Iran-Focused Intelligence Analyst

Who you’ll work with

You’ll join a fast-moving, globally distributed team — analysts, threat-domain SMEs, data scientists, and engineers — collaborating across time zones, async and in real time. We move fast, hold each other to a high bar, and back each other up across regions. As the Iran SME, you’ll be the single point of depth for the domain and a force multiplier for everyone working adjacent to it.

In this role, you’ll:

• Own Iran attribution end to end — the threat-actor entities, their definitions, and the accounts, addresses, and infrastructure they operate: Iranian exchanges and OTC/no-KYC networks, IRGC and IRGC-QF financing, Iranian proxy and Shia militant finance (e.g., Hezbollah, the Houthis, and Iraqi militias), sanctions-evasion infrastructure, Iranian ransomware and state-linked cyber operations, and oil-, commodity-, and procurement-for-crypto flows.

• Lead the attribution response to Iran-related sanctions events — when OFAC or allied authorities designate Iranian entities, actors, or infrastructure, drive the rapid, high-visibility on-chain attribution that turns those designations into coverage in our data, often against the clock.

• Map the networks on-chain — trace how Iranian actors raise, move, launder, and cash out value through Iranian VASPs, regional exchanges, mixers, no-KYC swaps, mining operations, and off-ramps, and keep that picture current as they adapt to pressure.

• Produce finished intelligence — advisory notes, customer and partner briefings, and contributions to flagship publications (the Crypto Crime Report and beyond) that make the Iran crypto threat legible and actionable.

• Be the named external expert — represent Chainalysis on Iran crypto threats at conferences, on panels, with the press, and in briefings to public- and private-sector partners.

• Help set the Iran collection agenda — surface what data we need on Iranian networks and feed those requirements into our collection process and priority intelligence requirements; you direct collection for the domain, but it runs through the team’s apparatus and prioritization, not you alone.

• Translate typologies into detection — turn what you learn about Iranian methods into guidance that our products and our customers can operationalize.

• Build with AI — design and tune the automation that scales your analysis and the team’s, and handle the hard cases automation can’t.

• Level up the team — raise the bar on Iran and threat-finance tradecraft broadly, and partner closely with analysts, other SMEs, data science, and engineering.

We’re looking for candidates who have:

• Deep, demonstrable Iran expertise — real command of the IRGC and IRGC-Qods Force, Iran’s proxy and Shia militant landscape, Iranian sanctions evasion, and/or Iran’s illicit-finance and procurement systems. This is the core of the role, and we’ll expect you to show it.

• On-chain tracing ability against Iranian targets — direct experience following Iranian crypto activity on-chain (Iranian exchanges, sanctions evasion, proxy or terror finance), or deep Iran threat-finance expertise paired with proven blockchain-tracing skill you can bring to bear here from day one.

• A national-security or threat-finance background — intelligence, sanctions, counter-threat-finance, or investigations, from the IC, Treasury/OFAC, law enforcement, the military, a think tank or research institution, or private-sector CTF/sanctions work.

• Regional fluency — a strong grasp of Iranian geopolitics, the proxy network, and regional financial flows. Farsi (or Arabic) language ability is a significant plus.

• Elite potential and a proven track record — exceptional aptitude, judgment, and work ethic; you’ve led hard problems end to end and you raise everyone around you.

• Excellent writing and communication — this is an outward-facing expert role; your intelligence has to land with analysts, customers, and senior audiences alike.

• AI-forward instincts — you build automation to scale your work and others’, not just use it.

• Comfort working with data; blockchain forensics experience strongly preferred.

• 5+ years of relevant analytic, intelligence, or threat-finance experience for a Senior hire; 8+ years and recognized domain authority for a Staff hire.

You might also have:

• Farsi language ability.

• Direct experience with OFAC sanctions, terror-finance designations, or the designation process.

• A record of published research or public speaking on Iran, sanctions evasion, or crypto threat finance.

• Familiarity with Iranian exchange infrastructure, crypto mining as a sanctions-evasion vector, or dual-use procurement networks.

AI at Chainalysis

AI is not a feature at Chainalysis - it is a new way of working. One that turns instructions into work done, and helps us move faster than the threats we're built to counter, and we expect our employees to take ownership of the output and ensure quality. As the world's most trusted blockchain analytics platform, Chainalysis sits at a rare intersection of proprietary data, regulatory relationships and crypto expertise that makes it uniquely placed to shape and lead the next era of AI-driven intelligence - and we expect everyone here, regardless of role, to be an active part of it.

AI fluency is tied directly to how we measure performance and how we plan to win. There is no substitute for your own curiosity. We provide the tools, workflows, and space to experiment - but the expectation is that you develop these capabilities yourself, bring ideas, and collaborate across teams to reinvent the way work gets done. We are not using AI to do less. We are using it to do what was never possible before.