Cyber Threat Intelligence Analyst

The Scam Disruption team at TRM Labs is the frontline defense against pig butchering syndicates, romance fraud networks, and investment scam operations that steal billions annually. As a Cyber Threat Intelligence Analyst, you’ll lead infrastructure-driven investigations, pivoting from a single domain, IP, or certificate to uncover the full network behind scams, track their evolution, and deliver actionable intelligence to law enforcement and government partners.

Key Responsibilities:

• Start with a single indicator—such as a scam domain, IP, or certificate—and map the broader infrastructure by analyzing shared certificates, registrars, nameservers, hosting, and ASNs, clustering indicators into campaigns.
• Monitor campaigns as they evolve, tracking new domains, hosting/registrar changes, and certificate reuse, while anticipating re-registration after takedowns.
• Drive threat actor attribution using open-source and commercially available data.
• Fuse technical infrastructure data with on-chain analysis, tracing investigations from infrastructure to wallets, laundering paths, and cash-outs.
• Develop clustering logic, detection rules, and automation/tooling to proactively surface malicious infrastructure instead of relying on off-the-shelf feeds.
• Produce defensible, calibrated assessments with confidence-weighted evidence and clear malicious-versus-benign calls.
• Synthesize on-chain and off-chain intelligence (OSINT, technical, financial) into actionable targeting packages for law enforcement.
• Own the intelligence cycle end-to-end with minimal supervision, collaborating with SMEs, data/engineering, and product teams to enhance TRM’s capabilities.

Requirements:

• 5+ years of experience in cyber threat intelligence or threat infrastructure analysis (not entry-level).
• Hands-on expertise in infrastructure pivoting and campaign tracking across shared certificates, registrars, nameservers, hosting, and ASNs.
• Proven ability to track actors/campaigns over time, including post-takedown re-registration.
• Fluency with CTI tooling: passive DNS, WHOIS, certificate fingerprinting, Shodan, and phishing monitoring.
• Experience building detection rules, clustering logic, or automation (not just configuring vendor tooling).
• Attribution skills using open-source/commercial data to link threat actors to campaigns.
• Track record of delivering actionable intelligence or targeting packages used by law enforcement.
• Must be located in the Washington, D.C./MD/VA area (periodic in-person collaboration and travel required).