Threat Intelligence Analyst

Tria; England; Hybrid; GBP 80,000 - 100,000; Full time

Job summary

A leading cybersecurity firm based in the United Kingdom is seeking an experienced Threat Intelligence Analyst for a hands-on role focused on adversary tracking and threat analysis. The successful candidate will manage third-party intelligence and collaborate across InfoSec teams. Ideal candidates will have over 5 years of experience, a strong understanding of the UK threat landscape and hands-on experience with security tools. This role offers a competitive daily rate and a hybrid work model.

Qualifications

• 5+ years' experience in Threat Intelligence, SOC or Incident Response.
• Strong working knowledge of MITRE ATT&CK and threat actor lifecycle analysis.
• Hands-on experience with threat intelligence platforms such as MISP, Recorded Future.

Responsibilities

• Lead threat actor tracking and attribution.
• Maintain adversary profiles using threat frameworks.
• Translate threat intelligence into actionable detections for SOC.

Skills

Threat Intelligence

KQL

Python

SOC/Incident Response

Microsoft Security Tooling

Education

GIAC Cyber Threat Intelligence (GCTI)

CREST Threat Intelligence Analyst

GCIH, SC-200, AWS Security Specialty

Tools

MISP

Recorded Future

CrowdStrike

Job description

Threat Intelligence Analyst - initial 3-6 month contract

Portsmouth or London (2 days a week onsite)

£500 - £600 a day (inside IR35)

We're seeking a highly experienced Threat Intelligence Analyst to lead adversary tracking, threat analysis, and intelligence integration across this large organisation. This is a senior, hands‑on role combining strategic threat insight with operational delivery, acting as the primary threat intelligence specialist within the InfoSec function and managing a third‑party intelligence provider.

This role is ideal for someone who understands the UK threat landscape, particularly critical national infrastructure and public sector risks, and can translate threat intelligence into actionable detection, response, and executive insight.

Key Responsibilities

• Lead threat actor tracking and attribution, focusing on APTs, ransomware, supply chain attacks and UK‑relevant campaigns
• Maintain adversary profiles using MITRE ATT&CK, Diamond Model and sector‑specific threat frameworks
• Correlate internal security telemetry with external intelligence feeds (e.g. MISP, Recorded Future, ISACs, Microsoft TI)
• Operationalise STIX/TAXII feeds and enrich IOC/IOA pipelines for SOC and Incident Response teams
• Translate threat intelligence into actionable detections, working with engineers on KQL/SPL queries and proactive threat hunts
• Produce regular threat reports and briefings for SOC leadership, CISO and senior stakeholders, including board‑level risk narratives
• Manage and oversee a third‑party cyber threat intelligence provider, ensuring quality, relevance and value
• Engage with UK threat‑sharing communities and maintain internal threat intelligence documentation and playbooks

Required Skills & Experience

• 5+ years' experience in Threat Intelligence, SOC or Incident Response
• Strong working knowledge of MITRE ATT&CK and threat actor lifecycle analysis
• Hands‑on experience with threat intelligence platforms such as MISP, Recorded Future, Anomali or similar
• Strong experience with Microsoft security tooling, ideally Sentinel and Defender
• Proficiency in KQL and working knowledge of Python for automation and enrichment
• Experience integrating intelligence into SIEM, EDR/XDR, and cloud security platforms (Microsoft, AWS, CrowdStrike, etc.)
• Deep understanding of the UK cyber threat landscape, particularly critical national infrastructure and public sector threats
• Comfortable operating as a sole senior threat intelligence specialist while collaborating across SOC and InfoSec teams

Desirable Certifications

• GIAC Cyber Threat Intelligence (GCTI)
• CREST Threat Intelligence Analyst
• GCIH, SC-200, AWS Security Specialty

We're looking for someone who can interview in Jan and ideally start within a few weeks so please apply asap.