Senior Threat Intelligence Analyst in Birmingham

UK Security Practice | Birmingham / UK-based with flexible remote working | Specialist and team lead

Role summary

The Senior Threat Intelligence Analyst leads the delivery of high-quality cyber threat intelligence for clients and the NTT DATA UK Security Practice. The role combines hands‑on analysis with day-to-day leadership of threat intelligence analysts, setting priorities, assuring analytical quality, developing team capability and translating intelligence into decisions across security operations, incident response, threat hunting, vulnerability management and risk leadership.

The postholder operates with substantial autonomy, manages complex assignments, influences technical and non-technical stakeholders, and is accountable for the quality, timeliness, legality and ethical integrity of intelligence outputs.

What you'll be doing;

Team leadership and delivery management

• Lead, allocate and coordinate the work of a threat intelligence team; set clear objectives, priorities, quality expectations and delivery deadlines.
• Provide technical supervision, peer review and escalation support while enabling analysts to exercise appropriate autonomy and judgement.
• Coach and mentor team members through structured feedback, knowledge sharing, skills development plans and support for professional certification.
• Manage workload, service risks, dependencies and competing client priorities; elevate material issues with clear options and recommendations.
• Establish and monitor delivery standards, analytical tradecraft, source handling, quality assurance and reusable intelligence processes.
• Act as deputy or workstream lead when required, representing the capability in client, operational and leadership forums.

Threat intelligence direction, collection and analysis

• Define and maintain priority intelligence requirements and collection plans aligned to client assets, business exposure, threat scenarios and decision needs.
• Direct and conduct research across OSINT, commercial and government feeds, technical telemetry, malware reporting, trusted sharing communities, underground sources and other lawful intelligence sources.
• Analyse threat actors, campaigns, malware, infrastructure, indicators of compromise and tactics, techniques and procedures using structured analytical techniques.
• Assess source reliability, information credibility, confidence and intelligence gaps; distinguish verified reporting from analytical judgement.
• Produce strategic, operational and tactical intelligence explaining relevance, likely impact and recommended action rather than simply reproducing threat data.
• Maintain awareness of geopolitical, sector, regulatory and technology developments affecting UK and international clients.

Intelligence production and stakeholder influence

• Own and assure executive threat briefs, campaign assessments, actor profiles, vulnerability intelligence, sector reports and incident intelligence packages.
• Brief senior leaders, clients, SOC teams, incident responders, detection engineers, vulnerability teams and risk stakeholders using language appropriate to each audience.
• Present defensible conclusions, confidence levels, assumptions, intelligence gaps and recommended actions; respond constructively to challenge and alternative hypotheses.
• Build trusted relationships with internal teams, clients, government bodies, industry groups and intelligence-sharing communities while protecting sensitive sources and information.

Operational integration and capability improvement

• Integrate intelligence into SIEM, SOAR, TIP, threat hunting, detection engineering, incident response and vulnerability prioritisation workflows.
• Guide the use of MITRE ATT&CK, STIX/TAXII, the intelligence cycle, Diamond Model and suitable analytical techniques.
• Develop and quality‑assure correlation rules, watchlists, enrichment logic, automation and playbooks, with controls to limit false positives and unmanaged operational impact.
• Use lessons learned, stakeholder feedback and measurable outcomes to improve collection, analysis, dissemination and intelligence‑led decisions.
• Support service development, proposals, client workshops and the evolution of NTT DATA threat intelligence methods and offerings.

What you'll bring;

• 3-5 years practical experience delivering cyber threat intelligence, including complex assessments and review of other analysts’ work.
• Demonstrable experience leading, coordinating or technically supervising a team, workstream or intelligence function and managing delivery through others.
• Strong knowledge of the intelligence cycle, structured analytical techniques, collection management, source evaluation, threat actor analysis and intelligence reporting.
• Deep working knowledge of MITRE ATT&CK and platforms such as MISP, ThreatConnect, Anomali or equivalent; practical experience of SIEM, SOAR and security operations integration.
• Ability to analyse malicious infrastructure, IOCs, malware reporting and TTPs, and explain how intelligence should change detection, response, hunting, vulnerability or risk decisions.
• Good understanding of OSINT and dark‑web research, including legal, ethical, operational‑security and source‑protection considerations.
• Working capability in scripting or automation, preferably Python or PowerShell, and confidence working with APIs and structured intelligence formats.
• Excellent written and verbal communication, including executive briefing, client engagement, analytical review and constructive challenge.

Professional qualifications and development

Candidates should demonstrate knowledge and practical capability broadly consistent with CREST Registered Threat Intelligence Analyst level. Equivalent evidence from recognised training, certification and relevant operational experience will also be considered.

• Preferred: CREST Registered Threat Intelligence Analyst (CRTIA).
• Relevant alternatives or complementary qualifications include GIAC Cyber Threat Intelligence (GCTI), supported by SANS FOR578, or other advanced threat intelligence, incident response, malware analysis, OSINT or security operations credentials.
• Must meet eligibility requirements for UK Security Check clearance.

#J-18808-Ljbffr