Threat Intelligence Analyst - Detection & Incident Response

DS Smith; City of Westminster; On-site; GBP 60,000 - 95,000; Full time

Job summary

DS Smith is seeking a skilled Threat Intelligence Analyst to join our Information Security team. You will identify, analyse, and communicate cyber security threats to protect our operations and data across manufacturing and logistics.

You will work with Security Operations, Incident Response, and Infrastructure teams, using Microsoft Sentinel, Defender, DarkIQ, and OSINT to deliver actionable intelligence and drive improvements in detection and response.

Qualifications

• Experience in cyber security with focus on threat intelligence, incident response, or security operations.
• Proven hands-on experience managing security incidents through full IR lifecycle.
• Strong understanding of cyber threats, threat actor behaviour, attack methodologies, and intelligence frameworks such as MITRE ATT&CK.

Responsibilities

• Monitor global threat landscape for emerging cyber threats and act on threats relevant to DS Smith.
• Analyse intelligence from OSINT, commercial feeds, industry sharing, and dark web sources.
• Correlate external intelligence with internal security events using Microsoft Sentinel and Defender.
• Develop advanced KQL queries to support threat hunting, detection engineering, and incident investigation.
• Produce actionable threat intelligence reports, IoCs, and executive briefings.
• Support incident response from triage through containment, eradication, and recovery.

Skills

Threat intelligence

Incident response

Security operations

MITRE ATT&CK

KQL

Microsoft Sentinel

Microsoft Defender

DarkIQ

OSINT

Threat hunting

Tools

DarkIQ

Microsoft Defender

Microsoft Sentinel

Job description

DS Smith is seeking a skilled Threat Intelligence Analyst to join our Information Security team. You will identify, analyse, and communicate cyber security threats to protect our operations and data across manufacturing and logistics.

You will work with Security Operations, Incident Response, and Infrastructure teams, using Microsoft Sentinel, Defender, DarkIQ, and OSINT to deliver actionable intelligence and drive improvements in detection and response.