Senior Blockchain Intelligence Analyst, Ransomware

Role overview

Lead complex investigations into ransomware activity as a senior individual contributor. You will combine blockchain tracing, cyber threat intelligence, and off-chain research to identify actors, follow proceeds, and produce defensible intelligence that can support investigations, disruption, or asset recovery.

Responsibilities

- Trace ransomware funds across blockchains, bridges, mixers, layered transactions, and cash-out services. - Take investigations from initial indicators through validation, attribution, and actionable leads. - Connect on-chain activity with open-source research, threat intelligence, infrastructure clues, and other off-chain signals. - Write source-supported assessments, actor profiles, fund-flow analyses, and lead packages for investigative, executive, and partner audiences. - Identify potential seizure, freezing, or recovery opportunities and help partners act promptly. - Share technical expertise, mentor peers, and improve analytical methods without managing a team.

Requirements

- Senior experience in crime analysis, threat intelligence, financial-crime investigations, or a comparable field, including work in government, law enforcement, national security, incident response, or a mature private-sector program. - Hands-on skill tracing funds across multiple blockchains and investigating mixers, bridges, chain-hopping, peel chains, and layered cash-outs. - Strong ransomware knowledge, including the roles of operators, affiliates, access brokers, malware developers, laundering networks, and cash-out services. - Ability to independently run complex investigations and turn technical findings into clear, actionable written and verbal briefings. - Familiarity with OSINT, cybercrime infrastructure research, and methods that combine blockchain evidence with off-chain signals. - Sound judgment and experience using AI tools or language models in research workflows, with the ability to check their outputs critically.

Nice to have

Experience with HUMINT collection or threat-actor engagement; manual demixing, smart-contract, Ethereum, or TRON investigations; structured investigative tools; and mentoring or improving analytical standards. The role has recurring team coordination, including weekly priority reviews and daily asynchronous updates, with primary time-zone overlap in US Eastern/Central hours.