Cyber Threat Intelligence Jobs: Three Openings to Review

Three employer career pages showed active cyber threat intelligence openings when checked on 26 October 2026: two at TRM Labs and one at Dragos. They span scam-infrastructure investigations, crypto-hack response and industrial-control-system intelligence. Each has a different location or experience gate, so read the employer page before you apply.

This is a small, US-focused snapshot, not a complete job feed. Employers can close or change roles at any time. We checked their own career pages, and you should confirm the status and requirements again before applying.

Three current cyber threat intelligence openings

The job pages did not show closing dates when we checked them. The descriptions below reflect what the employers published on 26 October, not a guarantee that each vacancy remains open today.

TRM Labs: investigate hacks and trace activity

The Senior / Staff Threat Intelligence Analyst, Hacks opening focuses on TRM’s response to cryptocurrency hacks. The role leads the hacks category, coordinates response and communication, maintains hack records, and works with data science and engineering on attribution and analysis systems.

The employer lists remote work across several locations, including the United States, Singapore, London, EMEA and Seoul. It asks for five or more years in blockchain intelligence, crypto investigations, cyber threat intelligence, incident response or a related field. The description also calls for experience owning incident response, tracing activity across major blockchains, using AI-assisted analytical workflows with quality checks, and leading a small team or contractor group.

That is a senior specialist role, not a general entry point into CTI. If your background is mainly enterprise security operations, compare your evidence with the listing’s blockchain investigation and incident-leadership requirements before spending time on an application.

TRM Labs: track scam infrastructure

The Cyber Threat Intelligence Analyst, Scams role examines the infrastructure and financial activity behind scam campaigns. The description covers pivoting from domains, IP addresses or certificates; tracking hosting and registrar changes; connecting technical and on-chain evidence; and producing assessments for law-enforcement and government partners.

The page says remote and lists Washington, D.C., but the full title narrows eligible location to D.C., Maryland or Virginia. The posting asks for at least five years in CTI or threat-infrastructure analysis and experience with infrastructure attribution, campaign tracking and analytical tools. It is explicitly not an entry-level vacancy.

Treat “remote” as a work arrangement, not permission to work from anywhere. If you live outside the stated area, this role may not fit even though the posting is remote.

Dragos: write intelligence for industrial and federal customers

Dragos lists an Associate Principal Cyber Threat Intelligence Analyst in Washington, D.C. The description says the analyst will support a federal customer onsite, research threats to industrial control and operational technology environments, and turn findings into reports, briefings and operational guidance. It asks for an active Top Secret clearance and five or more years of hands-on threat-intelligence experience.

There is a work-arrangement detail to clarify: the job description says onsite at the customer location, while the application form asks whether the candidate is willing to work a hybrid schedule that includes commuting to the Washington-area site. The page also carries a “remote” tag in its footer. These statements do not settle the schedule. Ask Dragos to confirm the expected onsite days and location before relying on the tag.

The clearance requirement is explicit. The page does not explain how a candidate without an active clearance could obtain one, so don’t assume sponsorship or a path to clearance is available.

Search beyond the exact title

Some relevant postings use names such as Threat Intelligence Analyst, Cyber Threat Analyst, Threat Researcher, Threat Analyst, Intelligence Analyst or Cyber Intelligence Analyst. Search the role title alongside the work you want to do: threat research, infrastructure attribution, incident response, adversary tracking, detection, malware analysis or intelligence reporting.

Then read the full responsibilities. A role called “intelligence analyst” could focus on cyber threats, fraud, physical security or national security. A threat-research post might be close to CTI, but only if its audience and deliverables match the work you want. Titles are useful starting points; the actual duties tell you more.

Before applying, check these details on the employer’s own page:

• Where you may work: city, state or country restrictions, time-zone overlap, travel and onsite days.
• Work authorization: sponsorship rules and any federal-customer restrictions.
• Clearance: whether the listing requires an active clearance or only mentions classified work.
• Experience: required years and the kind of investigation, reporting or operational ownership expected.
• The output: intelligence products, technical research, incident leadership, infrastructure analysis or another specialty.
• The application route: use the employer’s current vacancy page and check that it still accepts applications.

You can browse cybersecurity jobs on CSJL and compare the responsibilities and location rules in each posting. For a deeper look at what the work produces, read our threat intelligence analyst role guide. Recheck every employer link before you apply because this shortlist can go stale as roles change.

Sources

• TRM Labs: Senior / Staff Threat Intelligence Analyst, Hacks
• TRM Labs: Cyber Threat Intelligence Analyst, Scams
• Dragos: Associate Principal Cyber Threat Intelligence Analyst