AI-Driven Cyber Threat Intelligence Engineer

Bupa Australia; Melbourne; On-site; AUD 140,000 - 180,000; Full time

Job summary

Bupa Australia is seeking a Cyber Threat Intelligence Engineer to analyse threats, produce intelligence, and enable faster decision-making across the CTI function. The role combines threat intelligence expertise with building and operating tooling, automation, and AI-powered capabilities.

You will align findings to MITRE ATT&CK and related models, own CTI communications, and develop agentic workflows while integrating for CTI pipelines and platform integrations.

Qualifications

• 3–5 years’ experience working as a Threat Intelligence Analyst or in a closely related cyber security role with a demonstrable analytical component.
• Hands-on experience producing structured threat intelligence products (reports, advisories, briefings) for both technical and non-technical audiences.
• Strong understanding of the threat intelligence lifecycle and key frameworks including MITRE ATT&CK, D3FEND, Diamond Model, and Cyber Kill Chain, with demonstrated ability to apply these to real-world threats.
• Proven experience using and correlating data from multiple intelligence sources and commercial threat intelligence platforms (e.g., Recorded Future, Mandiant, MISP, OpenCTI, or equivalent).
• Practical scripting or automation experience in Python and/or PowerShell, with a track record of building tools that improve CTI workflows.
• Demonstrated experience using AI tools (e.g., GitHub Copilot, LLM-based assistants) to accelerate development or analytical work.
• Relevant certifications in Cyber Threat Intelligence, Incident Response, or Threat Hunting (e.g., SANS FOR578, FOR508, CREST CTA, or equivalent).
• Experience with agentic frameworks (e.g., LangChain, AutoGen, CrewAI, or equivalent) and working knowledge of LLM APIs (OpenAI, Anthropic, or similar).
• Familiarity with SOAR platforms, SIEM query languages (e.g., Splunk, Microsoft Sentinel KQL), or EDR tooling in a CTI context. Knowledge of Azure or AWS cloud environments including deployment using infrastructure as code (e.g. terraform) via CICD pipelines

Responsibilities

• Conduct all-source intelligence analysis (OSINT, commercial, and internal telemetry) and produce clear, actionable assessments for technical and non-technical audiences.
• Produce high-quality intelligence outputs – reports, advisories, briefings, and executive presentations – and manage the IOC lifecycle from review and validation through to platform ingestion.
• Align intelligence findings to MITRE ATT&CK, Diamond Model, and Cyber Kill Chain to drive threat led detection use cases, and support CSIRT and Threat Hunting teams during investigations and hunts.
• Own the end-to-end CTI communications process, ensuring the right intelligence reaches the right stakeholders in the right format – including executive summaries, tactical advisories, and sector threat briefs.
• Develop and maintain a structured stakeholder engagement model across Cyber Defence, Security Architecture, Risk, and business leadership, acting as a trusted intelligence adviser.
• Manage and evolve the CTI collaboration platform, maintaining documentation standards, version control, templates, and workflows across all intelligence products.
• Design and build AI-powered agents and agentic workflows from the ground up – covering CTI collection, enrichment, analysis, and dissemination pipelines – and operate and prompt those agents day-to-day to accelerate intelligence work.
• Embed AI-assisted development tools (such as GitHub Copilot) and LLMs into everyday working practice – whether writing scripts, automating workflows, accelerating intelligence production, or improving the quality and consistency of outputs.
• Develop and maintain Python and/or PowerShell scripts to automate CTI workflows including IOC processing, threat feed ingestion, platform integrations, and reporting pipelines.
• Contribute to the CTI technology stack (TIP, OpenCTI, SIEM/SOAR integrations) and co-develop agentic use cases as part of Bupa’s AI transformation.

Skills

Threat intelligence

MITRE ATT&CK

Python

PowerShell

AI tools

LLM APIs

LangChain

SOAR/SIEM

Tools

OpenCTI

MISP

Recorded Future

Azure

AWS

Job description

At Bupa, purpose meets possible . Join us and help shape a future where healthcare is more connected, morepersonaland more human.

We’rea global healthcare leader trusted by millions and committed to helping people to live longer, healthier, happier lives and making a better world. Healthcare is changing, and so are we.We’reinvesting in more clinics, bettersystemsand smarter, more connected ways to help our customers. As we continue to expand our services and invest in innovation,you’llhelp create a healthcare system that meets people where they are, responds to what they need and leaves them better than before. Here, your work has purpose, your voice matters and your future is full of possibility.

Just imagine the impact you could make.

Opportunity snapshot- Permanent role

The Bupa Threat Intelligence Team sits within the newly formed Cyber Threat Management (CTM) function, delivering relevant, timely, actionable intelligence through a 360-degree contextualised view of threats that could affect Bupa before they have an adverse impact.

