GEOINT Analyst, Scams
Job description
GEOINT Analyst on TRM Labs' Scam Disruption team, locating and mapping scam compounds and the people operating them, and turning that into intelligence for law enforcement partners.
At a glance
- Work mode
- Remote · United Kingdom, EMEA
What you'll do
- Locate and map scam compounds, people, and devices
- Fuse intelligence with on-chain attribution and OSINT to identify operators and controllers
- Pivot from a single address, IP, photo, or victim lead to the compound and the people running it
- Partner with the Threat Intelligence Analyst (Scams Expert), the CTI Analyst, and the All-Source Lead to translate disruption strategy into targeting packages that influence law enforcement and government action
- Participate in weekly team syncs to align targeting priorities and review disruption opportunities
- Daily async standups via Slack on active work, returns, and target packages in flight
- Document all output in Notion and TRM's investigative tools
- Surge availability expected during time-sensitive disruption windows
What we're looking for
- 3 to 5 years of hands-on GEOINT experience: military, IC, law enforcement, or a GEOINT/OSINT firm
- Works beyond the government toolkit: can get answers from open-source and commercial tools when classified systems and data aren't available
- Creative tactical thinking — demonstrated ability to pivot from a single point to a network view, identifying operators behind operations
- Link and pattern analysis fluency — ability to correlate disparate data sources to generate defensible target packages
- Clear written and verbal communication: can explain methods, confidence, and own role in plain terms, and write memos, attribution write-ups, and leads that are actionable
- AI fluency (required) — uses AI tools in workflow, synthesizing data, drafting outputs, and accelerating analysis, with examples of how AI has impacted work
- Must already have the right to work where based
Nice to have
- Crypto experience
- Familiarity with Southeast Asia scam compounds or Chinese-run criminal networks
Your team
Scam Disruption team
Operates within TRM's Blockchain Intelligence organization, alongside threat intelligence analysts, on-chain investigators, and federal partners; distributed team with an async-first approach via Slack and Notion, plus structured syncs for alignment
How to get hired
- 1Recruiter Intro: Qualifications, motivations, and alignment with the role
- 2Hiring Manager: Deep dive into relevant experience, skills, and impact
- 3First Round: 1–2 interviews focused on the skills most critical to the role
- 4Final Round: Hands-on case study, usually a panel-style session going deeper into craft, problem-solving, and alignment with TRM
- 5References: Former colleagues who can provide insight into work and impact
- 6Offer: Recruiter presents the offer and compensation details
Apply
About TRM Labs
Build a Safer World.
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks.
Mission
Make the world safer and more secure by helping public and private sector agencies investigate and disrupt crime.
Key facts
- San Francisco
- Series C company with $220M in total funding
- Distributed-first company with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore
Partners & customers
What they value
- Impact-Oriented Trailblazer
- Master Craftsperson
- Inspiring Colleague