Cyber Threat Intelligence (CTI) Analyst with Vulnerability Assessment and Vulnerability Management Responsibility

This is a pivotal Cyber Threat Intelligence role within a 24x7x365 CSOC. You will deliver targeted, customer-relevant threats and vulnerability intelligence that enables timely defensive decisions and strengthens cyber resilience.

Your mission is to turn relevant internal and external developments into customer-specific defensive advantage:

• Customer and Sector Context: Maintain an informed view of customer environments, critical services, technologies, and sector threat conditions.
• Adversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer.
• Threat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities.
• Vulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure.
• CSOC Integration: Ensure intelligence supports detection, hunting, incident handling, and operational decision-making.
• Preventive Outcomes: Inform proportionate vulnerability treatment and risk reduction through established VA/VM and service-management processes.

Key Responsibilities:

A. Customer → Sector → Adversary Intelligence (Targeted CTI Delivery)

• Build and maintain customer and sector intelligence profiles covering relevant threats, attack paths, critical technologies, and exposure.
• Produce strategic, operational, and tactical intelligence that informs defensive decisions, detections, hunts, and readiness.
• Deliver timely, evidence-led outputs with clear confidence assessments and proportionate actions.
• Identify and analyse relevant threat actors, campaigns, malware, and infrastructure.

B. Threat Behaviour and Defensive Relevance

• Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities.
• Maintain structured analysis that supports early warning, prioritisation and repeatable operational use.

C. Exploit and Vulnerability Intelligence (VA/VM)

• Deliver exploit-informed vulnerability intelligence, assessing technical severity, exploitation potential, credible attack paths and service or data impact.
• Evaluate evidence of exploitation, relevant threat interest, available exploit capability, customer exposure, existing controls, and operational impact.
• Analyse root cause, exploitation mechanics, chaining opportunities, and attacker workflow where required to support defensible decisions.

D. Zero-day Response and Vulnerability Management

• Lead monitoring and rapid advice for zero-day and emerging vulnerabilities, defining customer impact, priority, and proportionate defensive recommendations.
• Support vulnerability actions through established governance and service management processes, maintaining accountability and traceability.
• Contribute to Vulnerability Management Working Groups through agendas, actions, management information, and trend analysis.

E. Operationalisation into the CSOC Toolchain (Detection & Automation)

• Collect and assess intelligence from approved open, commercial, internal and specialist sources, applying relevance and quality controls.
• Manage indicators and intelligence through their lifecycle, including confidence, attribution, review, and false-positive reduction.
• Enable effective use of curated intelligence within approved CSOC platforms, including Microsoft Sentinel and Microsoft Defender where appropriate.
• Partner with detection, engineering and automation colleagues using structured sharing, STIX/TAXII 2.x, APIs, webhooks and Logic Apps/playbooks where applicable.

F. Customer Engagement & Reporting (Trusted Advisor, No Alarmism)

• Produce customer-ready executive and technical intelligence products covering threats, campaigns, and vulnerabilities.
• Explain risk, impact, confidence, and required decisions clearly to leadership, operational and engineering audiences.
• Work calmly under pressure, handling challenging discussions with diplomacy and sound professional judgement.

G. Service Maturity & Differentiation

• Sustain consistent, efficient, and customer-relevant CTI delivery across multi-customer MSSP operations, with appropriate data separation and prioritisation.
• Identify opportunities that shorten time to action, support automation and strengthen measurable cyber resilience.

Measures of Success:

Within 3-6 months, you will have:

• Established reliable customer and sector intelligence baselines.
• Delivered vulnerability intelligence that informs remediation priorities and reduces material exposure.
• Embedded relevant CTI into detection, hunting, enrichment, and vulnerability-management activity.
• Produced consistent, high-quality intelligence that enables timely customer action.

Ongoing, success will be demonstrated through:

• Timely and effective responses to exploited or high-likelihood vulnerabilities.
• Defensive coverage and detection or hunting outcomes informed by CTI.
• Intelligence outputs that lead to tracked defensive or risk-reduction actions.
• Clear, proportionate advice that sustains customer trust without unnecessary alarmism.
• Automation-ready workflows, playbook steps, and integration pathways that reduce time to action.

Essential Experience and Technical Capability:

• Proven CTI delivery experience in a SOC or CSOC, with demonstrable operational outcomes.
• Ability to translate intelligence into clear defensive actions and decisions.
• Strong technical understanding of vulnerabilities, exploitation concepts, chaining, credible attack paths and business or service impact.
• Experience producing customer-specific exposure assessments and proportionate remediation priorities.
• Experience supporting rapid responses to zero-day or emerging vulnerability events across multiple stakeholders.
• Experience using vulnerability assessment or management tools, such as Microsoft Defender Vulnerability Management or Nessus, and interpreting results for decisionmakers.

Benefits:

• Contributory Pension Scheme
• Private Medical Insurance
• 33 days Annual Leave (including public and privilege holidays)
• Access to Flexible benefits (including life assurance, health schemes, gym memberships, annual buy and sell holidays and a cycle to work scheme)
• Flexi-Time