Threat Intelligence Analyst

Responsibilities

• Monitor the global threat landscape for emerging cyber threats, vulnerabilities, and threat actor activity relevant to DS Smith and the manufacturing sector
• Analyse intelligence from OSINT, commercial feeds, industry sharing platforms, and dark web monitoring tools
• Correlate external intelligence with internal security events using Microsoft Sentinel and Microsoft Defender
• Develop and maintain advanced KQL queries for threat hunting, detection engineering, and incident investigation
• Produce actionable threat intelligence reports, threat actor profiles, IoCs, and executive briefings
• Support and participate in incident response from initial triage through containment, eradication, recovery, and post-incident review
• Conduct forensic investigations and provide threat context during live security incidents
• Collaborate with SOC teams, security architects, and technology stakeholders to strengthen detection and response capabilities
• Contribute to threat models, risk assessments, playbooks, and operational processes
• Maintain awareness of evolving cyber threats, attack techniques, and trends impacting manufacturing and logistics sectors

Requirements

• Experience in cyber security, with a focus on threat intelligence, incident response, or security operations
• Proven hands-on experience managing security incidents throughout the full incident response lifecycle
• Strong understanding of cyber threats, threat actor behaviour, attack methodologies, and intelligence frameworks such as MITRE ATT&CK, the Diamond Model, and Cyber Kill Chain
• Advanced knowledge of Microsoft Sentinel, Microsoft Defender, and KQL for threat hunting and investigation
• Experience working with threat intelligence platforms and dark web monitoring solutions, such as DarkIQ or equivalent
• Strong analytical skills with the ability to identify patterns and draw meaningful conclusions from complex datasets
• Knowledge of malware analysis, phishing investigations, and infrastructure security principles
• Experience with scripting and automation using PowerShell, Python, or similar technologies
• Excellent communication skills, with the ability to translate technical findings into clear business-focused recommendations
• A collaborative approach and desire to continuously improve security capabilities across the organisation
• Relevant industry certifications such as GCTI, GTIA, SC-200, or equivalent
• Experience within manufacturing, logistics, or industrial environments
• Knowledge of OT/ICS security and threats affecting operational technology environments
• Familiarity with GDPR, NIS2, and other relevant cyber security regulations

Core Competencies

Demonstrates expertise in cyber security with a focus on threat intelligence, incident response, and security operations. Proficient in using Microsoft Sentinel, Microsoft Defender, and KQL for threat hunting and investigation, while maintaining awareness of evolving cyber threats and attack methodologies.

Highest-signal resume keywords

• Cyber Security Experience
• Threat Intelligence Analysis
• Incident Response Management
• Microsoft Sentinel Proficiency
• KQL Query Development

Hard Skills

• Threat Intelligence
• Incident Response
• KQL
• Malware Analysis
• Phishing Investigation
• Scripting
• Automation
• Data Analysis
• Cyber Threat Frameworks
• Forensic Investigation

Soft Skills

• Analytical Skills
• Communication Skills
• Collaboration
• Problem-Solving
• Continuous Improvement

Certifications & Qualifications

• GCTI
• GTIA
• SC-200

Industry Keywords

• Manufacturing
• Logistics
• Operational Technology
• ICS Security
• GDPR
• NIS2

Tools & Technologies

• Microsoft Sentinel
• Microsoft Defender
• DarkIQ
• Threat Intelligence Platforms
• OSINT Tools
• Dark Web Monitoring Tools