Deployment Strategist, CTI

TRM Labs

12d•Remote

About The Position

The Deployment Strategist, CTI helps enterprise cyber threat intelligence teams move from a signed contract to repeatable intelligence outcomes on TRM's Intel platform. As the first Deployment Strategist dedicated to private-sector CTI in North America, this role owns customers end to end—from onboarding through adoption, renewal, and expansion—and defines the deployment playbook, success metrics, and tools for the function. The role uses AI, including Claude, to create onboarding plans, strengthen recurring intelligence workflows, automate account health summaries and business review drafts, identify adoption risks, demonstrate customer value, and surface product feedback. It partners with Account Directors on renewals and expansion, works with Product to prioritize customer needs, and builds deployment tooling for future hires. The role reports to and works directly with the Head of Customer Success and the CRO, with close collaboration with North America Sales and Product. The broader team is distributed and async-first, using Slack, documentation, weekly customer syncs, biweekly health syncs, and POD calls. Customer coverage is primarily during North American business hours, with occasional collaboration across other time zones. There is no formal on-call rotation, though the strategist is expected to see mission-critical customer issues through to resolution, including urgent needs outside standard hours. Travel is about 10%, primarily for occasional customer visits; there is no regular onsite requirement. Early objectives include delivering a working v1 deployment playbook within 30 days, sharing a draft success metrics framework at 50% completion within six weeks, and scoping the highest-impact expansion opportunity within 60 days. TRM describes itself as a distributed-first, Series C company with $220 million in total funding and hubs in several cities. The work is fast-paced and high-ownership, with changing priorities and ambiguity.

Requirements

At least 5 years of experience in deployment strategy, onboarding, solutions engineering, customer success, or another post-sale role.
Proven ownership of NRR, GRR, and expansion metrics, with a record of using AI to scale post-sale work.
Experience in cyber threat intelligence, security operations, threat hunting, incident response, or a CTI vendor or platform environment; consulting, MSSP, and enterprise security experience are relevant.
Understanding of corporate CTI team operations, including intelligence requirements, finished intelligence, and handoffs to SOC and hunt teams.
Fluency in threat actors, MITRE ATT&CK, vulnerability and exploitation intelligence, ransomware, and stealer logs, and ability to use AI to strengthen intelligence work and earn analyst trust.
Experience building a deployment, onboarding, or customer success function or playbook from scratch, using AI to accelerate it, and demonstrating its outcomes.
Production AI fluency: experience building repeatable workflows that synthesize data from multiple sources, with the ability to explain data logic and where human judgment remains involved.
Executive presence and ability to lead substantive QBRs with senior security leaders, supported by AI-assisted preparation.
Experience supporting enterprise customers across North American time zones, including regulated industries such as financial services, insurance, telecom, and critical infrastructure.
Bias toward shipping a v1 before all answers are known and using AI to work faster.
Ability to handle customer coverage primarily during North American business hours and occasional collaboration outside US time zones.
Ability to address urgent, mission-critical customer needs outside standard hours when they arise.
Willingness to travel occasionally, approximately 10% of the time.

Nice To Haves

Experience at a threat intelligence vendor, an ISAC or ISAO, or a corporate intelligence team.
Familiarity with third-party and supply chain risk or cyber insurance workflows.
Certifications such as GCTI or GCIH.

Responsibilities

Own enterprise CTI customers end to end from onboarding through adoption, renewal, and expansion.
Build and deliver a working v1 deployment and onboarding playbook, using customer call recordings and account notes to create tailored onboarding plans.
Use TRM's Intel platform and AI to develop recurring customer intelligence workflows, including threat landscape and sector targeting, vulnerability prioritization, credential and infostealer exposure, ransomware readiness, and malware and IOC investigation.
Build production AI workflows that combine Salesforce, Gong, and product usage telemetry to generate account health summaries and QBR drafts.
Define adoption benchmarks across hands-on usage, workflow adoption, consumption, and customer-specific success metrics; use AI-generated health signals to identify at-risk accounts ahead of renewal.
Lead business reviews with CISOs, CTI directors, and security leaders, connecting product usage to reported outcomes such as faster investigations, reduced exposure, and analyst time saved.
Co-own renewals and expansion with the Account Director, carry NRR and GRR targets alongside Sales, and identify additional workflows, teams, and use cases for expansion.
Aggregate adoption blockers, feature gaps, data coverage needs, and new use cases into prioritized Product feedback.
Build deployment tooling and define success metrics and practices for future hires.
Resolve mission-critical customer issues through to completion, including urgent needs that arise outside standard hours.
Collaborate with customers and internal teams through customer syncs, health syncs, POD calls, asynchronous Slack communication, and documentation.