Senior Cyber Threat Intelligence Analyst - Scam Infrastructure

Openkrill; United States; Remote; USD 140,000 - 210,000; Full time

Job summary

TRM Labs is seeking a seasoned Cyber Threat Intelligence Analyst for its Scam Disruption team to lead infrastructure-driven investigations. You will pivot from indicators to map networks, track evolving campaigns, and drive actor attribution using OSINT and commercial data.

Collaboration with engineering and law enforcement is required to sharpen TRM's collection capabilities. You will fuse on-chain and off-chain intelligence, build detection logic, and deliver defensible targeting packages for

Qualifications

• 5+ years in cyber threat intelligence or threat infrastructure analysis
• Experience pivoting across certificates, registrars, nameservers, hosting, and ASNs
• Proven track record of actor/campaign attribution over time
• Experience building detection, clustering logic, or automation
• Ability to produce actionable intelligence for government or law enforcement
• Must be located in the Washington, D.C./MD/VA area

Responsibilities

• Pivot from a single indicator to map wider infrastructure behind campaigns
• Track campaigns as they evolve and anticipate re-registration after takedowns
• Drive attribution of threat actors using open-source and commercial data
• Fuse infrastructure with on-chain data to trace money paths
• Develop detection and clustering logic to surface malicious infrastructure
• Produce defensible, calibrated intelligence packages for government or law enforcement
• Own the intelligence cycle end to end with cross-team collaboration

Skills

Infrastructure attribution

Campaign tracking

CTI tooling

Passive DNS

WHOIS

Shodan fingerprinting

Detection logic

Clustering

Automation

Open-source data

Attribution tradecraft

Actionable intelligence

Tools

Passive DNS

WHOIS

Shodan

Job description

TRM Labs is seeking a seasoned Cyber Threat Intelligence Analyst for its Scam Disruption team to lead infrastructure-driven investigations. You will pivot from indicators to map networks, track evolving campaigns, and drive actor attribution using OSINT and commercial data.

Collaboration with engineering and law enforcement is required to sharpen TRM's collection capabilities. You will fuse on-chain and off-chain intelligence, build detection logic, and deliver defensible targeting packages for