[Hiring] Senior Cyber Threat Response Advisor @TRM Labs

Role Description

As a Senior Cyber Threat Response Advisor focused on cyber resilience for critical infrastructure, your job is to:

• Analyze critical-infrastructure sectors.
• Identify the organizations that matter most to protect.
• Surface the vulnerabilities and exposures affecting them.
• Get intelligence into the hands of critical-infrastructure entities, government, and ISAC partners.

This is a senior individual-contributor role where you will:

• Run all-source analysis end to end on consequential targets in the cyber mission.
• Fuse OSINT, external exposure discovery, and threat-actor collection into defensible findings.

The impact you will have includes:

• Drive end-to-end remediation for your sectors.
• Run cyber threat collection.
• Build with AI, not just use it.
• Build the network picture around cyber threats.
• Triage at scale.
• Produce finished intelligence.
• Act as a senior advisor across multiple active threats.
• Partner across the ecosystem.

Qualifications

• 5+ years in cyber threat intelligence, incident response, or a closely related analytical field.
• Experience as the primary point of contact for an outside organization during a live incident or remediation.
• A track record of driving complex analysis independently.
• Comfort working under pressure with tight timelines.
• Applied AI fluency is required.
• Real collection capability from various sources.
• Demonstrated experience producing finished intelligence.
• Strong OSINT instincts.
• Excellent judgment about analytical confidence and evidentiary strength.
• Excellent written and verbal communication skills.
• Comfort operating in a fast-paced environment.
• Must be based in the United States. U.S. citizenship is required.

Requirements

• Travel: Up to 50%, within the United States.
• Direct familiarity with one or more critical-infrastructure sectors is a plus.
• Experience working with government partners, ISACs, or sector coordinating bodies is a plus.
• Working proficiency in a language heavily used by cyber actors is a plus.
• A public presence: conference talks, published research, or invite-only sharing circles is a plus.

Benefits

• High autonomy, high standards, low bureaucracy.
• Weekly team syncs to align targeting priorities.
• Daily async standups via Slack.
• All output documented in Notion and TRM's investigative tools.
• Surge availability during active disruption windows.