Senior Threat Intelligence Analyst, Hacks

As a Senior Threat Intelligence Analyst on TRM Labs' hacks team, you lead the metrics, systems, and contractor team that responds to major protocol drains and exchange compromises. Your customers need to know within minutes or hours which addresses to block and where funds are going, and you own TRM's end-to-end answer to that challenge.

What you'll do

• Take command when a major hack breaks: run the triage, coordinate across teams, manage internal and customer communications, and author the incident report.
• Ensure every major hack is visible to customers within hours of the first credible public report, operating around the clock.
• Keep TRM's hack data complete and accurate, recording every hack at any scale with its entity, theft addresses, date, amount, and hack type.
• Design systems with Data Science and Engineering teams that carry hack-specific attribution downstream as stolen funds move across blockchains.
• Leverage AI to build tools and agents that automate key parts of hacks analysis and response, while maintaining human quality control over every output.
• Root-cause the most important hacks and publish technical analysis that makes TRM the first source cited for industry-leading explanations.
• Build approaches that spot vulnerable contracts before exploitation and integrate them into TRM's product.

What you bring

• 5+ years of professional experience in blockchain intelligence, crypto investigations, cyber threat intelligence, incident response, or a closely related field.
• Proven track record owning incident response in high-stakes environments such as exchanges, security firms, or incident response teams, including war rooms, incident reports, and communications under pressure.
• Strong blockchain tracing skills across major chains including BTC, EVM, TRON, and Solana, with understanding of bridges, cross-chain swaps, and mixers.
• Deep understanding of how DeFi, bridge, and exchange exploits work and how attackers behave after theft.
• Applied AI fluency, building AI-assisted or agentic workflows into your daily analytical work, validating their outputs, and understanding where they fail.
• Experience managing contractors or leading a small team.
• Ability to write and brief clearly, from technical deep-dives to executive summaries.
• Hands-on and highly accountable: you do the hardest work, not only coordinate it.

Nice to have

• Smart-contract reverse-engineering experience with Solidity.
• Experience at a security auditor or blockchain analytics firm.
• Experience following specific well-known hacker groups.

About TRM Labs

TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM is a Series C company with $220M in total funding, backed by Goldman Sachs, Bessemer, Y Combinator, Thoma Bravo, and others. Headquartered in San Francisco with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore, TRM operates as a distributed-first company.