Senior Blockchain Intelligence Analyst, Ransomware

Skills

About the Role

This high-autonomy individual contributor role focuses on ransomware investigations, blockchain analytics, cyber threat intelligence, cryptocurrency attribution, and evidentiary workflows. The analyst will lead complex investigations, develop defensible assessments, and support disruption and asset recovery efforts.

Requirements

• 5-8+ years of experience in blockchain intelligence, crypto investigations, cybercrime analysis, threat intelligence, financial crime investigations, or a comparable senior analytical role.
• Deep experience tracing funds across multiple blockchains and through mixers, chain-hopping, bridges, peel chains, and layered cash-out behavior.
• Ability to independently conduct complex investigations and produce clear intelligence assessments, lead packages, fund-flow analyses, and attribution reports.
• Deep knowledge of ransomware ecosystems, including operators, affiliates, initial access brokers, malware developers, laundering networks, and cash-out services.
• Excellent written and verbal communication for technical and non-technical government and private-sector audiences.
• Strong judgment, curiosity, and execution in a fast-moving, high-stakes environment.
• Experience using AI tools and LLMs to accelerate research and analytical workflows while evaluating outputs critically.
• US citizenship required.
• Primary time-zone overlap with US Eastern or Central time.
• Preferred experience includes government, national security, law enforcement, incident response, OSINT, HUMINT, dark web research, crypto forensics, smart contracts, bridges, Ethereum, and TRON investigations.

Responsibilities

• Produce finished intelligence on ransomware actors, affiliates, facilitators, and laundering pathways.
• Lead end-to-end blockchain investigations from initial indicators through attribution and recovery or disruption opportunities.
• Trace funds across blockchains, bridges, mixers, peel chains, and nested services.
• Correlate on-chain activity with OSINT, threat intelligence, and off-chain identity or infrastructure signals.
• Own investigative workstreams through validation, escalation, and written production.
• Surface leads and seizure or freeze opportunities supporting ransomware asset recovery.
• Prioritize investigations, maintain analytical standards, and mentor other analysts.
• Partner with investigators, threat intelligence teams, product teams, and public- and private-sector partners.
• Improve ransomware attribution methodologies and repeatable investigative workflows.
• Support external briefings, partner engagements, and capability-building sessions.