Senior / Staff Threat Intelligence Analyst, Hacks

A senior or staff threat intelligence analyst who owns TRM Labs' coverage of crypto hacks, including its metrics, the system that delivers them and a small round-the-clock contractor team. After a DeFi protocol or exchange is hacked, the analyst runs the war room, coordinates teams, handles customer communication and writes the incident report, making sure customers learn which addresses to block within hours. The role keeps hack records complete, designs with data science how stolen funds are tracked as they move, builds AI agents to automate analysis, publishes root-cause write-ups and works on spotting vulnerable contracts before exploitation.

TRM wants five or more years in blockchain intelligence, crypto investigations, threat intelligence or incident response, cross-chain tracing skills and knowledge of DeFi and bridge exploits. Remote in the US, with on-call duty.