How much experience is required?

At least 5 years of relevant experience for this Senior Threat Intelligence Analyst, Hacks role.

What's the tech stack?

Joblaze extracted these technologies from the posting: AI, Blockchain, Incident Response, crypto.

What seniority level is this role?

TRM Labs targets senior candidates for this position.

Is this full-time or contract?

Full-time for this Senior Threat Intelligence Analyst, Hacks role at TRM Labs.

Senior Threat Intelligence Analyst, Hacks at TRM Labs

Joblaze summary

In the role of Senior Threat Intelligence Analyst at TRM Labs, the individual will lead the response to major hacks, coordinating across teams and ensuring timely communication with customers. Key skills include expertise in blockchain tracing, incident response, and applied AI, as well as the ability to manage a small team. This position is suited for someone with over five years of experience in cyber threat intelligence or related fields, particularly in high-stakes environments. The role involves close collaboration with various teams, emphasizing a fast-paced and high-ownership work culture.

Joblaze insights

Listed today — first seen on Joblaze October 1, 2026. Last confirmed on TRM Labs's careers page October 1, 2026.
Incident Response appears in 8% of 326 comparable senior security roles in United States; Blockchain appears in 1.2% of 326 comparable senior security roles in United States.

Quick facts

How much experience is required?: At least 5 years of relevant experience for this Senior Threat Intelligence Analyst, Hacks role.
What's the tech stack?: Joblaze extracted these technologies from the posting: AI, Blockchain, Incident Response, crypto.
What seniority level is this role?: TRM Labs targets senior candidates for this position.
Is this full-time or contract?: Full-time for this Senior Threat Intelligence Analyst, Hacks role at TRM Labs.

From the original posting

About the Role

When a protocol is drained, or an exchange is compromised, our customers need to know within minutes or hours which addresses to block and where the funds are going. You will own TRM's answer to that, end-to-end.

As a Senior Threat Intelligence Analyst, you will lead TRM's hacks category: the metrics, the system that hits them, and the small contractor team that keeps it running around the clock. We align on the outcome; the approach is yours.

The impact you will have

Take command when a big hack breaks and act as a leader. Run the response: triage, coordination across teams, internal and customer communications, and the incident report afterwards.
Get every major hack into TRM fast. Make sure every major hack is visible to customers within hours of the first credible public report, around the clock.
Keep TRM's hack data complete and accurate. Every hack, at any size, is recorded with its entity, theft addresses, date, amount, and hack type.
Follow the money at scale. Design the system, with our Data Science and engineering teams, that carries hack-specific attribution downstream as stolen funds move.
Build the machine with AI. Leverage AI to build the tools and agents to automate key parts of hacks analysis and response, while ensuring human quality control over every output.
Explain how it happened. Root-cause the most important hacks and publish best-in-industry technical analysis that makes TRM the first source cited.
See the next one coming. Build approaches that spot vulnerable contracts before they are exploited, and get them into our product.

What we're looking for

5+ years of professional experience in blockchain intelligence, crypto investigations, cyber threat intelligence, incident response, or a closely related field.
Has owned incident response in a high-stakes environment (exchange, security firm, incident response, or CTI team): war rooms, incident reports, communications under pressure.
Strong blockchain tracing across major chains (BTC, EVM, TRON, Solana), including bridges, cross-chain swaps, and mixers.
Understands how DeFi, bridge, and exchange exploits work, and how attackers behave after the theft.
Applied AI fluency. We expect you to already be building AI-assisted or agentic workflows in your daily analytical work, to be able to show how you validate their outputs and where they fail, and to treat AI as a force multiplier.
Experience managing contractors or leading a small team.
Writes and briefs clearly, from technical deep-dives to executive summaries.
Hands-on and highly accountable: does the hardest work, not only coordinates it.

Nice to have

Smart-contract reverse-engineering (Solidity).
Experience at a security auditor or blockchain analytics firm.
Experience following specific well-known hacker groups.

About the Team

The hacks function sits within TRM's Primary Intelligence organization, alongside the Facilitation & Money Laundering (F&ML) pod. You will work closely with the Nation States, Cyber Threat Intelligence, and Global Investigations teams, as well as with Data Science and Engineering on automation, and with Marketing on publications.

Team Operating Rhythms

Monthly metrics review with your manager.
Weekly operating sync with your team.
Regular syncs with your team across time zones.
A war room, run by you, whenever a major hack breaks.
On-call responsibilities

Recruiter Intro: Explore your experience, motivations, and alignment with the role.

Learn more about interviewing at TRM

At TRM, you should expect:

Priorities and targets to change quickly as we experiment and iterate
Close collaboration across teams and functions
Frequent, high-touch communication
Creative problem solving and out-of-the-box thinking

Accelerate repeatable workflows
Structure and solve problems
Improve output quality
Increase speed and leverage

Impact-Oriented Trailblazer: We put customers first and move with speed, focus, and adaptability. We treat every plan like an experiment – test, ship, measure, and iterate quickly.

Standard company text repeated across TRM Labs's postings is omitted here.