TRM Labs
Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)
$115K–$160K
Washington D.C. · Remote · Full-time · Posted Oct 1, 2026
- Experience
- 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles.
About the job
Investigates scam operations by mapping and tracking their technical infrastructure, connecting findings to on-chain financial activity, and delivering actionable intelligence to government and law-enforcement partners.
What you'll do
- Map and monitor scam infrastructure and campaigns, including changes after takedowns.
- Connect technical and open-source findings with wallets, laundering paths, and cash-outs; develop attribution assessments.
- Build detection and clustering logic, rules, or automation, and produce actionable intelligence packages.
What they ask for
- Hands-on infrastructure attribution and campaign tracking, including through takedowns and re-registration.
- Fluency with CTI tooling such as passive DNS, WHOIS, certificate or Shodan-style fingerprinting, and phishing monitoring.
- Experience building detection or clustering logic, rules, or automation.
- Demonstrated delivery of actionable intelligence to government, law-enforcement, or equivalent consumers, plus defensible analytic judgment; must be located in the Washington, D.C./MD/VA area.
Pay
$115K – $160K (base salary)
Tools
passive DNS, WHOIS, Shodan, Slack, Notion
AI focus
TRM expects applied AI fluency to accelerate repeatable workflows, structure and solve problems, improve output quality, and increase speed and leverage; AI fluency is evaluated during interviews.
Model-written summary · the original posting is authoritative