Threat Intelligence Lead

Threat Intelligence Lead Overview

This senior role is responsible for building and leading the company’s threat intelligence capability from the ground up. It sits at the centre of the security organisation and combines strategy ownership with hands-on technical work. The successful person will define how threat intelligence is planned and delivered, develop the threat hunting programme, support incident response with timely intelligence, and work closely with the SOC, Product Security, and other security teams. The role also involves presenting findings and programme updates to senior leadership, including CISO-level stakeholders.

What you will do

• Establish and run the threat intelligence function, including the overall strategy, the operating model, and the full intelligence lifecycle covering planning, collection, processing, analysis, dissemination, and feedback.
• Set the regular cadence for threat intelligence activity across the security organisation and ensure the function is aligned with business and security priorities.
• Manage threat intelligence platforms and tools, and connect them with the SOC, Product Security, and other existing security solutions so intelligence can be used effectively across teams.
• Design, develop, and mature the threat hunting programme by creating hunt methodologies, playbooks, and hypotheses that can be used by Security Operations and the wider security organisation.
• Carry out threat hunts from start to finish, using a structured and hypothesis-driven approach to identify relevant threats and turn findings into practical detections.
• Act as the main threat intelligence partner during active incidents, researching adversary techniques, campaigns, indicators of compromise, and attribution to help the incident response team make triage and containment decisions.
• Perform in-depth research on threat actors, campaigns, and emerging risks that are relevant to the company’s threat landscape, and produce intelligence outputs suitable for both technical teams and executive audiences.
• Build and maintain integrations between threat intelligence platforms and security tooling such as SIEM, SOAR, and EDR/XDR, using scripting and engineering skills to automate collection, enrichment, and sharing workflows.
• Create, contribute to, and validate detection content, including SIEM queries, hunt logic, and custom detection rules, ensuring the content is informed by current intelligence and mapped to MITRE ATT&CK.
• Communicate intelligence findings, programme maturity updates, and emerging risk briefings clearly and confidently to senior stakeholders, including executive leadership and the CISO.

What the company is looking for

• A strong understanding of how an effective threat intelligence capability operates, including the intelligence lifecycle, the day-to-day rhythm of the function, and the ways TI adds value across a security organisation.
• Hands-on experience with both commercial and open-source threat intelligence platforms and tools, especially those used for aggregation, enrichment, and sharing.
• Substantial threat hunting experience, including the ability to design and execute structured hunts based on hypotheses and frameworks such as MITRE ATT&CK, and to translate results into actionable detections.
• Practical experience supporting incident response with threat intelligence, including researching attacker tradecraft, attribution, and indicators of compromise under time pressure alongside an IR team.
• Engineering and scripting skills that can be used to build integrations, automate threat intelligence workflows, and develop or improve hunt tooling.
• Experience writing detection content, including SIEM queries and custom detection rule formats.
• Working knowledge of SIEM, SOAR, and EDR/XDR platforms, and an understanding of how threat intelligence enhances those capabilities.
• The ability to explain complex intelligence clearly and confidently to senior and executive audiences, including CISO-level stakeholders, while tailoring the level of technical detail to the audience.
• A solid understanding of adversary behaviour, threat actor groups, and the evolving threat landscape affecting SaaS and enterprise environments.

Team and culture

The organisation describes itself as a team of innovators helping customers improve business decision-making through an AI-infused scenario planning and analysis platform. It says its customers include many well-known global companies and that its culture is built around customer success, diversity of thought, leadership at every level, ambitious goals, and celebrating wins of all sizes. The company also says it follows operating principles that are strategy-led, values-based, and disciplined in execution, and that employees should expect to be inspired, connected, developed, and rewarded.

The company states that it welcomes people from all backgrounds and identities and is committed to an inclusive workplace where everyone is respected and valued. It also says reasonable accommodation will be provided for candidates and employees with disabilities during the application process, interviews, and the performance of essential job functions.

How to apply

Applications are submitted through the online application form. The form requests standard candidate details such as name, contact information, resume or CV, LinkedIn profile, and referral source. It also includes questions about whether the applicant is legally authorised to work in the country of employment and whether they will need visa sponsorship now or in the future.

Additional notice

The company warns applicants about fraudulent recruitment activity and says it does not make offers without a thorough interview process involving recruitment and hiring managers, does not send job offers by email, and uses only official @anaplan.com email addresses. If someone has doubts about the authenticity of a communication claiming to be from the company, they are asked to contact [email protected] before taking further action.

The application also includes voluntary self-identification forms for equal employment opportunity reporting, including gender, ethnicity, veteran status, and disability status. Completion of these forms is optional and does not affect hiring decisions.

Degree Requirement: Not Specified

Visa Sponsorship May be