Internal And External Threat Intelligence Manager

Metro Bank; England; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Competitive salary

Discretionary bonus

Generous benefits

Pension scheme

Healthcare

Life assurance

Colleague discounts

Internal progression

Job summary

Metro Bank is seeking an experienced cyber threat intelligence professional to deliver timely and accurate CTI outputs aligned with intelligence requirements. You will translate external and internal threat data into actionable intelligence for SOC, detection engineering, threat hunting, and incident response teams.

You will maintain threat actor and horizon threat assessments for financial services, including AI-enabled threats, and produce clear CTI reporting and recommendations for

Qualifications

• Minimum 6-8 years in cyber security or related field.
• Recognised industry qualification or equivalent experience.
• Experience with threat intelligence platforms and OSINT tools is highly desirable.
• Experience communicating to technical and executive audiences.

Responsibilities

• Deliver threat intelligence outputs aligned to requirements.
• Translate threat information into actionable intelligence for SOC and related teams.
• Maintain threat assessments for financial services including AI-enabled threats.
• Produce clear CTI reports, briefings, and recommendations.
• Support insider risk, fraud, and investigations with intelligence.
• Contribute to horizon threat discussions and emerging technology threats.
• Improve CTI processes, tooling, source management, and metrics.
• Oversee CTI suppliers and intelligence-sharing relationships.
• Promote analytical standards through peer review and documentation.
• Provide evidence and management information to support cyber defence strategy.

Skills

Cyber security experience

Threat intelligence

Security operations

Incident response

Vulnerability management

Education

CISSP / CISM / CISMP / GCTI / GCIH / GCIA / GCFA or equivalent

Tools

Threat intel platforms

OSINT tools

Reporting frameworks

Job description

What you will do:

• Deliver specialist cyber threat intelligence outputs that are timely, relevant, accurate, and aligned to agreed intelligence requirements.
• Translate external and internal threat information into tactical and operational intelligence for SOC, detection engineering, threat hunting, incident response, vulnerability management, architecture, and security engineering teams.
• Maintain threat actor, campaign, sector, horizon, and emerging threat assessments relevant to financial services, including AI-enabled cyber activity, digital channels, suppliers, cloud services, colleagues, and customers.
• Produce clear CTI reporting, briefings, and recommendations that help stakeholders prioritise detection, response, remediation, and control improvement activity.
• Support teams responsible for insider risk, fraud, physical security, investigations, HR, Legal, and Risk with relevant intelligence, indicators, trends, and external context; ownership of those domains remains with the accountable teams.
• Contribute intelligence-led input into horizon threats, AI-enabled attack techniques, emerging threat, zero-day, exploit activity, and high-risk vulnerability discussions, without owning vulnerability management decisions, remediation plans, or formal risk acceptance.
• Operate and suggest improvements to CTI processes, tooling, source management, reporting standards, and metrics within the strategic direction set by senior management.
• Support operational management of CTI suppliers, feeds, and intelligence-sharing relationships, escalating service, budget, or strategic issues to senior management.
• Promote consistent analytical standards through peer review, good practice sharing, and clear documentation of intelligence judgements.
• Provide evidence, insight, and management information to support senior manager ownership of cyber defence strategy, risk posture, regulatory engagement, and executive reporting

And... we are a bank so risk is a part of everything we do. We love people who take responsibility, do the right thing for customers, colleagues and Metro Bank and have the ability to call out any concerns.

What you will need:

• A minimum of 6-8 years’ experience within cyber security, threat intelligence, security operations, incident response, vulnerability management, or a closely related discipline
• Recognised industry qualification such as CISSP, CISM, CISMP, GCTI, GCIH, GCIA, GCFA, or equivalent experience.
• Experience with threat intelligence platforms, OSINT tools, reporting frameworks, and intelligence-sharing communities is highly desirable.
• Experience with threat intelligence platforms, OSINT tools, and reporting for both technical and executive audiences.
• Strong understanding of cyber threat intelligence lifecycle principles, including direction, collection, processing, analysis, dissemination, and feedback.
• Strong understanding of threat actor behaviours, MITRE ATT&CK, cyber kill chain concepts, intelligence confidence levels, source reliability, and analytical bias.
• Knowledge of the financial services threat landscape, including cyber crime, ransomware, supply chain compromise, credential theft, fraud-enabling cyber activity, AI-enabled threats, and other emerging technology risks.
• Awareness of insider and internal threat indicators, control environments, and investigation support needs, with clear understanding that ownership sits with the relevant accountable teams.
• Understanding of horizon scanning methods and emerging technology threat themes, including malicious use of AI, synthetic identity, deepfake-enabled social engineering, automated reconnaissance, and AI-assisted phishing or malware development.
• Knowledge of SOC operations, detection engineering, incident response, vulnerability management, cloud security, identity, and data protection controls.
• Understanding of regulatory expectations relevant to cyber resilience, operational resilience, risk management, and evidence-based control improvement.

Our promise to you…

• We will make sure that you are well-rewarded by providing you with a competitive salary, discretionary annual bonus, and a wide range of benefits, including generous holiday allowance, attractive pension scheme, healthcare, life assurance, and a number of colleague discounts!
• We will give you the training to ensure you succeed in your role and plenty of internal opportunities to progress your career (around 40% of our recruitment comes from internal promotions!