Senior / Staff Threat Intelligence Analyst, Hacks

As a Senior / Staff Threat Intelligence Analyst at TRM Labs, you lead the hacks category end-to-end: the metrics, the system that detects them, and the small contractor team that keeps it running around the clock. When a protocol is drained or an exchange is compromised, your customers need to know within minutes or hours which addresses to block and where the funds are going. You own TRM's answer to that.

What you'll do

• Take command when a major hack breaks, running the response including triage, cross-team coordination, internal and customer communications, and the incident report afterwards.
• Ensure every major hack is visible to customers within hours of the first credible public report, operating around the clock.
• Keep TRM's hack data complete and accurate, recording every hack with its entity, theft addresses, date, amount, and hack type.
• Design systems with Data Science and engineering teams that carry hack-specific attribution downstream as stolen funds move across chains.
• Build tools and AI agents to automate key parts of hacks analysis and response, while ensuring human quality control over every output.
• Root-cause the most important hacks and publish best-in-industry technical analysis that establishes TRM as the first source cited.
• Build approaches that spot vulnerable contracts before they are exploited and get them into the product.

What you bring

• 5+ years of professional experience in blockchain intelligence, crypto investigations, cyber threat intelligence, incident response, or a closely related field.
• Proven experience owning incident response in a high-stakes environment such as an exchange, security firm, incident response team, or CTI team, including war rooms, incident reports, and communications under pressure.
• Strong blockchain tracing across major chains (BTC, EVM, TRON, Solana), including bridges, cross-chain swaps, and mixers.
• Understanding of how DeFi, bridge, and exchange exploits work, and how attackers behave after the theft.
• Applied AI fluency: you are already building AI-assisted or agentic workflows in your daily analytical work, can show how you validate their outputs and identify where they fail, and treat AI as a force multiplier.
• Experience managing contractors or leading a small team.
• Ability to write and brief clearly, from technical deep-dives to executive summaries.
• Hands-on and highly accountable: you do the hardest work, not only coordinate it.

Nice to have

• Smart-contract reverse-engineering (Solidity).
• Experience at a security auditor or blockchain analytics firm.
• Experience following specific well-known hacker groups.

About TRM Labs

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM is a Series C company with $220M in total funding, backed by Goldman Sachs, Bessemer, Y Combinator, Thoma Bravo, and others, headquartered in San Francisco and operating as a distributed-first company with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore.