{"@context":"https://schema.org","@type":"JobPosting","directApply":"https://schema.org/False","title":"Senior Threat Intelligence Analyst (Iran APT Focus)","description":"

With 1,000 intelligence professionals, over $300M in sales, and serving over 1,900 clients worldwide, Recorded Future is the world’s most advanced, and largest, intelligence company!

Senior Threat Intelligence Analyst

Strategic and Persistent Threats, Insikt Group, Recorded Future

This Role:

As a Senior Threat Intelligence Analyst on Insikt Group’s Strategic and Persistent Threats (SPT) team, you will lead efforts to track state-sponsored APT campaigns, mentor peers in intrusion analysis, represent Insikt Group’s expertise externally, and support Recorded Future’s Analyst-on-Demand service.

This role involves both proactive monitoring and in-depth research into threat actor infrastructure, tools, and TTPs, as well as the production of high-impact, client-driven finished intelligence. Your focus will be on state-sponsored cyber threats originating from Iran.

What You’ll Do:

Conduct proactive research on state-sponsored APT activity by synthesizing multiple technical datasets to develop novel insights and high-quality reporting
Establish and refine methods to track APT campaigns using network, intrusion, and malware analysis
Hunt for threat actor infrastructure and activity across diverse technical data sources, leveraging banner data, service metadata, and related technical artifacts
Identify, prioritize, and deploy detection mechanisms for command-and-control infrastructure, malware families, and threat groups of interest
Continuously evaluate and improve threat intelligence workflows, identifying opportunities to enhance automation, efficiency, and analytic precision
Stay up to date on evolving APT tradecraft by regularly reviewing technical publications, blogs, and intelligence from trusted sharing communities
Mentor colleagues on intrusion analysis tradecraft and threat intelligence best practices, fostering a culture of knowledge sharing and continuous development
Collaborate with geopolitical and regional analysis teams to support cross-functional research
Propose and evaluate new data sources and analytical methods to enhance or automate the intelligence cycle
Represent Insikt Group externally as a subject matter expert through customer briefings, media engagements, or public research dissemination
Collaborate with engineering and data science teams to ensure effective integration of relevant data and analytics into the Recorded Future platform
Support customer intelligence needs through Recorded Future’s Analyst-on-Demand service

What You’ll Bring (Required):

BA/BS or equivalent experience in Computer Science, Computer Engineering, Information Security, Security Studies, Intelligence, or a related field
Preferably 5+ years of experience in Information Security and/or Threat Intelligence
Demonstrated experience conducting technical threat analysis and research
In-depth knowledge of TCP/IP and other networking protocols and datasets relevant to intrusion and network infrastructure analysis
Demonstrated capability in identifying and tracking infrastructure through methods such as banner analysis and metadata correlation
Experience with static and dynamic malware analysis, including family attribution and variant clustering
Proficiency in scripting (Python preferred, or Go, C, C++, Java) and fluency with common CTI research tools such as Maltego, Jupyter Notebook, the Elastic Stack, and similar tools
Proven experience applying structured analytical techniques and intelligence methodologies to assess state-sponsored threat activity, including the intelligence cycle, intelligence writing best practices, and frameworks such as the Diamond Model
Familiarity with threat modeling and adversary tracking frameworks such as MITRE ATT&CK, the Cyber Kill Chain, and related models to support campaign clustering, detection development, and strategic reporting
Detailed understanding of existing APT groups’ past activities, TTPs, motivations, and targeting patterns
Experience with open-source intelligence-gathering tools and techniques
Experience working directly with customers, with strong written and verbal communication skills to clearly convey complex technical and non-technical concepts
Strong interpersonal and teamwork skills, including working with globally distributed team members

Highly Desirable Skills/Experience (not required):

MA/MS or equivalent experience in Computer Science, Computer Engineering, Information Security, or a related field
Experience writing network and endpoint detection signatures
Experience with Windows, iOS, Android, macOS, or malware analysis
Proficiency in a high-priority foreign language, with preference for Arabic, Chinese, Farsi, Korean, Portuguese, Russian, or Spanish

The base salary range for this full-time position is $127,000 - $160,000. Our salary ranges are determined by role, level, and location. The range displayed reflects the minimum and maximum target for new hire salaries for the position across all US locations. Within the range, individual pay is determined by state, work location and additional factors, including job-related skills, experience, and relevant education or training. This position may be eligible for incentive compensation, equity, and medical, dental, vision, life insurance and 401K. Your recruiter can share more about the specific details of the compensation and benefit package during the hiring process.

