Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

A cyber threat intelligence analyst on TRM Labs' Scam Disruption team, which targets pig butchering syndicates, romance fraud and investment scam operations. Beginning with one indicator such as a domain, IP address or certificate, the analyst maps the wider infrastructure behind Southeast Asian scam groups, groups indicators into campaigns, follows actors as they rebuild after takedowns, attributes them using open and commercial data, and connects that infrastructure to wallets, laundering routes and cash-out points on the blockchain. The work ends in confidence-rated targeting packages for law enforcement and government partners, supported by clustering logic and detection rules the analyst builds.

TRM wants five or more years in threat intelligence or infrastructure analysis, fluency with passive DNS, WHOIS and certificate fingerprinting, and intelligence that partners have acted on. Candidates must live in the DC, Maryland or Virginia area.