Scam Disruption: Cyber Threat Analyst (DC)

Apply; Washington (District of Columbia); Hybrid; USD 120,000 - 180,000; Full time

Job summary

TRM Labs is seeking a Cyber Threat Intelligence Analyst in the Washington, DC area to lead infrastructure-focused investigations of scam networks. You will pivot from single indicators to the broader network, fuse open-source, on-chain, and technical data, and deliver actionable intelligence to law enforcement and government partners.

You will own the full intelligence cycle with minimal supervision, partnering with the Scams SME team and with data, engineering, and product to sharpen TRM's

Qualifications

• 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles.
• Hands-on infrastructure attribution across certificates, registrars, nameservers, hosting, and ASNs.
• Proven track record staying with an actor or campaign through takedowns and re-registration.
• Hands-on fluency with CTI tooling — passive DNS, WHOIS, certificate or Shodan-style fingerprinting, and phishing monitoring.
• Experience building detection and clustering logic, rules, or automation yourself — not just configuring vendor tooling.
• Attribution tradecraft: using open-source and commercially available data to drive attribution of threat actors.
• Demonstrated ability to produce actionable intelligence or targeting packages for a government, law-enforcement, or equivalent consumer who acted on them.

Responsibilities

• Lead infrastructure-driven investigations, pivoting from domain/IP/certificate to the network behind it.
• Track threat campaigns as they evolve using OSINT and on-chain data to understand infrastructure changes.
• Develop detection rules and automation to surface malicious infrastructure proactively.
• Produce defensible, calibrated assessments with confidence weighing evidence across sources.
• Own the intelligence cycle end-to-end with minimal supervision and collaborate across teams.

Skills

Cyber threat intelligence

Threat infrastructure analysis

Infrastructure attribution

Campaign tracking

CTI tooling

Tools

Passive DNS

WHOIS

Certificate fingerprinting

Shodan-style fingerprinting

Phishing monitoring

Job description

TRM Labs is seeking a Cyber Threat Intelligence Analyst in the Washington, DC area to lead infrastructure-focused investigations of scam networks. You will pivot from single indicators to the broader network, fuse open-source, on-chain, and technical data, and deliver actionable intelligence to law enforcement and government partners.

You will own the full intelligence cycle with minimal supervision, partnering with the Scams SME team and with data, engineering, and product to sharpen TRM's