partner directly with infrastructure entities, government agencies, and ISACs
- Mentor other analysts and share tradecraft to improve team quality
What you'll need
- 5-8+ years in cyber threat intelligence, incident response, or related analytical fields
- Experience acting as primary contact for external organizations during live incidents
- Proven ability to drive complex analysis from fragmented data to actionable outcomes
- Applied AI fluency with experience building agentic workflows and validating outputs
- Strong collection skills in OSINT, social sources, or external attack surface discovery
- Excellent judgment regarding analytical confidence and evidentiary strength
- Strong written and verbal communication skills for technical and non-technical audiences
- Must be based in the United States with US citizenship
- Willingness to travel up to 50% within the United States
Nice to have
- Familiarity with critical infrastructure sectors such as ICS/OT, healthcare, or energy
- Experience delivering intelligence to government partners or ISACs
- Working proficiency in languages used by cyber threat actors
- Public presence through conference talks, published research, or sharing circles
Stack
- OSINT tools
- AI agents
- Notion
- Slack
How you'll work
- Distributed team with async-first approach
- Primary time zone overlap: US Eastern or Central
- No formal on-call rotation
- Flexible hours during active disruption windows
- Up to 50% travel within the United States required
What you get
- High autonomy and low bureaucracy environment
- Opportunity to work on national security and crime disruption
- Collaboration with expert analysts and engineers
- Series C company backed by major investors
Hiring process
- Recruiter intro call
- Hiring manager deep dive
- First round skill-focused interviews
- Final round hands-on case study panel
- Reference checks
- Offer presentation