[Remote] Threat Intelligence Analyst, Finanical Networks

Note: The job is a remote job and is open to candidates in USA. TRM Labs is a company dedicated to building a safer world through AI-powered intelligence solutions. As a Threat Intelligence Analyst focused on Financial Networks, you will analyze and report on threat actors using both traditional financial systems and cryptocurrency to disrupt illicit activities.ResponsibilitiesDevelop novel collection strategies and analytic methodologies to surface threat actor activity that isn't visible through conventional tooling or open databasesConduct proactive threat hunting across on-chain and off-chain data sources to identify emerging illicit networks before they're widely knownMap financial networks used for sanctions evasion — including commodity flows, corporate ownership structures, and offshore financial centers — and connect them to on-chain activityTrack, analyze, and report on threat actors, campaigns, and illicit networks that operate across both traditional financial infrastructure and the crypto ecosystemIdentify and assess adversary TTPs, infrastructure, and behavior to support detection and attribution effortsLeverage OSINT and other intelligence methods to uncover hidden threats and generate actionable insightsProduce high-quality intelligence that reaches law enforcement and government partners worldwideCollaborate with data, engineering, and product teams to enhance TRM's intelligence capabilitiesBe a leading voice on how adversaries exploit the intersection of traditional finance and crypto to move illicit valueSkillsProven experience in threat intelligence, cyber intelligence, or national security intelligence roles (this is not an entry-level position)A track record of generating net-new intelligence — developing original hypotheses, pursuing non-obvious investigative threads, and surfacing findings that others missWorking knowledge of blockchain and cryptocurrency — including how transactions work, on-chain tracing concepts, and the role of crypto in financial crime (e.g., ransomware, sanctions evasion, darknet markets)Demonstrated ability to analyze corporate ownership structures, beneficial ownership, and cross-border fund flows — including how adversaries use trade finance, commodity flows, and offshore financial centers to move valueExperience tracking threat actors, nation-state activity, or sanctioned entities — including analysis of TTPs, infrastructure, and financial behavior to support attributionStrong analytical and communication skills with the ability to produce clear, actionable intelligence reports with high intelligence tradecraft standardsAbility to collaborate cross-functionally with technical and non-technical stakeholdersComfort operating in ambiguous, low-signal environments where the analytic path forward has to be constructed, not followed — and the ownership mindset to drive it independentlyHands-on experience with blockchain analysis tools (e.g., Chainalysis Reactor, TRM, Elliptic) or formal cryptocurrency investigation experienceRelevant certifications (e.g., GIAC, CEH, Chainalysis Reactor Certification) or background in cybersecurity, intelligence, or investigationsFluency in Russian, Chinese (Mandarin or Cantonese), or Farsi, with the ability to conduct research and analysis in that language, is strongly preferred and may be required in some casesBackground in sanctions enforcement, financial intelligence, or corporate investigations is strongly preferredCompany OverviewTRM Labs is a software company that offers blockchain, transaction monitoring, and analytics to help financial institutions and governments. It was founded in 2018, and is headquartered in San Francisco, California, USA, with a workforce of 201-500 employees. Its website is https://trmlabs.com.Company H1B SponsorshipTRM Labs has a track record of offering H1B sponsorships, with 2 in 2026, 1 in 2025, 4 in 2024, 3 in 2023, 3 in 2022, 1 in 2021. Please note that this does not guarantee sponsorship for this specific role.