DC-area Cyber Threat Intel Analyst, Scam Disruption

TRM Labs; Washington (District of Columbia); Hybrid; USD 120,000 - 190,000; Full time

Job summary

TRM Labs in the Washington, D.C. area is seeking a seasoned Cyber Threat Intelligence Analyst to lead infrastructure-driven investigations, pivoting from domain or IP indicators to map networks behind scams and deliver actionable intelligence for law enforcement partners.

You will fuse on-chain and off-chain data, build detection rules, and own the intelligence cycle end to end with autonomy and collaboration across engineering and product teams.

Qualifications

• 5+ years of cyber threat intelligence or threat infrastructure analysis experience.
• Hands-on infrastructure attribution across domains, registrars, nameservers, hosting, and ASNs.
• Track actor campaigns through takedowns and re-registration.
• Fluency with CTI tooling (passive DNS, WHOIS, certificate fingerprinting, phishing monitoring).
• Experience building detection and clustering logic, rules, or automation.

Responsibilities

• Own the intelligence cycle end to end with minimal supervision.
• Pivot from indicators to map wider infrastructure behind scams.
• Fuse on-chain and off-chain data to produce actionable intelligence.
• Develop clustering logic, detection rules, and automation to surface malicious infrastructure proactively.
• Collaborate with Scams SME team, data, engineering, and product.

Skills

Cyber threat intelligence

Threat infrastructure analysis

Infrastructure attribution

CTI tooling

Campaign tracking

Open-source data usage

Detection and clustering

Tools

Passive DNS

WHOIS

Certificate fingerprinting

Shodan

Phishing monitoring

Job description

TRM Labs in the Washington, D.C. area is seeking a seasoned Cyber Threat Intelligence Analyst to lead infrastructure-driven investigations, pivoting from domain or IP indicators to map networks behind scams and deliver actionable intelligence for law enforcement partners.

You will fuse on-chain and off-chain data, build detection rules, and own the intelligence cycle end to end with autonomy and collaboration across engineering and product teams.