Global Investigator

BUILD A SAFER WORLD. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure. The Scam Investigations team is TRM’s tip of the spear against pig butchering syndicates, romance fraud networks, and investment scam operations that steal billions from victims each year. The team operates an integrated workflow — from AI-supported complaint triage to time-sensitive investigation, escalation, and recovery support for victims. As a Global Investigator, you are the human judgment layer that turns AI-supported leads into actionable investigative outcomes. You review crypto-scam complaints and related artifacts at scale, validate or override proposed dispositions, and route matters to the appropriate downstream workflow. The impact you will have here: - Hold the disposition call on every case in your queue. Your validated disposition fires the automated handoff downstream. Clearing the daily queue is the core operational rhythm of the role. - Be the human override on AI. When the model is wrong, you catch it. Your override pattern teaches engineering where the confidence schema and auto-cluster logic need to improve. - Flag patterns, not just cases. When the same model error shows up across multiple clusters, surface it. What we’re looking for: - 3–5 years of experience triaging financial-crime complaints or dispositioning alerts in a high-volume environment — for example, a bank or VASP financial intelligence unit, a cyber-fraud complaint or task-force program, a cryptocurrency exchange’s compliance or investigations team, or a comparable mission. You have personally decided how individual cases get routed and owned the quality of those calls. You can walk us through a specific override — what the system said, what you decided instead, and why — and articulate, without a checklist, the difference between a good lead and noise worth ignoring. - AI fluency (required) — AI tools are core to your workflow. You can show specific ways AI has changed how you triage, draft, and pivot. AI fluency is evaluated during the interview process. - Complaint-data literacy — you know what separates a useful complaint from a noisy one in a high-volume feed, and you can read victim narratives — including screenshots, forwarded chat logs, and ragged copy-paste — without losing the thread of what actually happened. - Crypto/blockchain literacy at a read-and-triage level — You can recognize crypto artifacts, interpret crypto-related complaints, and know when a case is ready for asset-recovery review. You do not need to be a tracing expert. We can teach on-chain tradecraft; we cannot teach investigative judgment. - Strong written communication — your override rationale and pattern-level feedback need to be useful to engineering, the Manager, and downstream investigators. - US Citizenship required - NA-batch shift availability (location: anywhere in the US; one of two seats based in the Washington, D.C. / MD / VA area, hybrid) - Ability to obtain Public Trust clearance About the team: - Distributed, async-first via Slack and Notion, with structured syncs for alignment. Primary time-zone overlap: US Eastern / Central. - High autonomy, high standards, low bureaucracy — work directly with engineers, analysts, legal counterparts, and customers who depend on the team’s output. Team operating rhythms: - Daily action-queue clear and async standups via Slack on active work - Weekly team sync with the Investigations Manager - Regular engineering feedback sessions — you bring the week’s override patterns - All output documented in Notion and TRM’s investigative tools Learn about TRM Speed in this position: - React timely to the movement of funds during an ongoing investigation. -