Note The job is a remote job and is open to candidates in USA. TRM Labs is a company dedicated to building a safer world through AI-powered intelligence solutions. As a Threat Intelligence Analyst focused on Financial Networks, you will analyze and report on threat actors using both traditional financial systems and cryptocurrency to disrupt illicit activities.

Responsibilities

• Develop novel collection strategies and analytic methodologies to surface threat actor activity that isn't visible through conventional tooling or open databases
• Conduct proactive threat hunting across on-chain and off-chain data sources to identify emerging illicit networks before they're widely known
• Map financial networks used for sanctions evasion — including commodity flows, corporate ownership structures, and offshore financial centers — and connect them to on-chain activity
• Track, analyze, and report on threat actors, campaigns, and illicit networks that operate across both traditional financial infrastructure and the crypto ecosystem
• Identify and assess adversary TTPs, infrastructure, and behavior to support detection and attribution efforts
• Leverage OSINT and other intelligence methods to uncover hidden threats and generate actionable insights
• Produce high-quality intelligence that reaches law enforcement and government partners worldwide
• Collaborate with data, engineering, and product teams to enhance TRM's intelligence capabilities
• Be a leading voice on how adversaries exploit the intersection of traditional finance and crypto to move illicit value Skills
• Proven experience in threat intelligence, cyber intelligence, or national security intelligence roles (this is not an entry-level position)
• A track record of generating net-new intelligence — developing original hypotheses, pursuing non-obvious investigative threads, and surfacing findings that others miss
• Working knowledge of blockchain and cryptocurrency — including how transactions work, on-chain tracing concepts, and the role of crypto in financial crime (e.g., ransomware, sanctions evasion, darknet markets)
• Demonstrated ability to analyze corporate ownership structures, beneficial ownership, and cross-border fund flows — including how adversaries use trade finance, commodity flows, and offshore financial centers to move value
• Experience tracking threat actors, nation-state activity, or sanctioned entities — including analysis of TTPs, infrastructure, and financial behavior to support attribution
• Strong analytical and communication skills with the ability to produce clear, actionable intelligence reports with high intelligence tradecraft standards
• Ability to collaborate cross-functionally with technical and non-technical stakeholders
• Comfort operating in ambiguous, low-signal environments where the analytic path forward has to be constructed, not followed — and the ownership mindset to drive it independently
• Hands-on experience with blockchain analysis tools (e.g., Chainalysis Reactor, TRM, Elliptic) or formal cryptocurrency investigation experience
• Relevant certifications (e.g., GIAC, CEH, Chainalysis Reactor Certification) or background in cybersecurity, intelligence, or investigations
• Fluency in Russian, Chinese (Mandarin or Cantonese), or Farsi, with the ability to conduct research and analysis in that language, is strongly preferred and may be required in some cases
• Background in sanctions enforcement, financial intelligence, or corporate investigations is strongly preferred Company Overview
• TRM Labs is a software company that offers blockchain, transaction monitoring, and analytics to help financial institutions and governments. It was founded in 2018, and is headquartered in San Francisco, California, USA, with a workforce of 201-500 employees. Its website is https//trmlabs.com. Company H1B Sponsorship
• TRM Labs has a track record of offering H1B sponsorships, with 2 in 2026, 1 in 2025, 4 in 2024, 3 in 2023, 3 in 2022, 1 in 2021. Please note that this does not guarantee sponsorship for this specific role. Apply To This Job