Severe Harms All-Source Investigator

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure.

Sextortion — extorting money or further imagery from victims, disproportionately minors, under threat of releasing explicit images — has been named a national emergency by the FBI and NCMEC, and financial sextortion cases have been directly linked to a rise in teen suicides. In parallel, CSAM distribution networks increasingly monetize through cryptocurrency, using crypto's speed and pseudonymity to move money across borders faster than any single agency can follow.

TRM's Severe Harms pod exists to close that gap. We fuse on-chain and off-chain intelligence to trace the financial rails behind this abuse, working alongside Law Enforcement and Government Partners, and TRM's financial-institution and exchange partners to identify offenders, disrupt activity, and support victim identification and safeguarding. It is some of the most consequential and difficult work at TRM.

As a Severe Harms All-Source Investigator, you will be one of the investigators running that flywheel every day — tracing the financial rails behind sextortion and CSAM monetization, building the target packages and legal-process returns that lead to disruption, and working cases from referral through to an actionable outcome.

This is an individual-contributor role for someone who wants to do the work directly, not manage it. You will build genuine casework skill on some of the most consequential and difficult material at TRM, with a manager and a Lead Investigator supporting your growth.

The Impact You Will Have

• Work your caseload. Run point on target packages from referral to disruption: legal process → on-chain/off-chain fusion → targeting, on your own cases under normal review.
• Run all-source collection. Combine OSINT, link analysis, and direct engagement with subjects and sources to identify and attribute actors — not just trace the money.
• Build defensible, actionable outputs. Every attribution write-up and legal-process return you produce should hold up when tested by Law Enforcement and Government Partners, or a court — with growing independence over time.
• Map networks, not just events. Build a picture of how a network actually operates, rather than a catalogue of isolated indicators.
• Use AI to accelerate your own casework. Apply it where it genuinely speeds up or sharpens your work, and know where human judgment has to stay in the loop given the sensitivity of the material.
• Partner across the ecosystem. Work directly with legal, engineering, and external partners on the specific leads and referrals in front of you.
• Practice victim-centered, trauma-informed investigative work, and follow TRM's protocols for evidence handling, escalation, and mandatory reporting.
• Take care of yourself and your teammates. Actively manage your own content exposure and psychological well-being, and know when and how to ask for support.

What We're Looking For

• You are an operator. 3–5 years of relevant investigative or casework experience — illicit-finance, financial-crime, cybercrime, trust & safety, all-source intelligence, OSINT, or direct human-source engagement, or a comparable law-enforcement/intelligence-adjacent background. You have taken a body of information and driven it to a real outcome, not just written a report about it.
• Real collection capability, whether that's hands-on experience building or adapting tools to pull signal from open web, social, and forum sources, or direct experience engaging subjects and sources yourself. Ideally you've done some of both, but real strength in one is enough.
• You know how to work a case with other people, not just alone. You can point to investigations you've co-run with another investigator, or handed off cleanly without losing momentum.
• You're comfortable working to someone else's clock. You've delivered real answers under RFI-style pressure — a partner or requester needing something in hours or days, not on a self-paced research timeline — and can point to examples.
• Genuine interest in, and some exposure to, child exploitation, sextortion, or closely adjacent investigative work, including CT or Serious Organised Crime. We will teach you the ecosystem specifics; we are looking for the instinct and resilience for this material, plus at least some track record adjacent to it.
• AI fluency (required). You use AI in your own work today and have a clear, honest view of where it helps and where it does not — especially given the sensitivity of this material.
• Working knowledge of legal process — subpoenas, warrants, preservation requests — or a fast willingness to learn it. You do not need to be a lawyer; you need to understand how high-quality investigative documentation supports downstream action.
• Solid written communication. You can produce a clear, defensible written package under review.
• Sound judgment with difficult material. The maturity to work with emotionally demanding content without it compromising your judgment or your well-being.
• Fully remote, US- or UK-based. Expect occasional travel, unevenly distributed, with periodic DC-based working sessions.

Nice-to-Have

• Crypto or on-chain experience. A genuine advantage, but we teach on-chain tradecraft — we cannot teach the instinct built from years investigating crimes against children.
• Sextortion/CSAM-ecosystem familiarity. Direct experience with financial sextortion schemes, CSAM distribution networks, or platform-based grooming and extortion patterns will shorten your ramp considerably, but the team knows this ecosystem well and can bring you up to speed on it.

Vetting

Given the sensitivity of the material and data handled, successful completion of an enhanced background check is required as a condition of employment.

About the Team

• The Severe Harms pod operates within TRM's Primary Intelligence organization, alongside the other threat categories comprised of threat intelligence analysts, on-chain investigators and data scientists.
• Distributed team with an async-first approach via Slack and Notion, plus structured syncs for alignment.
• High autonomy, high standards, low bureaucracy — you work directly with engineers, analysts, legal counterparts, and the partners and customers who depend on the team's output.

Team Operating Rhythms

• Weekly 1:1 with your manager
• Weekly team sync covering active work, throughput, and escalations
• 6-week performance pulse check-in
• Quarterly career-pathing conversation
• Mandatory wellness check-ins and access to specialized counseling/EAP resources, on a standing cadence
• Primary time-zone overlap: US Eastern / Central
• Surge availability expected during time-sensitive referral and disruption windows