Senior Threat Intelligence Analyst

The Senior Threat Intelligence Analyst leads the delivery of high-quality cyber threat intelligence for clients and the NTT DATA UK Security Practice. The role combines hands-on analysis with day-to-day leadership of threat intelligence analysts, setting priorities, assuring analytical quality, developing team capability and translating intelligence into decisions across security operations, incident response, threat hunting, vulnerability management and risk leadership.

The postholder operates with substantial autonomy, manages complex assignments, influences technical and non-technical stakeholders, and is accountable for the quality, timeliness, legality and ethical integrity of intelligence outputs.

What you'll be doing:

• Team leadership and delivery management
  • Lead, allocate and coordinate the work of a threat intelligence team; set clear objectives, priorities, quality expectations and delivery deadlines.
  • Provide technical supervision, peer review and escalation support while enabling analysts to exercise appropriate autonomy and judgement.
  • Coach and mentor team members through structured feedback, knowledge sharing, skills development plans and support for professional certification.
  • Manage workload, service risks, dependencies and competing client priorities; escalate material issues with clear options and recommendations.
  • Establish and monitor delivery standards, analytical tradecraft, source handling, quality assurance and reusable intelligence processes.
  • Act as deputy or workstream lead when required, representing the capability in client, operational and leadership forums.
• Threat intelligence direction, collection and analysis
  • Define and maintain priority intelligence requirements and collection plans aligned to client assets, business exposure, threat scenarios and decision needs.
  • Direct and conduct research across OSINT, commercial and government feeds, technical telemetry, malware reporting, trusted sharing communities, underground sources and other lawful intelligence sources.
  • Analyse threat actors, campaigns, malware, infrastructure, indicators of compromise and tactics, techniques and procedures using structured analytical techniques.
  • Assess source reliability, information credibility, confidence and intelligence gaps; distinguish verified reporting from analytical judgement.
  • Produce strategic, operational and tactical intelligence explaining relevance, likely impact and recommended action rather than simply reproducing threat data.
  • Maintain awareness of geopolitical, sector, regulatory and technology developments affecting UK and international clients.
• Intelligence production and stakeholder influence
  • Own and assure executive threat briefs, campaign assessments, actor profiles, vulnerability intelligence, sector reports and incident intelligence packages.
  • Brief senior leaders, clients, SOC teams, incident responders, detection engineers, vulnerability teams and risk stakeholders using language appropriate to each audience.
  • Present defensible conclusions, confidence levels, assumptions, intelligence gaps and recommended actions; respond constructively to challenge and alternative hypotheses.
  • Build trusted relationships with internal teams, clients, government bodies, industry groups and intelligence-sharing communities while protecting sensitive sources and information.
• Operational integration and capability improvement
  • Integrate intelligence into SIEM, SOAR, TIP, threat hunting, detection engineering, incident response and vulnerability prioritisation workflows.
  • Guide the use of MITRE ATT&CK, STIX/TAXII, the intelligence cycle, Diamond Model and suitable analytical techniques.
  • Develop and quality-assure correlation rules, watchlists, enrichment logic, automation and playbooks, with controls to limit false positives and unmanaged operational impact.
  • Use lessons learned, stakeholder feedback and measurable outcomes to improve collection, analysis, dissemination and intelligence-led decisions.
  • Support service development, proposals, client workshops and the evolution of NTT DATA threat intelligence methods and offerings.

What experience you'll bring:

• 3-5 years practical experience delivering cyber threat intelligence, including complex assessments and review of other analysts’ work.
• Demonstrable experience leading, coordinating or technically supervising a team, workstream or intelligence function and managing delivery through others.
• Strong knowledge of the intelligence cycle, structured analytical techniques, collection management, source evaluation, threat actor analysis and intelligence reporting.
• Deep working knowledge of MITRE ATT&CK and platforms such as MISP, ThreatConnect, Anomali or equivalent; practical experience of SIEM, SOAR and security operations integration.
• Ability to analyse malicious infrastructure, IOCs, malware reporting and TTPs, and explain how intelligence should change detection, response, hunting, vulnerability or risk decisions.
• Good understanding of OSINT and dark-web research, including legal, ethical, operational-security and source-protection considerations.
• Working capability in scripting or automation, preferably Python or PowerShell, and confidence working with APIs and structured intelligence formats.
• Excellent written and verbal communication, including executive briefing, client engagement, analytical review and constructive challenge.

Professional qualifications and development

• Candidates should demonstrate knowledge and practical capability broadly consistent with CREST Registered Threat Intelligence Analyst level. Equivalent evidence from recognised training, certification and relevant operational experience will also be considered.
• Preferred: CREST Registered Threat Intelligence Analyst (CRTIA).
• Relevant alternatives or complementary qualifications include GIAC Cyber Threat Intelligence (GCTI), supported by SANS FOR578, or other advanced threat intelligence, incident response, malware analysis, OSINT or security operations credentials.
• Must meet eligibility requirements for UK Security Check clearance.

Who we are:

At NTT DATA, you have endless opportunities to think big, act bold and take ownership. As a $30+ billion business and technology services, AI and digital infrastructure leader, we co-innovate solutions with clients and partners globally for business and societal impact. Serving 75% of the Fortune Global 100, with experts in over 70 countries, we encourage experimentation and recognise great work. Proudly a Global Top Employer, NTT DATA is part of NTT Group, which invests over $3 billion annually in R&D. Make this the place where you belong, learn, and build your network. Make this the place where you grow.

What we'll offer you:

We offer a range of tailored benefits that support your physical, emotional, and financial wellbeing. Our Learning and Development team ensure that there are continuous growth and development opportunities for our people. We also offer the opportunity to have flexible work options.

We are an equal opportunities employer. We believe in the fair treatment of all our employees and commit to promoting equity and diversity in our employment practices. We are committed to creating a diverse and inclusive workforce. We actively collaborate with individuals who have disabilities and long-term health conditions which have an effect on their ability to do normal daily activities, ensuring that barriers are eliminated when it comes to employment opportunities. In line with our commitment, we guarantee an interview to applicants who declare to us, during the application process, that they have a disability and meet the minimum requirements for the role. If you require any reasonable adjustments during the recruitment process, please let us know. Join us in building a truly diverse and empowered team.