Threat Team Lead

About the role

Key responsibilities

• Set the strategic roadmap for threat intelligence and hunting capabilities, aligned with organisational risk appetite and resilience goals.
• Lead threat intelligence and hunting across IT and OT; oversee collection, analysis, and dissemination of actionable intelligence.
• Hunt for indicators of compromise and adversary techniques, and coordinate timely escalation of threat incidents.
• Improve threat management processes and ensure alignment with industry practices and regulatory requirements.
• Develop dashboards and reports, track effectiveness KPIs, and improve detection and response.
• Integrate intelligence into SOC workflows and automation, working with detection engineers, SOC analysts, and ICT teams.
• Lead, mentor, and manage Threat Analysts; drive continuous improvement through automation and advanced analytics.
• Ensure data protection, confidentiality, and security standards are maintained.

Essential qualifications and experience

• Degree or equivalent experience in a relevant field such as cyber security, computer science, or digital forensics.
• Proven experience in threat intelligence, threat hunting, or advanced SOC operations.
• Strong knowledge of adversary tactics, techniques, and procedures and frameworks such as MITRE ATT&CK.
• Experience managing and developing technical teams in threat analysis.
• Knowledge of frameworks such as GDPR or the NIS Directive and standards such as NCSC CAF.
• Experience automating threat analysis and hunting processes.

Essential skills

• Strong analytical, problem-solving, and decision-making skills.
• Strong communication and stakeholder engagement, including explaining technical threats to technical and non-technical audiences and senior management.

Desirable qualifications and experience

• Professional certifications such as GPEN, GCTI, CISSP, or CISM, or equivalent.
• Experience with threat intelligence platforms and SIEM/SOAR integration; familiarity with cloud threat detection and hybrid environments.
• Knowledge of malware analysis and reverse engineering, scripting in Python or PowerShell, or experience in regulated nuclear, defence, or critical-infrastructure environments.

Benefits

• Benefits include an annual bonus of up to 15%, a defined contribution pension with company matching, and 30 days of annual leave plus bank holidays.
• The advert describes training and development opportunities.