Job Description:
• Produce finished intelligence on ransomware actors, affiliates, facilitators, and laundering pathways
• Lead complex end-to-end blockchain investigations from seed indicators through attribution and recovery or disruption opportunities
• Trace ransomware funds across blockchains, bridges, mixers, peel chains, and nested services
• Correlate on-chain activity with OSINT, threat intelligence, partner data, and off-chain identity or infrastructure signals
• Own investigative workstreams from discovery through validation, escalation, and written production
• Surface leads and seizure or freeze opportunities supporting ransomware asset recovery
• Prioritize investigative work, maintain analytical standards, and mentor analysts without formal people management
• Partner with investigators, threat intelligence teams, product teams, and public- and private-sector partners
• Improve ransomware coverage, investigative methodologies, lead-generation workflows, and asset-recovery support
• Support external briefings, customer engagements, and capability-building sessions
• Participate in weekly team syncs and daily async Slack standups
• Document output in Notion and TRM investigative tools
• Provide surge availability during time-sensitive disruption windows
Requirements:
• 3–5+ years of professional experience in blockchain intelligence, crypto investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a comparable senior analytical role
• Deep hands-on blockchain tracing across multiple blockchains
• Experience tracing laundering and obfuscation techniques including mixers, chain-hopping, bridges, peel chains, and layered cash-out behavior
• Ability to independently conduct complex investigations and produce investigative assessments, lead packages, fund-flow analyses, and attribution reports
• Deep ransomware domain expertise and understanding of ransomware operators, affiliates, initial access brokers, malware developers, laundering networks, and cash-out services
• Excellent written and verbal communication skills
• Strong judgment, curiosity, and execution in fast-moving, high-stakes environments
• Experience using AI tools and large language models, with ability to critically evaluate AI-generated outputs
• Familiarity with OSINT, cybercrime infrastructure research, and cross-domain analytical methods
• Preferred: experience in government, national security, law enforcement, incident response, or mature investigative/threat-intelligence programs
• Preferred: familiarity with TRM, Maltego, Palantir, or similar platforms
• Preferred: HUMINT collection and engaging threat actors via dark web forums and encrypted messaging platforms
• Preferred: mentoring peers and improving investigative workflows
• Preferred: practitioner-level knowledge of manual demixing, smart contracts, bridges, Ethereum- and TRON-based investigations, and OSINT-based data extraction
• Primary time-zone overlap with US Eastern/Central
• Surge availability during time-sensitive disruption windows
Benefits:
• Equity plan eligibility
• Competitive benefits
• Wellness programs
• Time away from work
• Reasonable accommodations for applicants with disabilities
• Distributed-first/remote work arrangement