Threat Intelligence Manager - CTI & Security Strategy

Metro Bank (UK); Greater London; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Competitive salary

Discretionary annual bonus

Generous holiday allowance

Pension scheme

Healthcare

Life assurance

Colleague discounts

Job summary

Metro Bank is seeking an experienced Cyber Threat Intelligence (CTI) professional to deliver timely, accurate intelligence outputs and translate threat information for SOC, incident response, and risk teams. You will maintain horizon scans and coordinate with security engineering, privacy, and finance stakeholders across a hybrid London-based environment.

The role requires 6–8 years in cyber security, CISSP/CISM/CISMP or equivalent, and hands-on experience with CTI platforms and OSINT.

Qualifications

• A minimum of 6-8 years’ experience within cyber security, threat intelligence, security operations, incident response, vulnerability management, or a closely related discipline.
• Recognised industry qualification such as CISSP, CISM, CISMP, GCTI, GCIH, GCIA, GCFA, or equivalent experience.
• Experience with threat intelligence platforms, OSINT tools, reporting frameworks, and intelligence‑sharing communities is highly desirable.
• Experience with threat intelligence platforms, OSINT tools, and reporting for both technical and executive audiences.
• Strong understanding of cyber threat intelligence lifecycle principles, including direction, collection, processing, analysis, dissemination, and feedback.

Responsibilities

• Deliver specialist cyber threat intelligence outputs that are timely, relevant, accurate, and aligned to agreed intelligence requirements.
• Translate external and internal threat information into tactical and operational intelligence for SOC, detection engineering, threat hunting, incident response, vulnerability management, architecture, and security engineering teams.
• Maintain threat actor, campaign, sector, horizon, and emerging threat assessments relevant to financial services, including AI-enabled cyber activity, digital channels, suppliers, cloud services, colleagues, and customers.
• Produce clear CTI reporting, briefings, and recommendations that help stakeholders prioritise detection, response, remediation, and control improvement activity.
• Support teams responsible for insider risk, fraud, physical security, investigations, HR, Legal, and Risk with relevant intelligence, indicators, trends, and external context; ownership of those domains remains with the accountable teams.
• Contribute intelligence-led input into horizon threats, AI-enabled attack techniques, emerging threat, zero-day, exploit activity, and high‑risk vulnerability discussions, without owning vulnerability management decisions, remediation plans, or formal risk acceptance.
• Operate and suggest improvements to CTI processes, tooling, source management, reporting standards, and metrics within the strategic direction set by senior management.
• Support operational management of CTI suppliers, feeds, and intelligence‑sharing relationships, escalating service, budget, or strategic issues to senior management.
• Promote consistent analytical standards through peer review, good practice sharing, and clear documentation of intelligence judgements.
• Provide evidence, insight, and management information to support senior manager ownership of cyber defence strategy, risk posture, regulatory engagement, and executive reporting

Skills

Threat intelligence

SOC collaboration

Incident response

Vulnerability management

Security analysis

Education

CISSP/CISM/CISMP/GCTI/GCIA/GCFA

Tools

Threat intelligence platforms

OSINT tools

Reporting frameworks

Job description

Metro Bank is seeking an experienced Cyber Threat Intelligence (CTI) professional to deliver timely, accurate intelligence outputs and translate threat information for SOC, incident response, and risk teams. You will maintain horizon scans and coordinate with security engineering, privacy, and finance stakeholders across a hybrid London-based environment.

The role requires 6–8 years in cyber security, CISSP/CISM/CISMP or equivalent, and hands-on experience with CTI platforms and OSINT.