Senior Blockchain Intelligence Analyst – Ransomware

This is a fully remote position, open to applicants in United States.

📋 Description

• Generate compelling finished intelligence on ransomware actors, their affiliates, facilitators, and laundering routes, including actor profiles, lead packages, attribution assessments, and operational reports tailored for investigative, executive, and partner stakeholders.

• Oversee intricate end-to-end blockchain investigations starting from initial indicators such as victim payment addresses, deposit addresses, transactions, exchange exposure, infrastructure leads, or IP-linked activities, progressing to comprehensive attribution and actionable recovery or disruption opportunities.

• Track ransomware-related finances across various blockchains, bridges, mixers, peel chains, and nested services, identifying controllers, counterparties, cash-out services, and recovery points.

• Link on-chain activities with OSINT, threat intelligence, attribution partner data, and off-chain identity or infrastructure signals to create a comprehensive overview of adversary behavior within the larger cybercrime landscape.

• Manage investigative workflows from discovery through validation, escalation, and documentation, including composing intelligence products that are source-cited, auditable, and operationally beneficial.

• Aid TRM’s ransomware asset recovery initiatives by surfacing high-quality leads, pinpointing seizure or freeze opportunities, and assisting partners in acting swiftly before funds are off-ramped.

• Foster analytical leadership across ongoing ransomware investigations by prioritizing tasks, upholding stringent standards, and mentoring fellow analysts without formal management responsibilities.

• Collaborate closely with both internal and external stakeholders, including investigators, threat intelligence colleagues, product teams, and partners from the public and private sectors, to ensure that analytical outputs reflect genuine investigative practices and support cross-functional operations.

• Enhance TRM’s ransomware coverage by contributing fresh attribution insights, refining investigative methodologies, and optimizing repeatable processes for lead generation and asset recovery assistance.

• Assist in external briefings, customer or partner interactions, and capability-building sessions where ransomware tracing, attribution, and recovery techniques need to be conveyed clearly and credibly.

⛳️ Requirements

• 5-8+ years of professional experience in blockchain intelligence, cryptocurrency investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a similar senior analytical position.

• Expertise in blockchain tracing — Extensive hands-on experience tracking funds across multiple blockchains and through laundering or obfuscation methods such as mixers, chain-hopping, bridges, peel chains, and multi-layered cash-out behaviors.

• In-depth investigative tradecraft — Proven capability to independently conduct complex investigations and synthesize results into clear written intelligence products, including investigative assessments, lead packages, fund-flow analyses, and attribution reports.

• Ransomware domain expertise — A profound understanding of the broader cybercrime ecosystem and the connections between ransomware operators, affiliates, initial access brokers, malware developers, laundering networks, and cash-out services.

• Exceptional written and verbal communication — Particularly the skill to translate technically complex tracing findings into understandable, actionable intelligence for government and private-sector audiences.

• Sound judgment and execution — Strong judgment, curiosity, and the ability to perform effectively in a fast-paced, high-pressure environment where timing is crucial and outputs must withstand scrutiny.

• AI proficiency — Experience utilizing AI tools and large language models (LLMs) to expedite research, uncover insights, and enhance analytical workflows, with the capability to critically assess AI-generated outputs for accuracy and relevance.

🏝️ Benefits

• Individual compensation is determined by skills, qualifications, experience, and geographical location. Salary ranges are aligned with local market rates for the country where this role is based.

• We do not inquire about candidates' salary histories at any point during the hiring process.

• This position may also be eligible to participate in TRM's equity plan.