Threat Intelligence Analyst, Scams Expert

Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure. About the Role: TRM's Blockchain Intelligence team is the world's leading source of actionable crypto crime intelligence — and scams are the fastest-growing threat category we track. As a Threat Intelligence Analyst specializing in scams, you will own TRM's intelligence production on pig butchering syndicates, romance fraud networks, and investment scam operations: tracing their infrastructure, uncovering their actors, and delivering leads and insights that directly influence how law enforcement and financial institutions fight back. The impact you will have: You will map the infrastructure behind global scam syndicates — tracing victim funds through complex laundering chains and building attribution that TRM's customers and law enforcement partners rely on to take action against some of the most prolific criminal networks operating today. You will produce Snap Leads, Timely Insights, and contribute to published reports reaching law enforcement agencies, financial institutions, and crypto businesses worldwide, directly influencing investigations and shaping industry understanding of the scam threat landscape. You will use AI tools — including Claude, Perplexity, and AI‑assisted OSINT workflows — as core components of your research process to accelerate hypothesis generation, pattern recognition, and intelligence drafting at a pace manual methods cannot match. You will monitor global scam channels, forums, and social media platforms to surface proactive collection not visible through on-chain analysis alone, expanding TRM's proprietary attribution database with intelligence only TRM can provide. You will collaborate with TRM's GTM, Product, and Data teams to ensure your intelligence is embedded in the platform and reaches the customers who need it most. What we're looking for: 3+ years of experience in threat intelligence, fraud investigation, or crypto crime analysis, with demonstrated knowledge of scam ecosystems (pig butchering, romance fraud, investment fraud, or equivalent). Working proficiency in blockchain analysis — you can trace funds, identify clusters, and use tools like TRM Investigator or Chainalysis Reactor to follow laundering chains and build attribution chains. A track record of producing actionable intelligence outputs: you have written leads, reports, or briefs that reached real operational consumers and influenced investigative or business decisions. Strong AI fluency — you use Claude, Perplexity, or equivalent tools as core parts of your research workflow; you can articulate specific ways AI has accelerated your work. Excellent written communication: you can write a BLUF‑style intelligence report that a financial investigator, law enforcement analyst, or compliance officer can act on immediately. A self‑starter mindset: at L4, you are expected to generate your own collection priorities, pursue investigative threads independently, and deliver substantive output without being told exactly what to look for. About the Team: TRM's Blockchain Intelligence team combines the tradecraft of national security intelligence with the analytical depth of blockchain forensics — producing intelligence you will not find anywhere else in the industry. The team operates with high autonomy, a strong bias toward output, and direct access to the customers and law enforcement agencies who rely on the intelligence we produce. We work distributed, not distant — with structured async communication and regular syncs to align on collection priorities and share findings across the team. Expect high intellectual rigor, low bureaucracy, and fast iteration: you will go from an investigative thread to a published insight in days, not months. #J-18808-Ljbffr TRM Labs