Cyber Threat Intelligence Analyst

00139 LEIDOS INNOVATIONS UK LTD.; Farnborough; On-site; GBP 60,000 - 95,000; Full time

Benefits offered by this job

Contributory Pension Scheme

Private Medical Insurance

33 days Annual Leave

Flexi-Time

Job summary

Leidos is seeking a Cyber Threat Intelligence Analyst in Farnborough to deliver customer-focused CTI, vulnerability intelligence and remediation guidance within a 24x7 CSOC. The role emphasises translating adversary activity and vulnerability data into actionable recommendations for detection, hunting and incident readiness.

You will work with MITRE ATT&CK, VA/VM processes, and governance to prioritise defensive actions and improve cyber resilience for multiple clients, while collaborating with

Qualifications

• Proven CTI delivery experience in a SOC/CSOC with measurable outcomes.
• Ability to translate intelligence into defensive actions and decisions.
• Strong understanding of vulnerabilities, exploitation concepts and risk.
• Experience producing customer-specific exposure assessments and remediation priorities.

Responsibilities

• Deliver targeted CTI outputs to inform detections, hunts and readiness.
• Apply MITRE ATT&CK to connect actors to techniques and defensive opportunities.
• Lead exploit-informed vulnerability intelligence and zero-day response.
• Support VA/VM governance and contribute to vulnerability management workflows.

Skills

CTI delivery

Threat intelligence

Analytical thinking

Stakeholder engagement

Tools

Microsoft Defender VM

Nessus

MISP

Job description

Cyber Threat Intelligence (CTI) Analyst with Vulnerability Assessment and Vulnerability Management Responsibility

Location: Farnborough

Clearance - SC to start, DV for role

Everything we do is built on a commitment to do the right thing for our customers, our people and our community. Our mission and our values guide the way we do business. The foundations of our Leidos culture are our Values, Beliefs and Expectations by which we select, recognise and reward employees. They create the environment that drives us toward our mission.

Your role and responsibilities:

This is a pivotal Cyber Threat Intelligence role within a 24x7x365 CSOC. You will deliver targeted, customer-relevant threats and vulnerability intelligence that enables timely defensive decisions and strengthens cyber resilience. You will convert customer, sector, adversary, and vulnerability intelligence into clear priorities for detection, threat hunting, incident readiness, and remediation.

The role focuses on:

• Exploit-prevention-led intelligence that helps reduce credible attack paths before impact.
• Rapid, proportionate response to zero-day and emerging vulnerability events.
• Translation of geopolitical, sector and technical developments into customer-relevant cyber risk and action.

2) Intelligence Delivery Approach

Your mission is to turn relevant internal and external developments into customer-specific defensive advantage:

• Customer and Sector Context: Maintain an informed view of customer environments, critical services, technologies, and sector threat conditions.
• Adversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer.
• Threat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities.
• Vulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure.
• CSOC Integration: Ensure intelligence supports detection, hunting, incident handling, and operational decision-making.
• Preventive Outcomes: Inform proportionate vulnerability treatment and risk reduction through established VA/VM and service-management processes.

3) Key Responsibilities (Outcome-led)

A. Customer -> Sector -> Adversary Intelligence (Targeted CTI Delivery)

• Build and maintain customer and sector intelligence profiles covering relevant threats, attack paths, critical technologies, and exposure.
• Produce strategic, operational, and tactical intelligence that informs defensive decisions, detections, hunts, and readiness.
• Deliver timely, evidence-led outputs with clear confidence assessments and proportionate actions.
• Identify and analyse relevant threat actors, campaigns, malware, and infrastructure.

B. Threat Behaviour and Defensive Relevance

• Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities.
• Maintain structured analysis that supports early warning, prioritisation and repeatable operational use.

C. Exploit and Vulnerability Intelligence (VA/VM)

• Deliver exploit-informed vulnerability intelligence, assessing technical severity, exploitation potential, credible attack paths and service or data impact.
• Evaluate evidence of exploitation, relevant threat interest, available exploit capability, customer exposure, existing controls, and operational impact.
• Analyse root cause, exploitation mechanics, chaining opportunities, and attacker workflow where required to support defensible decisions.

D. Zero-day Response and Vulnerability Management

• Lead monitoring and rapid advice for zero-day and emerging vulnerabilities, defining customer impact, priority, and proportionate defensive recommendations.
• Support vulnerability actions through established governance and service management processes, maintaining accountability and traceability.
• Contribute to Vulnerability Management Working Groups through agendas, actions, management information, and trend analysis.

E. Operationalisation into the CSOC Toolchain (Detection & Automation)

• Collect and assess intelligence from approved open, commercial, internal and specialist sources, applying relevance and quality controls.
• Manage indicators and intelligence through their lifecycle, including confidence, attribution, review, and false-positive reduction.
• Enable effective use of curated intelligence within approved CSOC platforms, including Microsoft Sentinel and Microsoft Defender where appropriate.
• Partner with detection, engineering and automation colleagues using structured sharing, STIX/TAXII 2.x, APIs, webhooks and Logic Apps/playbooks where applicable.

