Blockchain Intelligence Analyst Manager

TRM is seeking a mission-driven leader to build and lead our advanced Threat Intelligence function. This role will oversee a team of 3–5 analysts focused on high-confidence attribution, strategic intelligence reporting, and proactive tracking of complex adversarial activity across the blockchain ecosystem. You’ll help elevate TRM’s capabilities in attribution and intelligence production, ensuring our clients — from Fortune 500 enterprises to government agencies — stay ahead of evolving threats.

The impact you will have:

• Build, lead, and mentor a team of 3–5 intelligence professionals focused on complex blockchain based threats.
• Develop and operationalize an attribution strategy that strengthens TRM’s confidence and analytical coverage across diverse threat landscapes.
• Collaborate with Product and R&D to integrate intelligence insights into our platform, models, and tagging.
• Deliver strategic reports and briefings to internal stakeholders, clients, and global decision-makers.
• Provide senior-level guidance and surge support during client-facing investigations involving sophisticated threat actors.

What we’re looking for:

• 10+ years in threat intelligence, national security, law enforcement, cyber investigations, or related analytical roles.
• Proven experience leading or managing a team of analysts or investigators in a high-stakes operational setting.
• Subject-matter expertise in analyzing advanced threat actors or complex illicit activity within the crypto or cyber domain.
• Excellent writing, synthesis, and briefing skills — capable of translating technical insights into executive-level narratives.
• Based in the U.S., with work authorization and overlap with U.S. time zones.

About the Team:

The Threat Intelligence team at TRM operates at the intersection of blockchain analytics, investigative tradecraft, and risk intelligence. We are a fully distributed team that works asynchronously with structured updates, Slack collaboration, and Notion documentation. Weekly syncs drive coordination across Product, R&D, Investigations, and Government Affairs. We value precision, discretion, and the ability to move quickly without sacrificing analytical rigor. Our culture rewards initiative, humility, and deep ownership of complex, mission-aligned work.

Operating Rhythms:

• This role is U.S.-based with required overlap between 9am–2pm PT (or equivalent ET hours).
• No on-call rotation, but the role may require participation in high-priority customer escalations on short notice.
• Slack, Notion, and secure async channels are primary modes of collaboration.

Learn about TRM Speed in this position:

• During breaking events involving emerging threats, the team ships a V1 threat report within 48 hours — then iterates based on partner feedback and new insights.
• The team continuously refines attribution workflows, leveraging internal tagging and cross-team retros to increase speed and confidence.
• High-priority customer escalations receive coordinated support across Investigations, Intel, and Product — with the Blockchain Intelligence Manager playing a central triage and intel-shaping role.