Cyber Threat Intelligence Analyst, Scams (DC, MD, VA only)

📋 Description

• Start from one indicator — a scam domain, IP, or certificate — and pivot across shared
• Track campaigns as they evolve — new domains, hosting and registrar changes, certificate reuse —
• Drive attribution of threat actors by leveraging open-source and commercially available data.
• Fuse technical infrastructure with the on-chain picture — carrying an investigation from
• Build clustering logic, detection rules, and automation or tooling to surface malicious
• Produce defensible, calibrated assessments — assigning confidence, weighing evidence across

🎯 Requirements

• 5+ years of proven experience in cyber threat intelligence or threat infrastructure analysis roles
• Hands-on infrastructure attribution: infrastructure pivoting and campaign tracking across shared
• A track record of staying on an actor or campaign over time, including through takedowns and
• Hands-on fluency with CTI tooling — passive DNS, WHOIS, certificate or Shodan-style fingerprinting
• Experience building detection and clustering logic, rules, or automation yourself — not just
• Attribution tradecraft: using open-source and commercially available data to drive attribution of

🎁 Benefits

• Distributed team with an async-first approach via Slack and Notion, plus structured syncs for
• High autonomy, high standards, low bureaucracy — work directly with analysts, engineers, and
• Weekly team syncs to align targeting priorities and review disruption opportunities
• Daily async standups via Slack on active work, returns, and target packages in flight
• Primary time zone overlap: US Eastern / Central
• All output documented in Notion and TRM's investigative tools