Threat Analyst

Sanderson Government & Defence; City Of London; On-site; GBP 60,000 - 80,000; Full time

Job summary

Sanderson Government & Defence is seeking a Threat Intelligence Analyst to join a high-performing Cyber Security team supporting a major UK Central Government programme. The role involves identifying, analysing, and communicating cyber threats that could impact government systems and services, with exposure to a nationally significant project.

You will work closely with Security Operations, Incident Response, and wider Cyber Security teams to build situational awareness, develop actionable

Responsibilities

• Monitor and assess a wide range of intelligence sources, including OSINT, commercial intelligence platforms, internal security telemetry, online databases and restricted intelligence feeds.
• Identify, analyse, and prioritise actionable cyber threats relevant to the organisation.
• Maintain awareness of emerging cyber threats, campaigns, vulnerabilities, threat actors and attack techniques.
• Conduct detailed research into cyber security threats, attackers, vulnerabilities and industry trends.
• Produce high-quality intelligence reports, threat assessments, executive summaries and technical briefings.
• Deliver actionable intelligence products to both technical and non-technical stakeholders.
• Analyse Indicators of Compromise (IoCs), including malicious IP addresses, domains, file hashes and malware indicators.
• Support identification of threat actor behaviours, tactics, techniques, and procedures (TTPs).
• Develop recommendations to strengthen defensive controls and improve detection capabilities.
• Support cyber incident investigations throughout the intelligence lifecycle.
• Work alongside Incident Responders and Security Operations teams to enrich investigations with threat intelligence.
• Assist with incident containment, remediation activities, and post-incident analysis.
• Apply established threat modelling and intelligence methodologies including MITRE ATT&CK, Cyber Kill Chain, Pyramid of Pain and Diamond Model.
• Identify intelligence gaps and opportunities to enhance threat detection and response capabilities.
• Contribute to tactical, operational and strategic threat intelligence activities.
• Support development of the organisation's intelligence capability.
• Provide proactive warnings and situational awareness on emerging threats affecting government services and critical infrastructure.

Job description

Threat Analyst

We are looking for a Threat Intelligence Analyst to join a high-performing Cyber Security team supporting a major UK Central Government programme. This is a unique opportunity to work on a nationally significant project that helps protect critical services and infrastructure used by millions of citizens.

As a Threat Intelligence Analyst, you will play a key role in identifying, analysing, and communicating cyber threats that could impact government systems and services. Working closely with Security Operations, Incident Response, and wider Cyber Security teams, you will help build situational awareness, develop actionable intelligence, and support the detection and response to emerging threats.

This role offers exposure to a highly visible government environment where security is paramount, providing excellent opportunities for professional growth and hands-on experience within a complex threat landscape.

Key Responsibilities

Threat Monitoring & Intelligence Analysis

• Monitor and assess a wide range of intelligence sources, including:
• Open-source intelligence (OSINT)
• Commercial intelligence platforms
• Internal security telemetry
• Online databases
• Restricted intelligence feeds
• Identify, analyse, and prioritise actionable cyber threats relevant to the organisation.
• Maintain awareness of emerging cyber threats, campaigns, vulnerabilities, threat actors, and attack techniques.

Research & Reporting

• Conduct detailed research into cyber security threats, attackers, vulnerabilities, and industry trends.
• Produce high-quality intelligence reports, threat assessments, executive summaries, and technical briefings.
• Deliver actionable intelligence products to both technical and non-technical stakeholders.

Threat Hunting & Indicators of Compromise (IoCs)

• Analyse Indicators of Compromise (IoCs), including:
• Malicious IP addresses
• Domains
• File hashes
• Malware indicators
• Support identification of threat actor behaviours, tactics, techniques, and procedures (TTPs).
• Develop recommendations to strengthen defensive controls and improve detection capabilities.

Incident Response Support

• Support cyber incident investigations throughout the intelligence lifecycle.
• Work alongside Incident Responders and Security Operations teams to enrich investigations with threat intelligence.
• Assist with incident containment, remediation activities, and post-incident analysis.

Threat Modelling & Frameworks

• Apply established threat modelling and intelligence methodologies including:
• MITRE ATT&CK
• Cyber Kill Chain
• Pyramid of Pain
• Diamond Model
• Identify intelligence gaps and opportunities to enhance threat detection and response capabilities.

Strategic Intelligence Support

• Contribute to tactical, operational, and strategic threat intelligence activities.
• Support development of the organisation's intelligence capability.
• Provide proactive warnings and situational awareness on emerging threats affecting government services and critical infrastructure.

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.