Threat Intelligence Analyst

About the role

We are looking for a Threat Intelligence Analyst to join our security team. The analyst will collect, analyse and operationalise threat data to protect the organisation against advanced adversaries. This role works closely with SOC, security engineering and leadership to turn intelligence into actionable defence.

Key responsibilities

• Collect and analyse threat intelligence from commercial feeds, OSINT, ISACs, vendor advisories, malware reports and internal incident findings.
• Produce tactical, operational and strategic intelligence reports for SOC, security engineering and leadership stakeholders.
• Map adversary tactics, techniques and procedures (TTPs) to the MITRE ATT&CK framework and create threat‑hunting hypotheses, detection content and SOAR enrichments.
• Validate and investigate indicators of compromise (IOCs) such as IP addresses, domains, URLs, hashes, malware families and campaign markers.
• Support investigations of phishing, BEC, ransomware, cloud compromise and targeted attacks by providing adversary context.
• Maintain threat‑actor profiles, intelligence requirements, collection plans and business‑risk mappings.
• Manage and optimise threat feeds within SIEM, SOAR and TIP platforms, reducing false positives and duplicate indicators.
• Deliver regular briefings on emerging threats, attack campaigns and recommended security actions.

Required profile

• Proven experience in the full threat‑intelligence lifecycle, from collection to dissemination.
• Ability to translate technical findings into clear reports for both technical and non‑technical audiences.
• Strong communication skills for briefing stakeholders and collaborating with SOC and engineering teams.
• Familiarity with intelligence frameworks such as MITRE ATT&CK, Cyber Kill Chain and Diamond Model.
• Experience working with SIEM, SOAR and TIP solutions.

Required skills

• OSINT (Open‑Source Intelligence) gathering.
• IOC analysis and validation.
• TTP analysis and adversary tracking.
• MITRE ATT&CK framework mapping.
• Cyber Kill Chain and Diamond Model knowledge.
• SIEM, SOAR and TIP platform integration.
• EDR/XDR technologies.
• Email security and malware analysis.
• Detection engineering and threat hunting.