Cyber Threat Intelligence Lead in York

Build a brilliant future with Hiscox. Hiscox is a diversified international insurance group with a powerful brand, strong balance sheet and plenty of room to grow. Listed on the London Stock Exchange and headquartered in Bermuda, Hiscox has over 3,000 staff across 14 countries and 34 offices.

The Cyber Threat Intelligence Lead is responsible for leading and maturing the organisation’s threat intelligence capability and ensuring intelligence drives security strategy, investment decisions and operational priorities across the business. Acting as the senior subject matter expert for cyber threats, the role holder will deliver strategic, operational and tactical intelligence products, provide leadership across the Cyber Fusion Centre and influence senior stakeholders across Technology and the wider business.

The role holder will contribute directly to the development and maintenance of the cyber security strategy, ensuring it remains aligned to the evolving threat landscape. They will work closely with the Head of Cyber Fusion and Chief Resilience and Security Officer to identify emerging threats, assess organisational exposure and recommend strategic improvements.

You will play a pivotal role in defending our business from cyber threats. By continuously monitoring, analysing and actioning intelligence, you will be on the front line of protecting our business assets and interests from harm. The role is based in either York (UK) or Lisbon (Portugal) and is a permanent position. Travel to other team locations will be required as necessary.

Key Responsibilities

• Lead the end-to-end threat intelligence lifecycle and maintain intelligence requirements aligned to business objectives.
• Develop and maintain strategic, operational and tactical threat intelligence products.
• Provide regular threat briefings and intelligence updates to senior leadership and executive stakeholders.
• Contribute directly to the development and evolution of the Cyber Security Strategy.
• Act as the principal cyber threat intelligence advisor to the Head of Cyber Fusion and Chief Resilience and Security Officer.
• Develop threat-led action plans and influence remediation priorities across Technology and business functions.
• Embed a threat-led approach across vulnerability management, detection engineering, threat hunting, security architecture and incident response activities.
• Assess emerging threats, adversary activity, geopolitical developments and industry trends relevant to Hiscox.
• Develop and maintain intelligence sources, including OSINT, commercial intelligence feeds, industry partnerships and government engagement.
• Support major incident response activities through threat analysis, attribution assessments and remediation guidance.
• Build relationships with external intelligence sharing communities, government agencies and industry bodies.
• Present complex intelligence findings clearly to both technical and non-technical audiences.
• Drive understanding of the threat landscape across Technology Leadership and key business stakeholders.
• Coach and develop junior threat intelligence analysts and support future team growth.
• Establish threat intelligence methodologies, standards and quality controls.

Candidate Profile

• Experienced in cyber threat intelligence, cyber security operations, government intelligence, military intelligence or law enforcement environments.
• Strong understanding of the intelligence lifecycle and threat intelligence frameworks.
• Experience producing strategic intelligence assessments and executive-level briefings.
• Experience influencing senior stakeholders and driving security improvements through intelligence-led recommendations.
• Excellent analytical, research and critical thinking skills.
• Strong knowledge of threat actor tactics, techniques and procedures (TTPs).
• Experience mentoring or developing junior analysts.
• Excellent communication, presentation and stakeholder management skills.
• Experience within financial services or other regulated industries is desirable.
• Industry recognised certifications such as GCTI, CCTIM, GCFA, GREM, GPEN or equivalent are desirable.

Desirable experience

• Threat-intelligence-led detection and IOC operationalisation.

Diversity and flexible working at Hiscox

At Hiscox we care about our people. We hire the best people for the job, and we are committed to diversity and creating a truly inclusive culture, which we believe drives success. Working life does not always have to be in the office so we have introduced hybrid working to encourage a healthy work life balance. This hybrid working model is set by the team rather than the business to enable you to manage your own personal work-life balance.