Staff Cyber Threat Intelligence Analyst
TRM Labs · Remote · United States ·
COMPENSATION
$180k – $215k
Listed on the employer's job board (Ashby)
- Staff level role
- Fully remote (async)
- AI fluency required
- 8+ years experience
- US time zone overlap
As a Staff Cyber Threat Intelligence Analyst, you will drive high-complexity investigations on TRM's AI-powered platform. You will codify methods and workflows for the team, fusing technical indicators with OSINT and identity work to disrupt threat networks.
This position requires partnering with engineering and data science to scale investigative tradecraft. You will raise the bar on rigor and confidence judgments, coaching other analysts while delivering high-confidence intelligence products to internal and external partners.
What you'll do
- Run end-to-end investigations from single indicators to attributed actor campaigns
- Identify new collection opportunities to stay ahead of emerging cyber threats
- Map threat actor networks including infrastructure, malware, and operators
- Fuse technical data with OSINT and financial trail analysis
- Set analytical standards and coach team members on tradecraft
- Partner with engineering to build scalable investigative tools and workflows
- Provide timely intelligence briefings during high-ambiguity incidents
What you'll need
- 8+ years in cyber threat intelligence or related analytical fields
- Proficiency in building AI tools and agentic workflows for automation
- Experience partnering with engineering to scale investigative methods
- Strong ability to combine direct collection and OSINT for unique intel
- Track record of producing finished intelligence like actor profiles
- Excellent written and verbal communication for diverse audiences
- Comfort working in fast-paced environments with high ambiguity
Nice to have
- Working proficiency in Russian, Chinese, or similar operational languages
- Public presence via conference talks or published research
- Hands-on experience with crypto or blockchain tracing
- Ability to connect technical findings to financial infrastructure
Stack
- Claude
- Slack
- Notion
How you'll work
- Distributed and async-first work model
- Primary time zone overlap: US Eastern or Central
- Weekly team syncs for alignment and priority review
- Daily async standups via Slack for active work updates
- Surge availability expected during time-sensitive windows
What you get
- High autonomy and low bureaucracy environment
- Direct collaboration with analysts, engineers, and partners
- Opportunity to impact global security and crime disruption
Hiring process
- Recruiter intro call for qualifications and motivation
- Hiring manager interview on experience and impact
- First round interviews focused on critical role skills
- Final round hands-on case study with panel session
- Reference checks with former colleagues
- Offer presentation and onboarding