Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. The Cyber Threat Intelligence Analyst will lead infrastructure-driven investigations into scam operations, track evolving campaigns, connect technical infrastructure to on-chain financial activity, and deliver actionable intelligence to law enforcement and government partners.

Responsibilities:

• Start from one indicator — a scam domain, IP, or certificate — and pivot across shared certificates, registrars, nameservers, hosting, and ASNs to map the wider infrastructure behind Southeast Asia scam operations, clustering one-off indicators into campaigns
• Track campaigns as they evolve — new domains, hosting and registrar changes, certificate reuse — and stay on actors as they rebuild and re-register after takedowns and seizures, anticipating their next infrastructure
• Drive attribution of threat actors by leveraging open-source and commercially available data
• Fuse technical infrastructure with the on-chain picture — carrying an investigation from infrastructure through to the wallet, the laundering path, and the cash-out
• Build clustering logic, detection rules, and automation or tooling to surface malicious infrastructure proactively, rather than waiting on off-the-shelf feeds
• Produce defensible, calibrated assessments — assigning confidence, weighing evidence across sources, and standing behind a malicious-versus-benign call
• Synthesize on-chain and off-chain intelligence (OSINT, technical, and financial) into targeting packages that a government or law-enforcement consumer can act on
• Own the intelligence cycle end to end with minimal supervision, partnering with the Scams SME team and with data, engineering, and product to sharpen TRM's collection capabilities

Requirements:

• 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles
• Hands-on infrastructure attribution: infrastructure pivoting and campaign tracking across shared certificates, registrars, nameservers, hosting, and ASNs — and a habit of thinking in campaigns, not isolated indicators
• A track record of staying on an actor or campaign over time, including through takedowns and re-registration
• Hands-on fluency with CTI tooling — passive DNS, WHOIS, certificate or Shodan-style fingerprinting, and phishing monitoring
• Experience building detection and clustering logic, rules, or automation yourself — not just configuring vendor tooling
• Attribution tradecraft: using open-source and commercially available data to drive attribution of threat actors
• Demonstrated ability to produce actionable intelligence or targeting packages for a government, law-enforcement, or equivalent consumer who acted on them, and calibrated, defensible analytic judgment
• Must be located in the Washington, D.C./MD/VA area