Cyber Threat Intelligence Consultant

Cyber Threat Intelligence Consultant

Join one of the leading Cyber Threat Intelligence consulting teams in the world!

Permanent, full-time position, 40 hours per week

Location: Hybrid (1-2 days per week at Canary Wharf, London), Remote or other European locations considered providing you have the appropriate Right to Work documentation for that country

About us

We are a market-leading cybersecurity company built by and for technical experts. Our mission is to protect organisations from advanced cyber threats through cutting-edge research, intelligence and technical expertise. Our services span Threat Intelligence, Managed Detection & Response (MDR), Incident Response and Research. As part of Allurity (https://allurity.com), a European powerhouse of tech-enabled cybersecurity providers, we collaborate closely with sister companies across Europe.

Our Consulting Team is one of the leading Cyber Threat Intelligence (CTI) consulting teams in the world. We are a CREST-accredited Bank of England CBEST provider, Cabinet Office GBEST provider, and have delivered over 80 TIBERs/TLPTs and 200 scheme-linked (CBEST, GBEST, STAR, STAR-FS, iCAST) or other TLPT derivatives. The team contributes research for Governments and international intelligence-sharing collectives and performs National Threat Assessments. This is a team dedicated to providing high-quality reporting at a high cadence. We are looking for a colleague who matches our capability, drive and commitment to quality.

We are seeking a CTI Consultant to support the production of accurate, high quality and timely intelligence products. The role will include support to management, peers and junior members of staff as well as clients. At least 3 years’ experience gained across all aspects of cyber threat intelligence is required. 

We make Intelligence Human!

Your new role 

This role is focused on the technical and open-source reconnaissance of entities to support red teaming which requires a technical understanding of how to simulate threat actor reconnaissance. You will support the assessments team to generate accurate and detailed threat scenarios which are realistic and credible, to be used for emulation by Red Teams.

Your responsibilities will include: 

• Supporting Consultancy Cyber Threat Intelligence Engagements across various national and international frameworks (*BEST, TIBER/TLPT, iCAST, etc)
• Following intelligence collection requirements, conducting technical and OSINT collection
• High-quality strategic report writing using standardised reporting structures
• Working under operational time pressure, self-managing tasks, meeting deadlines in support of client requirements
• Liaising with teams supporting the ThreatMatch platform to task them with specific collection efforts or support on bespoke RFI’s

About you 
Essential requirements include:

• Previous OSINT research and short- and long-form writing experience to a specified technical writing style.
• Previous direct use of CTI methodologies, e.g. investigative pivoting models, investigative frameworks, MITRE ATT&CK and the Extended Cyber Kill Chain.
• A good understanding of common enterprise IT concepts, networking (DNS, TCP/IP, application layer protocols, PKI) and operating systems
• Familiarity with major cognitive bias types, and the ability to identify those cognitive biases during research
• Previous experience with competing hypothesis theory, and use of different tools to score those hypotheses
• An effective communicator able to build and maintain stakeholder relationships
• Ability to analyse, evaluate and contextualise sets of information using analytical techniques and common industry tooling
• A high level of professionalism and focus
• Detailed understanding of the Threat Landscape, ideally with a financial services specialism

Desirable requirements:

• Experience of working on national and international frameworks for TI-led testing (*BEST, TIBER/TLPT, iCAST)
• Experience with pen testing, reconnaissance or red team engagements
• Experience of core CTI components
• Experience with tools such as Shodan, Censys, VirusTotal, WHOIS domain and netblock analysis
• Strong communicator with experience of taking complex technical findings and translating into clear business impact.
• Strong presentational skills
• Use of LLMs and other AI tools to support collection and research (awareness of their strengths and weaknesses)

Training/qualifications desired:

• DIAC/DIAM/GIAC or other advanced analytical technique training
• CREST (CRTIA) or other Threat Intelligence qualifications (e.g. SANS, GIAC)
• CEH, CRT, OSCP or similar penetration testing certifications/training

We are committed to promoting equality, diversity and inclusion, and welcome applications from all suitably qualified candidates, regardless of age, sex, disability, race, ethnicity, religion or belief, sexual orientation, gender reassignment, marriage and civil partnership, or pregnancy and maternity. We are dedicated to building a diverse workforce and take steps to ensure our recruitment process is fair, accessible and inclusive.