Senior Cyber Threat Intelligence Consultant

Senior Cyber Threat Intelligence Consultant
  

Join one of the leading Cyber Threat Intelligence consulting teams in the world!

Permanent, full-time position, 40 hours per week

Location: Hybrid (1-2 days per week at Canary Wharf, London), Remote or other European locations considered providing you have the appropriate Right to Work documentation for that country

About us

We are a market-leading cybersecurity company built by and for technical experts. Our mission is to protect organisations from advanced cyber threats through cutting-edge research, intelligence and technical expertise. Our services span Threat Intelligence, Managed Detection & Response (MDR), Incident Response and Research. As part of Allurity (https://allurity.com), a European powerhouse of tech-enabled cybersecurity providers, we collaborate closely with sister companies across Europe.

Our Consulting Team is one of the leading Cyber Threat Intelligence (CTI) consulting teams in the world. We are a CREST-accredited Bank of England CBEST provider, Cabinet Office GBEST provider, and have delivered over 80 TIBERs/TLPTs and 200 scheme-linked (CBEST, GBEST, STAR, STAR-FS, iCAST) or other TLPT derivatives. The team contributes research for Governments and international intelligence-sharing collectives and performs National Threat Assessments. This is a team dedicated to providing high-quality reporting at a high cadence. We are looking for a colleague who matches our capability, drive and commitment to quality.

We are seeking a Senior CTI Consultant to lead the production of accurate, high quality and timely intelligence products. The role will include support to management, peers and junior members of staff as well as clients. At least 5 years’ experience gained across all aspects of cyber threat intelligence is required. 

We make Intelligence Human!

Your new role 

This role is focused on the technical and open-source reconnaissance of entities to support red teaming which requires a technical understanding of how to simulate threat actor reconnaissance. You will work within the assessments team to generate accurate and detailed threat scenarios which are realistic and credible, to be used for emulation by Red Teams.

Your responsibilities will include: 

• Leading and supporting Consultancy Cyber Threat Intelligence Engagements across various national and international frameworks (*BEST, TIBER/TLPT, iCAST, etc)
• Setting intelligence collection requirements, as well as conducting technical and OSINT collection
• High-quality strategic report writing using standardised reporting structures
• Working under operational time pressure, self-managing tasks, meeting deadlines in support of client requirements
• Liaising with teams supporting the ThreatMatch platform to task them with specific collection efforts or support on bespoke RFI’s
• Building and maintaining relationships with partners, regulators and clients to ensure a more complete picture of the threat landscape

About you 
Essential requirements include:

• Experience of delivering assessments or other intelligence products to consumers/customers, particularly senior executives (presentations or Q&A sessions)
• Experience in managing client and partner relationships as part of large, combined threat intelligence-led activities
• Strong communicator with experience of taking complex technical findings and translating into clear business impact
• Strong presentational skills
• Previous OSINT research and short- and long-form writing experience to a specified technical writing style
• Previous direct use of CTI methodologies, e.g. investigative pivoting models, investigative frameworks, MITRE ATT&CK and the Extended Cyber Kill Chain
• A good understanding of common enterprise IT concepts, networking (DNS, TCP/IP, application layer protocols, PKI) and operating systems
• Familiarity with major cognitive bias types, and the ability to identify those cognitive biases during research
• Previous experience with competing hypothesis theory, and use of different tools to score those hypotheses
• An effective communicator able to build and maintain stakeholder relationships
• Ability to analyse, evaluate and contextualise sets of information using analytical techniques and common industry tooling
• Experience in open-source collection, use of online tools, experience querying internal databases of information in support of investigative efforts
• A high level of professionalism and focus
• Detailed understanding of the Threat Landscape, ideally with a financial services specialism

Desirable requirements:

• Experience of working on national and international frameworks for TI-led testing (*BEST, TIBER/TLPT, iCAST)
• Experience with pen testing, reconnaissance or red team engagements
• Experience of core CTI components
• Experience with tools such as Shodan, Censys, VirusTotal, WHOIS domain and netblock analysis
• Use of LLMs and other AI tools to support collection and research (awareness of their strengths and weaknesses)

Training/qualifications required:

• DIAC/DIAM/GIAC or other advanced analytical technique training
• CREST (CCTIM) or other Threat Intelligence qualifications (e.g. SANS, GIAC)
• CEH, CRT, OSCP or similar penetration testing certifications/training

We are committed to promoting equality, diversity and inclusion, and welcome applications from all suitably qualified candidates, regardless of age, sex, disability, race, ethnicity, religion or belief, sexual orientation, gender reassignment, marriage and civil partnership, or pregnancy and maternity. We are dedicated to building a diverse workforce and take steps to ensure our recruitment process is fair, accessible and inclusive.