NMC Senior Cyber Threat Intelligence Specialist

Police Digital Service; Wigan; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Hybrid working

Job summary

Police Digital Service is recruiting for a senior CTI role within the National Management Centre. You will lead threat intelligence operations, coordinate with national partners (NCSC/NCA) and translate complex insights for technical and executive audiences.

You will mentor the NMC team, manage live incident responses, and help enhance the cyber threat posture across policing. Hybrid working arrangements apply across the UK.

Qualifications

• Deep understanding of threat actor lifecycles and TTPs.
• Proven ability in malware, phishing and SIEM log analysis.
• Experience leading CTI teams and mentoring colleagues.

Responsibilities

• Lead advanced threat hunting across national policing infrastructure.
• Profile adversaries and inform defensive measures.
• Collaborate with national partners and coordinate responses.
• Produce intelligence reports for technical and executive audiences.
• Guide pre-incident planning and threat modelling.
• Act as senior incident lead during live events and ensure continuity.
• Mentor NMC staff and drive continuous learning.
• Translate threat intelligence into actionable insights for boards.

Skills

Adversarial TTPs

Threat intelligence

Malware analysis

Phishing analysis

SIEM analysis

Leadership

Communication

Incident response

Education

GCTI or CREST

Intelligence training (NIAT/RISC UK)

Job description

This is an opportunity to play your part and protect our company, our customers and our communities from cyber attacks. Be part of a dedicated team and get ready to be challenged every day to make the most of your skills and experience. You’ll learn from those around you, and from outstanding training and development resources to become even better at what you do. With thebest technology at your fingertips, you'll be part of a friendly and flexible working environment where your contribution is always valued.

About Police Digital Service

We exist to harness the power of digital, data and technology to enable UK policing to better protect the communities it serves. Ours is a team of experts in commercial services, technical assurance, data, digital transformation and innovation, with a unique experience in policing and national programme delivery.

Our Values are:

• We value People
• We do the right thing
• We are innovative
• We are one Team
• We are proud and passionate

The National Management Centre will provide visibility and control of information risks for Policing. It will support the 24x7x365 nature of the police operations, providing a threat detection and response capability for digital services before, during and after cyber attacks, enabling stakeholders to understand and proactively manage risk across the technology estate at both the national and force level.

Key Responsibilities

• Support advanced threat hunting activities across national policing infrastructure, identifying indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and emerging threat patterns.
• Profile cyber adversaries by analysing behavioural patterns, infrastructure, and motivations to inform strategic and tactical defence measures.
• Collaborate with national partners including NCSC and NCA to share intelligence, coordinate responses, and align threat assessments.
• Produce high-quality, actionable intelligence reports and briefings for a range of stakeholders, including technical teams, senior police leadership, and government departments.
• Correlate intelligence from multiple sources (OSINT, SIGINT, internal telemetry, etc.) to build a comprehensive threat picture and drive proactive defence.
• Support and lead pre-incident planning, threat modelling, and attack surface reduction initiatives.
• Act as a senior point of contact during live incidents, supporting decision-making and coordinating intelligence-led responses.
• Mentor and develop NMC colleagues, fostering a culture of continuous learning and analytical excellence.
• Perform a leadership role during the manager’s absence, overseeing team operations, prioritizing workloads, and ensuring service continuity.
• Translate complex threat intelligence into clear, concise insights tailored to operational, strategic, and executive audiences.
• Present at various senior boards and forums (internal and external) on the benefits of establishing a healthy cyber security posture.

What you need to succeed in the role

• Deep understanding of adversarial TTPs and threat actor lifecycles.
• Proven experience in malware, phishing, and SIEM log analysis.
• Strong grasp of threat modelling and risk assessment frameworks.
• Skilled in OSINT collection and analysis.
• Demonstrated leadership in CTI environments, including mentoring and service development.
• Excellent communication skills - able to translate complex threats into clear insights.
• Experience supporting cyber incident response under pressure.
• Ability to work independently and manage stakeholder relationships effectively.
• Highly experienced in cyber threat intelligence or analytical roles.
• GIAC Cyber Threat Intelligence (GCTI) or CREST Registered Threat Intelligence Analyst.
• Understanding of UK policing cyber environments and threat landscape.
• Completed intelligence analysis training (e.g., NIAT, RISC UK).

We acknowledge that statistically women are less likely to apply for a job unless they meet all the criteria. We would like to encourage you to apply if you feel you might be the right person for this role. If you have any questions regarding the role itself, please email us at [e-mail] .

Diversity, equity and inclusion

We are committed to equal opportunities for all and will not discriminate on any grounds. We encourage applications from people from the widest possible span of experience. All applicants will be considered without attention to age, ethnicity, religion, sex, sexual orientation, gender identity, parental status, nationality, neurodiversity or disability status.

Working Arrangements

At the NMC, you will benefit from hybrid working, getting the advantages of both face-to-face team engagement and home working. NMC employees have the opportunity to work in our modern office environment for in-person collaboration, however you will also get the opportunity to work from home 2 days a week.

All applicants must be eligible for NPPV3 and SC clearances. Successful applicants will require NPPV3 clearance to have been approved before starting with PDS.