#LI-Remote

","identifier":"https://remote.com/jobs/recorded-future-c1e1g7nb/senior-threat-intelligence-analyst-iran-apt-focus-j1eofl0p","employmentType":"FULL_TIME","hiringOrganization":{"@type":"Organization","name":"Recorded Future","sameAs":"https://recordedfuture.com","logo":"https://cdn.talent-assets.remote.com/company_logos/d96a536f-1f5d-46d6-b1da-c36c188335edcompany_logo.png"},"datePosted":"2025-08-15T00:34:49Z","applicantLocationRequirements":[{"@type":"Country","name":"United Kingdom (UK)"},{"@type":"Country","name":"United States"},{"@type":"Country","name":"Puerto Rico"},{"@type":"Country","name":"Saint Pierre and Miquelon"},{"@type":"Country","name":"Cuba"},{"@type":"Country","name":"Bermuda"},{"@type":"Country","name":"Greenland"},{"@type":"Country","name":"Canada"},{"@type":"Country","name":"Cayman Islands"},{"@type":"Country","name":"Denmark"},{"@type":"Country","name":"Faroe Islands"},{"@type":"Country","name":"Hungary"},{"@type":"Country","name":"Iceland"},{"@type":"Country","name":"Jersey"},{"@type":"Country","name":"Moldova"},{"@type":"Country","name":"North Macedonia"},{"@type":"Country","name":"Norway"},{"@type":"Country","name":"Poland"},{"@type":"Country","name":"Romania"},{"@type":"Country","name":"Russia"},{"@type":"Country","name":"Serbia"},{"@type":"Country","name":"Sweden"},{"@type":"Country","name":"Liechtenstein"},{"@type":"Country","name":"Switzerland"},{"@type":"Country","name":"Ukraine"},{"@type":"Country","name":"Guernsey"},{"@type":"Country","name":"Isle of Man"},{"@type":"Country","name":"Andorra"},{"@type":"Country","name":"Austria"},{"@type":"Country","name":"Belgium"},{"@type":"Country","name":"Croatia"},{"@type":"Country","name":"Cyprus"},{"@type":"Country","name":"Estonia"},{"@type":"Country","name":"Finland"},{"@type":"Country","name":"France"},{"@type":"Country","name":"Germany"},{"@type":"Country","name":"Greece"},{"@type":"Country","name":"Ireland"},{"@type":"Country","name":"Italy"},{"@type":"Country","name":"Kosovo"},{"@type":"Country","name":"Latvia"},{"@type":"Country","name":"Lithuania"},{"@type":"Country","name":"Luxembourg"},{"@type":"Country","name":"Malta"},{"@type":"Country","name":"Monaco"},{"@type":"Country","name":"Montenegro"},{"@type":"Country","name":"Netherlands"},{"@type":"Country","name":"Portugal"},{"@type":"Country","name":"San Marino"},{"@type":"Country","name":"Slovakia"},{"@type":"Country","name":"Slovenia"},{"@type":"Country","name":"Spain"},{"@type":"Country","name":"Albania"},{"@type":"Country","name":"Vatican City (Holy See)"},{"@type":"Country","name":"Armenia"},{"@type":"Country","name":"Belarus"},{"@type":"Country","name":"Bosnia and Herzegovina"},{"@type":"Country","name":"Bulgaria"},{"@type":"Country","name":"Czech Republic"},{"@type":"Country","name":"Georgia"},{"@type":"Country","name":"Gibraltar"}],"jobLocationType":"TELECOMMUTE","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":127000,"maxValue":160000,"unitText":"YEAR"}}}