Cyber Threat Intelligence Analyst: Campaign-focused Investigator

Apply; Washington, Northern (District of Columbia, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

TRM Labs is seeking a Cyber Threat Intelligence Analyst to join the Scam Disruption team in the Washington, DC area. You will lead infrastructure-driven investigations, pivoting from single indicators to network-level understanding and delivering actionable intelligence to law enforcement and government partners.

You will fuse technical, open-source, and on-chain data to build operational pictures and drive proactive detection and clustering logic, with minimal supervision and cross-functional

Qualifications

• 5+ years of cyber threat intelligence or threat infrastructure analysis experience.
• Experience with infrastructure attribution across domains, registrars, and hosting.
• Track campaigns over time, including takedowns and re-registration.
• Hands-on experience with CTI tooling (passive DNS, WHOIS, fingerprinting, phishing monitoring).
• Experience building detection/rules or automation to surface malicious infrastructure.

Responsibilities

• Pivot from indicators to map wider infrastructure and campaigns.
• Track evolving campaigns and actor loyalties across takedowns and re-registration.
• Produce actionable intelligence or targeting packages for government or law enforcement.
• Fuse infrastructure data with on-chain data to follow investigations end-to-end.
• Develop clustering logic, rules, or tooling to surface malicious infrastructure proactively.

Skills

Cyber threat intel

Infrastructure attribution

Campaign tracking

CTI tooling

Tools

Passive DNS

WHOIS

Shodan-style fingerprinting

Job description

TRM Labs is seeking a Cyber Threat Intelligence Analyst to join the Scam Disruption team in the Washington, DC area. You will lead infrastructure-driven investigations, pivoting from single indicators to network-level understanding and delivering actionable intelligence to law enforcement and government partners.

You will fuse technical, open-source, and on-chain data to build operational pictures and drive proactive detection and clustering logic, with minimal supervision and cross-functional