Threat Intelligence Lead

Resolve Tech Solutions; Irving (TX); On-site; USD 140,000 - 210,000; Full time

Job summary

Resolve Tech Solutions Inc. is seeking a Threat Intelligence Lead to own the organization’s threat intelligence program from strategy to execution. You will direct a team of analysts, set collection priorities, and govern standards for intelligence products.

You will report on KPIs and partner with Security Operations, IR, and Vulnerability Management to translate insights into actionable defense actions. You will also own the TI platform strategy, vendor selection, andfeed management, while

Qualifications

• Deep knowledge of MITRE ATT&CK, intelligence cycle, and structured analytic techniques.
• Proven ability to deliver intelligence to executive/board audiences.
• Experience directing threat intelligence platform and vendor strategy, including feed evaluation and management.

Responsibilities

• Lead the threat intelligence program and supervise the analyst team.
• Set collection priorities based on organizational risk, target markets, and stakeholder needs.
• Own the TI roadmap, maturity, tooling, staffing and process improvements.
• Establish and enforce standards for finished intelligence, source reliability, and confidence reporting.
• Define and track KPIs; report timeliness, actionability, detection coverage, and stakeholder satisfaction.
• Collaborate with IR, Vulnerability Management, and Product Security on prioritization and actions.
• Oversee TI platform strategy, vendor relations, licensing, and renewals.
• Coordinate with ISACs/ISAOs and leadership forums on risk and governance.

Skills

MITRE ATT&CK proficiency

Intelligence cycle expertise

Executive briefing experience

Vendor strategy & feed management

Cross-functional leadership

Detection engineering collaboration

Communication skills

Education

Bachelor's degree in Cybersecurity, CS, Intelligence Studies, or related field

Tools

MISP

ThreatConnect

Anomali

Recorded Future

VirusTotal

Job description

Role: Threat Intelligence Lead Location: Irving, TX Onsite job. Position Summary (Summary of the Role) You own the threat intelligence function, setting collection priorities, intelligence standards, and reporting cadence for the organization. You lead a team of analysts, direct their day-to-day work, and are personally accountable for the quality, timeliness, and actionability of intelligence delivered to Security Operations, Incident Response, Vulnerability Management, and executive stakeholders. You represent threat intelligence in leadership forums, own vendor and feed decisions, and build the program's maturity year over year.

Responsibilities

• Key Responsibilities
• Lead the threat intelligence program
• Set intelligence collection priorities and requirements based on organizational risk, industry targeting, and stakeholder needs
• Own the threat intelligence roadmap, including program maturity, tooling, staffing, and process improvements
• Establish and enforce standards for finished intelligence products, source reliability, and confidence-level reporting
• Define and track program KPIs, such as report timeliness, actionability, detection coverage, and stakeholder satisfaction
• Manage and develop the analyst team
• Hire, coach, and manage threat intelligence analysts, including workload prioritization and quality review of their work
• Set individual and team goals, conduct performance reviews, and build career development plans for analysts
• Run the team's intelligence cycle end to end: tasking, collection, analysis, production, and dissemination
• Build team proficiency in structured analytic techniques, adversary tracking, and the MITRE ATT&CK framework
• Deliver strategic and operational intelligence
• Personally author and quality-check high-stakes intelligence products, including executive and board-level briefings
• Lead intelligence support during major incidents, providing attribution, actor intent, and containment guidance to IR leadership
• Direct the organization's threat landscape assessment, including sector-specific and geopolitical risk
• Prioritize vulnerability remediation guidance in partnership with Vulnerability Management using exploitation and actor-interest data
• Own detection enablement and adversary emulation
• Partner with detection engineering to convert intelligence into SIEM/EDR detection logic and hunting programs
• Direct threat-informed red team, purple team, and adversary emulation exercises using current TTPs
• Review and approve detection and hunting priorities to ensure they reflect the current threat landscape
• Vendor, platform, and cross-functional leadership
• Own the threat intelligence platform (TIP) strategy, feed and vendor selection, licensing, and renewal decisions
• Build and maintain relationships with industry ISACs/ISAOs, law enforcement, and peer intelligence leads for information sharing
• Represent threat intelligence in leadership, risk, and governance forums, including budget and staffing discussions
• Partner with Security Architecture, IR, Vulnerability Management, and Product Security leads to align intelligence with broader security strategy
• This is a full-time, on-site position based in Irving, TX.
• Occasional after-hours support may be required.
• Set the team's quarterly collection priorities based on a shift in the organization's threat landscape or business footprint
• Lead intelligence support for a major incident, briefing executive leadership on likely actor, objectives, and containment status
• Negotiate and onboard a new commercial threat intelligence feed, defining success metrics before renewal
• Review and elevate an analyst's actor profile before it goes to the CISO and board
• Direct a purple team exercise built around a threat actor actively targeting the organization's sector

Qualifications

• Years of Experience 6+ years of experience in threat intelligence, security operations, or incident response, including prior experience mentoring or leading analysts
• Education & Certification Requirements Bachelor's degree in Cybersecurity, Computer Science, Intelligence Studies, or related field, or equivalent experience

Required Skills

• Required Qualifications (Non-Negotiable)
• Deep working knowledge of MITRE ATT&CK, the intelligence cycle, and structured analytic techniques
• Demonstrated experience producing and delivering intelligence to executive and board-level audiences
• Experience directing threat intelligence platform and vendor strategy, including feed evaluation and management
• Experience partnering with detection engineering, incident response, and vulnerability management on intelligence-driven prioritization
• Strong people-leadership skills, including hiring, coaching, and performance management of analysts
• Excellent written and verbal communication skills, with the ability to translate technical findings into business risk
• Sound analytic judgment, including the ability to state and defend confidence levels under scrutiny

Preferred Skills

• Nice-to-Have Qualifications (Desired but Not Required)
• Threat Intelligence Platforms (TIPs): MISP, ThreatConnect, Anomali, Recorded Future
• Malware and sandbox analysis: VirusTotal, Any.Run, Hybrid Analysis, Joe Sandbox
• Frameworks: MITRE ATT&CK, Diamond Model, Cyber Kill Chain, Traffic Light Protocol (TLP)
• Vulnerability and exposure data: CVE/NVD, EPSS, CISA KEV catalog
• Program and reporting: KPI dashboards, ticketing/workflow tools, executive reporting templates
• Preferred Industry Experience Convenience Retail, Fuel Operations, Supply Chain