F. Customer Engagement & Reporting (Trusted Advisor, No Alarmism)

• Produce customer-ready executive and technical intelligence products covering threats, campaigns, and vulnerabilities.
• Explain risk, impact, confidence, and required decisions clearly to leadership, operational and engineering audiences.
• Work calmly under pressure, handling challenging discussions with diplomacy and sound professional judgement.

G. Service Maturity & Differentiation

• Sustain consistent, efficient, and customer-relevant CTI delivery across multi-customer MSSP operations, with appropriate data separation and prioritisation.
• Identify opportunities that shorten time to action, support automation and strengthen measurable cyber resilience.

4) Measures of Success

Within 3-6 months, you will have:

• Established reliable customer and sector intelligence baselines.
• Delivered vulnerability intelligence that informs remediation priorities and reduces material exposure.
• Embedded relevant CTI into detection, hunting, enrichment, and vulnerability-management activity.
• Produced consistent, high-quality intelligence that enables timely customer action.

Ongoing, success will be demonstrated through:

• Timely and effective responses to exploited or high-likelihood vulnerabilities.
• Defensive coverage and detection or hunting outcomes informed by CTI.
• Intelligence outputs that lead to tracked defensive or risk-reduction actions.
• Clear, proportionate advice that sustains customer trust without unnecessary alarmism.
• Automation-ready workflows, playbook steps, and integration pathways that reduce time to action.

5) Key Deliverables

• Customer and sector intelligence profiles defining relevant threats, exposures, and priority intelligence needs.
• Strategic, operational, and tactical intelligence products with evidence, confidence, and recommended actions.
• Exploit-informed vulnerability and zero-day advisories with clear impact and risk‑reduction priorities.
• MITRE ATT&CK-based analysis connecting relevant threats to defensive opportunities.
• Curated intelligence and indicator packages suitable for approved CSOC platforms.
• Vulnerability‑management reporting, working-group support, actions, and trend analysis.

6) Essential Experience and Technical Capability

CTI and Vulnerability Intelligence

• Proven CTI delivery experience in a SOC or CSOC, with demonstrable operational outcomes.
• Ability to translate intelligence into clear defensive actions and decisions.
• Strong technical understanding of vulnerabilities, exploitation concepts, chaining, credible attack paths and business or service impact.
• Experience producing customer‑specific exposure assessments and proportionate remediation priorities.
• Experience supporting rapid responses to zero‑day or emerging vulnerability events across multiple stakeholders.
• Experience using vulnerability assessment or management tools, such as Microsoft Defender Vulnerability Management or Nessus, and interpreting results for decisionmakers.

Collection, Curation, and Integration

• Hands‑on intelligence collection and curation experience, including source assessment and indicator lifecycle management.
• Awareness of organisational, legal, and ethical requirements for specialist intelligence sources in high‑assurance environments.
• Familiarity with structured intelligence sharing integration and security automation concepts.
• Experience progressing actions through case management or ITSM platforms.

TDR (Threat Detection and Response) Experience

• Understanding MITRE ATT&CK, adversary TTPs and common attack vectors.
• Experience detecting, triaging, and investigating cyber security alerts and distinguishing false positives from incidents.
• Ability to create clear incident records and recommend proportionate countermeasures.
• Working knowledge of cyber security incident response.
• Flexibility to support customer TDR activity during BAU hours when required; this is not the core role.

7) Behavioral Competencies

• Customer‑focused: calm, credible and diplomatic; support decisions without alarmism.
• Clear communicator: adapts complex threats for executive, operational and engineering audiences.
• Analytical: connects weak signals and anticipates changes in attacker behaviour.
• Quality‑driven: evidence‑led, consistent, and precise.
• Collaborative: works effectively across intelligence, detection, engineering, vulnerability, and service‑management teams.

8) Desirable (Nice-to-have)

• CTI or VM experience in UK Government, MOD, CNI or another high‑assurance environment.
• Experience in multi‑tenant or MSSP operations and data‑segregation requirements.
• Experience with CTI platforms supporting correlation, analytics, or campaign reconstruction.
• Experience building or using MISP.

Leidos Sector: OOT Department: Leidos CSOC Security Requirement: Eligibility and willingness to obtain SC and DV security clearance are mandatory; no clearance is required on entry. Operating Model: 24x7x365 multi-customer CSOC, primarily aligned to an anchor customer. Working Model: BAU Monday to Friday, 37.5 hours per week; not shift work. Hybrid/Remote/Onsite: Onsite role. Homeworking requests will be considered case by case.

Our reward scheme includes:

• Contributory Pension Scheme
• Private Medical Insurance
• 33 days Annual Leave (including public and privilege holidays)
• Access to Flexible benefits (including life assurance, health schemes, gym memberships, annual buy and sell holidays and a cycle to work scheme)
• Flexi‑Time

Commitment to Diversity: We welcome applications from every part of the community and are committed to a truly diverse and inclusive culture. We foster a sense of belonging, welcoming all perspectives and contributions, and providing equal access to opportunities and resources for everyone.

If you have a disability or need any reasonable adjustments during the application and selection stages please let us know, and we will respond in a way that best fits your needs.

Pay Range: - The Leidos pay range for this job level