Threat Intelligence & Incident Response Analyst

DS Smith; Greater London; On-site; GBP 65,000 - 95,000; Full time

Job summary

DS Smith is seeking a skilled Threat Intelligence Analyst to join its Information Security team. You will identify and analyse cyber threats, provide actionable intelligence, and support incident response to protect global operations and data.

You will monitor threats across manufacturing and logistics, leverage OSINT and dark web sources, and translate findings into practical actions for risk mitigation. Strong SQL-like querying and scripting help drive detection improvements.

Qualifications

• Experience in cyber security, with focus on threat intelligence, incident response, or security operations.

Responsibilities

• Monitor the global threat landscape for emerging cyber threats relevant to DS Smith and the manufacturing sector.
• Analyze intelligence from multiple sources including OSINT and dark web monitoring.
• Correlate external intelligence with internal security events using Microsoft Sentinel and Defender.
• Develop advanced KQL queries to support threat hunting, detection, and investigation.
• Produce threat intelligence reports, IoCs, and executive briefings.
• Support incident response activities from triage to recovery.
• Collaborate with SOC and technology stakeholders to strengthen detection capabilities.
• Contribute to threat models, risk assessments, and playbooks.

Skills

Threat intelligence

Incident response

Security operations

Threats & frameworks

Analytical skills

Malware analysis

Phishing investigations

Scripting & automation

Communication

Tools

Microsoft Sentinel

Microsoft Defender

KQL

DarkIQ

PowerShell

Python

Job description

DS Smith is seeking a skilled Threat Intelligence Analyst to join its Information Security team. You will identify and analyse cyber threats, provide actionable intelligence, and support incident response to protect global operations and data.

You will monitor threats across manufacturing and logistics, leverage OSINT and dark web sources, and translate findings into practical actions for risk mitigation. Strong SQL-like querying and scripting help drive detection improvements.