Cyber Threat Intelligence Analyst

Role Overview

Deliver intelligence-led services across sectors, including Critical National Infrastructure (CNI), helping clients understand and respond to relevant cyber threats.

Research threats, produce actionable intelligence, and support threat hunting and digital risk monitoring. Work with increasing independence alongside senior analysts, security specialists, and client stakeholders.

What You’ll Be Doing

Threat Intelligence Research and Analysis

• Monitor emerging threats, campaigns, actors, vulnerabilities, and TTPs using internal, commercial, and open sources; collect, process, analyse, and enrich intelligence against client requirements.
• Apply structured analytic techniques and inductive/deductive reasoning; assess source credibility, reliability, access, and placement to reduce bias and strengthen judgements.
• Assess first-, second-, and third-order effects, explain client implications, and improve research, collection, and analytical workflows.
• Present your research and findings in a confident, professional, and easy to understand manner to both technical and non-technical stakeholders.

Intelligence Products and Reporting

• Produce timely notifications, advisories, assessments, reports, and briefings; own monthly CTI reports for assigned clients.
• Contribute data, trends, statistics, and commentary to monthly and quarterly service reviews; present CTI content to technical, non-technical, senior, and executive audiences.
• Use precise, probabilistic language to distinguish judgements from facts and observations; apply frameworks such as MITRE ATT&CK to model threats, intrusions, and adversary behaviour, linking findings to business impact, cyber risk, and action.

Threat Intelligence Platforms and Digital Risk

• Use CTI platforms such as OpenCTI to enrich, tag, validate, maintain, and disseminate intelligence through established workflows.
• Triage, investigate, and escalate attack surface and digital risk alerts; configure platform rules and scans, and handle appropriate junior-analyst escalations.
• Review feeds through Feedly or similar tools; maintain keyword/entity lists and turn relevant intelligence into notifications, advisories, reports, and newsletters.
• Monitor the CTI mailbox, respond to requests, and maintain associated planning tasks.

Threat Hunting and Technical Analysis

• Run, triage, investigate, and escalate threat hunts within the assigned squad; analyse actor infrastructure, indicators of compromise, malware behaviour, and attack patterns.
• Apply enterprise-network, security-operations, and incident-response knowledge; use or develop KQL, YARA, infrastructure profiling, malware analysis, scripting, and automation skills.
• Use generative AI and LLMs appropriately to improve workflows; integrate intelligence with SOC, Incident Response, Offensive Security, and Consulting teams.

Client Engagement and Consulting Delivery

• Build trusted client relationships; understand business context, threats, priorities, and outcomes, and translate stakeholder needs into clear, answerable intelligence requirements.
• Maintain proportionate collection plans, identifying sources, gaps, dependencies, and escalation points; deliver products and briefings that answer agreed requirements.
• Plan and contribute to client meetings, record decisions and follow-up actions, and manage deliverables to agreed quality and timescales; communicate progress, risks, dependencies, and blockers promptly.

Collaboration and Continuous Improvement

• Support a diverse, cohesive team; share knowledge, mentor colleagues, and guide junior analysts through established workflows.
• Support client onboarding, undertaking defined activities when senior analysts are unavailable.
• Improve CTI products, research, tooling, and delivery; stay current with threats, technologies, analytical techniques, and industry developments.
• Manage assigned work through CTI planning and contribute actively to stand-ups.

Essential Criteria

Experience - Approximately 1–3 years in cyber security, CTI, security operations, incident response, or a related discipline

CTI knowledge - Sound understanding of CTI principles, intelligence requirements, collection planning, and the intelligence lifecycle

Threat knowledge - Foundational-to-intermediate knowledge of threat actors, TTPs, offensive operations, vulnerabilities, malware, and threat frameworks

Research and analysis - Research technical and non-technical sources, evaluate evidence, identify connections, and form clear judgements

Critical thinking - Apply structured analytical techniques and inductive/deductive reasoning

Communication - Strong written and verbal communication, including intelligence reports and briefings

Technical literacy - Practical understanding of enterprise networks, security technologies, cyber security roles, and the wider security ecosystem

Client delivery - Manage assigned deliverables and communicate effectively with client stakeholders

Teamwork - Collaborative, dependable, curious, and improvement-minded, with sound judgement

Organisation - Prioritise work and deliver to agreed quality standards and timescales

Desirable Criteria

CTI platforms - OpenCTI, MISP, Recorded Future, or similar platforms

Digital risk - EASM, digital risk protection, breached-credential monitoring, or related tooling

Intelligence feeds - Feedly or comparable intelligence aggregation and monitoring platforms

Security operations - SIEM, EDR, SOC, incident response, or detection engineering experience

Threat hunting - Running, triaging, investigating, and escalating threat hunts

Technical skills - KQL, YARA, infrastructure profiling, malware analysis, or network analysis

Automation - Foundational scripting or automation using Python, PowerShell, Bash, or similar tools

Standards - Familiarity with STIX, TAXII, JSON, and intelligence-sharing communities

Emerging technology - Exposure to generative AI and LLMs in intelligence workflows