As a Cyber Threat Intelligence Engineer, you will be analysing threats, producing intelligence, and making sure the right people across Bupa have what they need to make informed decisions. What makes this role different is that you will also have the engineering skills to build and operate the tooling, automation, and AI powered capabilities that make the function faster and smarter. Both skills live in one role, and both matter equally.

Responsibilities

• Conduct all-source intelligence analysis (OSINT, commercial, and internal telemetry) and produce clear, actionable assessments for technical and non-technical audiences.
• Produce high-quality intelligence outputs – reports, advisories, briefings, and executive presentations – and manage the IOC lifecycle from review and validation through to platform ingestion.
• Align intelligence findings to MITRE ATT&CK, Diamond Model, and Cyber Kill Chain to drive threat led detection use cases, and support CSIRT and Threat Hunting teams during investigations and hunts.
• Own the end-to-end CTI communications process, ensuring the right intelligence reaches the right stakeholders in the right format – including executive summaries, tactical advisories, and sector threat briefs.
• Develop and maintain a structured stakeholder engagement model across Cyber Defence, Security Architecture, Risk, and business leadership, acting as a trusted intelligence adviser.
• Manage and evolve the CTI collaboration platform, maintaining documentation standards, version control, templates, and workflows across all intelligence products.
• Design and build AI-powered agents and agentic workflows from the ground up – covering CTI collection, enrichment, analysis, and dissemination pipelines – and operate and prompt those agents day-to-day to accelerate intelligence work.
• Embed AI-assisted development tools (such as GitHub Copilot) and LLMs into everyday working practice – whether writing scripts, automating workflows, accelerating intelligence production, or improving the quality and consistency of outputs.
• Develop and maintain Python and/or PowerShell scripts to automate CTI workflows including IOC processing, threat feed ingestion, platform integrations, and reporting pipelines.
• Contribute to the CTI technology stack (TIP, OpenCTI, SIEM/SOAR integrations) and co-develop agentic use cases as part of Bupa’s AI transformation.

Requirements

• 3–5 years’ experience working as a Threat Intelligence Analyst or in a closely related cyber security role with a demonstrable analytical component.
• Hands-on experience producing structured threat intelligence products (reports, advisories, briefings) for both technical and non-technical audiences.
• Strong understanding of the threat intelligence lifecycle and key frameworks including MITRE ATT&CK, D3FEND, Diamond Model, and Cyber Kill Chain, with demonstrated ability to apply these to real-world threats.
• Proven experience using and correlating data from multiple intelligence sources and commercial threat intelligence platforms (e.g., Recorded Future, Mandiant, MISP, OpenCTI, or equivalent).
• Practical scripting or automation experience in Python and/or PowerShell, with a track record of building tools that improve CTI workflows.
• Demonstrated experience using AI tools (e.g., GitHub Copilot, LLM-based assistants) to accelerate development or analytical work.
• Relevant certifications in Cyber Threat Intelligence, Incident Response, or Threat Hunting (e.g., SANS FOR578, FOR508, CREST CTA, or equivalent).
• Experience with agentic frameworks (e.g., LangChain, AutoGen, CrewAI, or equivalent) and working knowledge of LLM APIs (OpenAI, Anthropic, or similar).
• Familiarity with SOAR platforms, SIEM query languages (e.g., Splunk, Microsoft Sentinel KQL), or EDR tooling in a CTI context. • Knowledge of Azure or AWS cloud environments including deployment using infrastructure as code (e.g. terraform) via CICD pipelines

Why you’lllove it?

At Bupa, our purpose is to help people live longer, healthier, happier lives and make a better world, and we know this starts with delivering our purpose for our people.

Our wellbeing program Viva has been designed to help you to live a healthy and happy life. It includes access to health & general insurance discounts, information and education sessions, and preventative healthcare screening such as annual health assessments and skin checks. Through Viva you have access to a range of benefits that will help you tomaintainyour physical, mental, social, digital,environmentaland financial wellbeing. As well as a competitive salary, a range of Bupa benefits and flexible working,you’llbe challenged and encouraged to innovate.

If this sounds exciting,we’dlove to hear from you.Let’sshape the future of healthcare, together.

At Bupa your wellbeing, identity, and personal story are respected and valued. We are continuing to build teams that reflect the diversity of the communities we serve. Bupa is committed toprovidingequal opportunities and fostering a workplace and environment that is free of discrimination,bullyingand harassment.

We actively encourage applicants from all backgrounds and experiences, including Aboriginal and Torres Strait Islander peoples, veterans, people with disabilities, and LGBTQIA+ applicants.

We are dedicated to removing barriers to participation. If you need any reasonable adjustments during the recruitment process, or if you’d like to discuss how this role can be flexible for you, please let us know so we can support your participation on an equitable basis.