Threat assessment
Leading the identification, assessment and prioritisation of strategic threat arising from illicit cryptoassset use.Produce forward-leaning strategic intelligence assessments that inform national-level policy, operational prioritisation and capability investment. Translate complex on-chain and off-chain activity into clear judgements on the threat and (where appropriate) work up intelligence packages for further development by intelligence or operational teams.
Intelligence collection
Define intelligence requirements and gaps, working with both public and private partners across the UK system to fill them.
Blockchain analysis
Conduct advanced blockchain analytics and integrate this data with other intelligence sources.
Staff management
Manage staff and build a high-performing analtyical culture.
Stakeholder engagement
Interact with UK law enforcement, UK Intelligence Community (UKIC), regulators, policy teams, international partners and private-sector institutions to shape a shared understanding of the threat from cryptoassets and influence activity in other areas of the system response.
Innovation and capabilty development
opportunities to enhance analytical capability, pilot new approaches and contribute to organisational strategy on the use of blockchain analytics in the wider data landscape.
Person specification
Blockchain transaction analysis and tracing
Practical ability to analyse on-chain data, trace funds across wallets and protocols, and interpret transaction behaviour across major blockchains (e.g. Bitcoin, Ethereum, common L2s).
Use of specialist blockchain analytics tools
Hands-on experience with platforms such as Chainalysis, TRM Labs, Elliptic, CipherTrace or equivalent, including building cases, labelling entities, and producing evidential outputs.
Data analysis and technical literacy
Strong analytical capability, often including SQL, Python, or similar tools to interrogate large datasets, automate analysis, and validate findings is desirable.
Understanding of cryptoasset ecosystems and typologies
Knowledge of DeFi, exchanges (centralised and decentralised), bridges, mixers, NFTs, and common illicit and high-risk typologies (fraud, scams, sanctions evasion, laundering techniques).
Reporting, communication, and stakeholder engagement
Ability to translate complex blockchain activity into clear written reports and briefings for non-technical audiences, often supporting compliance, investigations, or strategic decision-making.
Behaviours
We'll assess you against these behaviours during the selection process: