[Remote] Threat Intelligence Analyst, Finanical Networks
Note: The job is a remote job and is open to candidates in USA. TRM Labs is a company dedicated to building a safer world through AI-powered intelligence solutions. As a Threat Intelligence Analyst focused on Financial Networks, you will analyze and report on threat actors using both traditional financial systems and cryptocurrency to disrupt illicit activities.
Responsibilities
ā¢ Develop novel collection strategies and analytic methodologies to surface threat actor activity that isn't visible through conventional tooling or open databases
ā¢ Conduct proactive threat hunting across on-chain and off-chain data sources to identify emerging illicit networks before they're widely known
ā¢ Map financial networks used for sanctions evasion ā including commodity flows, corporate ownership structures, and offshore financial centers ā and connect them to on-chain activity
ā¢ Track, analyze, and report on threat actors, campaigns, and illicit networks that operate across both traditional financial infrastructure and the crypto ecosystem
ā¢ Identify and assess adversary TTPs, infrastructure, and behavior to support detection and attribution efforts
ā¢ Leverage OSINT and other intelligence methods to uncover hidden threats and generate actionable insights
ā¢ Produce high-quality intelligence that reaches law enforcement and government partners worldwide
ā¢ Collaborate with data, engineering, and product teams to enhance TRM's intelligence capabilities
ā¢ Be a leading voice on how adversaries exploit the intersection of traditional finance and crypto to move illicit value
Skills
ā¢ Proven experience in threat intelligence, cyber intelligence, or national security intelligence roles (this is not an entry-level position)
ā¢ A track record of generating net-new intelligence ā developing original hypotheses, pursuing non-obvious investigative threads, and surfacing findings that others miss
ā¢ Working knowledge of blockchain and cryptocurrency ā including how transactions work, on-chain tracing concepts, and the role of crypto in financial crime (e.g., ransomware, sanctions evasion, darknet markets)
ā¢ Demonstrated ability to analyze corporate ownership structures, beneficial ownership, and cross-border fund flows ā including how adversaries use trade finance, commodity flows, and offshore financial centers to move value
ā¢ Experience tracking threat actors, nation-state activity, or sanctioned entities ā including analysis of TTPs, infrastructure, and financial behavior to support attribution
ā¢ Strong analytical and communication skills with the ability to produce clear, actionable intelligence reports with high intelligence tradecraft standards
ā¢ Ability to collaborate cross-functionally with technical and non-technical stakeholders
ā¢ Comfort operating in ambiguous, low-signal environments where the analytic path forward has to be constructed, not followed ā and the ownership mindset to drive it independently
ā¢ Hands-on experience with blockchain analysis tools (e.g., Chainalysis Reactor, TRM, Elliptic) or formal cryptocurrency investigation experience
ā¢ Relevant certifications (e.g., GIAC, CEH, Chainalysis Reactor Certification) or background in cybersecurity, intelligence, or investigations
ā¢ Fluency in Russian, Chinese (Mandarin or Cantonese), or Farsi, with the ability to conduct research and analysis in that language, is strongly preferred and may be required in some cases
ā¢ Background in sanctions enforcement, financial intelligence, or corporate investigations is strongly preferred
Company Overview
ā¢ TRM Labs is a software company that offers blockchain, transaction monitoring, and analytics to help financial institutions and governments. It was founded in 2018, and is headquartered in San Francisco, California, USA, with a workforce of 201-500 employees. Its website is https://trmlabs.com.
Company H1B Sponsorship
ā¢ TRM Labs has a track record of offering H1B sponsorships, with 2 in 2026, 1 in 2025, 4 in 2024, 3 in 2023, 3 in 2022, 1 in 2021. Please note that this does not guarantee sponsorship for this specific role.
Apply To This Job
Responsibilities
ā¢ Develop novel collection strategies and analytic methodologies to surface threat actor activity that isn't visible through conventional tooling or open databases
ā¢ Conduct proactive threat hunting across on-chain and off-chain data sources to identify emerging illicit networks before they're widely known
ā¢ Map financial networks used for sanctions evasion ā including commodity flows, corporate ownership structures, and offshore financial centers ā and connect them to on-chain activity
ā¢ Track, analyze, and report on threat actors, campaigns, and illicit networks that operate across both traditional financial infrastructure and the crypto ecosystem
ā¢ Identify and assess adversary TTPs, infrastructure, and behavior to support detection and attribution efforts
ā¢ Leverage OSINT and other intelligence methods to uncover hidden threats and generate actionable insights
ā¢ Produce high-quality intelligence that reaches law enforcement and government partners worldwide
ā¢ Collaborate with data, engineering, and product teams to enhance TRM's intelligence capabilities
ā¢ Be a leading voice on how adversaries exploit the intersection of traditional finance and crypto to move illicit value
Skills
ā¢ Proven experience in threat intelligence, cyber intelligence, or national security intelligence roles (this is not an entry-level position)
ā¢ A track record of generating net-new intelligence ā developing original hypotheses, pursuing non-obvious investigative threads, and surfacing findings that others miss
ā¢ Working knowledge of blockchain and cryptocurrency ā including how transactions work, on-chain tracing concepts, and the role of crypto in financial crime (e.g., ransomware, sanctions evasion, darknet markets)
ā¢ Demonstrated ability to analyze corporate ownership structures, beneficial ownership, and cross-border fund flows ā including how adversaries use trade finance, commodity flows, and offshore financial centers to move value
ā¢ Experience tracking threat actors, nation-state activity, or sanctioned entities ā including analysis of TTPs, infrastructure, and financial behavior to support attribution
ā¢ Strong analytical and communication skills with the ability to produce clear, actionable intelligence reports with high intelligence tradecraft standards
ā¢ Ability to collaborate cross-functionally with technical and non-technical stakeholders
ā¢ Comfort operating in ambiguous, low-signal environments where the analytic path forward has to be constructed, not followed ā and the ownership mindset to drive it independently
ā¢ Hands-on experience with blockchain analysis tools (e.g., Chainalysis Reactor, TRM, Elliptic) or formal cryptocurrency investigation experience
ā¢ Relevant certifications (e.g., GIAC, CEH, Chainalysis Reactor Certification) or background in cybersecurity, intelligence, or investigations
ā¢ Fluency in Russian, Chinese (Mandarin or Cantonese), or Farsi, with the ability to conduct research and analysis in that language, is strongly preferred and may be required in some cases
ā¢ Background in sanctions enforcement, financial intelligence, or corporate investigations is strongly preferred
Company Overview
ā¢ TRM Labs is a software company that offers blockchain, transaction monitoring, and analytics to help financial institutions and governments. It was founded in 2018, and is headquartered in San Francisco, California, USA, with a workforce of 201-500 employees. Its website is https://trmlabs.com.
Company H1B Sponsorship
ā¢ TRM Labs has a track record of offering H1B sponsorships, with 2 in 2026, 1 in 2025, 4 in 2024, 3 in 2023, 3 in 2022, 1 in 2021. Please note that this does not guarantee sponsorship for this specific role.
Apply To This Job