Senior CTI Analyst: Campaigns & Infrastructure

TRM Labs; Washington; On-site; USD 140,000 - 180,000; Full time

Job summary

TRM Labs is seeking a Cyber Threat Intelligence Analyst to lead infrastructure-driven investigations in the Scam Disruption team. You will pivot from single indicators to multi-layer infrastructure, tracking campaigns and attributing threat actors with open-source and commercial data.

You will fuse on-chain and off-chain intelligence to build actionable targeting packages for law enforcement and government partners, owning the intelligence cycle end to end with minimal supervision.

Qualifications

• 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles.
• Hands-on infrastructure attribution across shared certificates, registrars, nameservers, hosting, and ASNs.
• Experience tracking campaigns and maintaining focus on actor or campaign continuity.
• Proficiency with CTI tooling such as passive DNS, WHOIS, fingerprinting, and phishing monitoring.
• Experience building detection, clustering logic, rules, or automation.
• Ability to produce actionable intelligence and targeted packages for government or law-enforcement.
• Must be located in the Washington, D.C./MD/VA area.

Responsibilities

• Own the intelligence cycle end to end with minimal supervision.
• Pivot from indicators (domains, IPs, certificates) to the wider infrastructure network behind them.
• Drive attribution of threat actors using open-source and commercial data.
• Fuse infrastructure with on-chain data to map investigations from infrastructure to wallet and cash-out.
• Develop clustering logic, detection rules, and automation to surface malicious infrastructure proactively.
• Provide defensible, calibrated assessments with confidence and evidence-weighting.

Skills

Cyber threat intel

Infrastructure attribution

Campaign tracking

CTI tooling

Detection & clustering

Attribution tradecraft

Actionable intelligence

Tools

Passive DNS

WHOIS

Shodan fingerprinting

Phishing monitoring

Job description

TRM Labs is seeking a Cyber Threat Intelligence Analyst to lead infrastructure-driven investigations in the Scam Disruption team. You will pivot from single indicators to multi-layer infrastructure, tracking campaigns and attributing threat actors with open-source and commercial data.

You will fuse on-chain and off-chain intelligence to build actionable targeting packages for law enforcement and government partners, owning the intelligence cycle end to end with minimal supervision.