Senior Intelligence Analyst, DPRK & China Focus

About the role

The role is a deep domain expertise position focused exclusively on North Korea and China within the Global Intelligence Team at Chainalysis. You will own the end-to-end attribution, analysis, and operationalization of cryptocurrency activity related to these specific threat actors and networks. This is a hands-on intelligence role where your work will directly inform product data and customer decision-making in high-stakes environments. You will be responsible for transforming on-chain activity into clear, actionable intelligence regarding DPRK and Chinese malicious cyber operations. The position requires a high level of ownership over the problem space from initial data collection through final intelligence dissemination. You will act as the definitive subject matter expert both internally and externally on these critical threat landscapes.

Key facts

What you'll do

• Own DPRK & China attribution end to end - the threat-actor entities, their definitions, and the accounts, addresses, and infrastructure they operate: Lazarus Group and DPRK state-sponsored theft and laundering, DPRK IT-worker networks, Chinese-language OTC and underground-banking networks, guarantee marketplaces (e.g., Huione-style platforms), scam-compound and pig-butchering laundering infrastructure, fentanyl and precursor vendors, and Chinese money-laundering organizations.
• Lead the attribution response to DPRK- and China-related sanctions events - when OFAC or allied authorities designate DPRK actors, exchange-hacking units, or Chinese laundering networks, drive the rapid, high-visibility on-chain attribution that turns those designations into coverage in our data, often against the clock.
• Map the networks on-chain - trace how stolen and illicit funds move through mixers, cross-chain bridges, no-KYC swaps, OTC brokers, and off-ramps, following DPRK hack proceeds into and through Chinese laundering infrastructure, and keep that picture current as they adapt to pressure.
• Produce finished intelligence - advisory notes, customer and partner briefings, and contributions to flagship publications (the Crypto Crime Report and beyond) that make DPRK theft/laundering and Chinese money laundering legible and actionable.
• Be the named external expert - represent Chainalysis on DPRK and China crypto threats at conferences, on panels, with the press, and in briefings to public- and private-sector partners.
• Help set the DPRK & China collection agenda - surface what data we need on these networks and feed those requirements into our collection process and priority intelligence requirements; you direct collection for the domain, but it runs through the team's apparatus and priority-setting methodology.
• Drive entity resolution for DPRK and Chinese actors within the platform, ensuring that the blockchain data accurately reflects the evolving tactics, techniques, and procedures of these threat actors.
• Collaborate with data scientists and engineers to optimize data labeling pipelines and improve the automated detection of illicit patterns specific to these jurisdictions.

Requirements

You must meet the following eligibility and hard bars as defined by the source material.

• You possess the ability to solve the hardest technical challenges and build products that establish trust in cryptocurrencies.
• You thrive in a global organization that values challenging work done alongside exceptionally talented teammates.
• You are capable of building a flexible, AI-driven platform that automates entity resolution and optimizes data labeling pipelines.
• You have the capability to create predictive models that identify illicit patterns before they escalate.
• You have experience with blockchain data being used to solve high-profile criminal and national-security cases.
• You understand how cryptocurrency data can make it safer for people everywhere to access crypto.
• You have a deep understanding of the global crypto money laundering ecosystem and how it operates.
• You are the subject-matter expert who connects on-chain activity to real-world entities across the global crypto ecosystem.

Nice to have

The source text does not specify any preferred or nice-to-have qualifications beyond the core requirements and responsibilities.

Practical notes

The engagement is full-time and the location is remote within the USA. The role involves fast-paced work where the analyst will be expected to be a force multiplier for the entire team. There is no mention of specific hours, travel requirements, visa sponsorship details, or application deadlines in the provided source text. The focus is entirely on the depth of analysis required for the DPRK and China threat domains.