# Cyber Threat Intelligence (CTI) Analyst with Vulnerability Assessment and Vulnerability Management Responsibility **Company**: Leidos **Location**: Farnborough, Hampshire **Work arrangement**: onsite **Experience**: senior **Job type**: full-time **Category**: Defence & Intelligence **Industry**: Aerospace & Defence **Apply**: https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Farnborough-Hampshire-UK/Cyber-Threat-Intelligence-Analyst_R-00196382?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/job/cyber-threat-intelligence-cti-analyst-with-b158dbc5-92c/ ## Description This is a pivotal Cyber Threat Intelligence role within a 24x7x365 CSOC. You will deliver targeted, customer-relevant threats and vulnerability intelligence that enables timely defensive decisions and strengthens cyber resilience. Your mission is to turn relevant internal and external developments into customer-specific defensive advantage: - Customer and Sector Context: Maintain an informed view of customer environments, critical services, technologies, and sector threat conditions. - Adversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer. - Threat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities. - Vulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure. - CSOC Integration: Ensure intelligence supports detection, hunting, incident handling, and operational decision-making. - Preventive Outcomes: Inform proportionate vulnerability treatment and risk reduction through established VA/VM and service-management processes. Key Responsibilities: A. Customer → Sector → Adversary Intelligence (Targeted CTI Delivery) - Build and maintain customer and sector intelligence profiles covering relevant threats, attack paths, critical technologies, and exposure. - Produce strategic, operational, and tactical intelligence that informs defensive decisions, detections, hunts, and readiness. - Deliver timely, evidence-led outputs with clear confidence assessments and proportionate actions. - Identify and analyse relevant threat actors, campaigns, malware, and infrastructure. B. Threat Behaviour and Defensive Relevance - Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities. - Maintain structured analysis that supports early warning, prioritisation and repeatable operational use. C. Exploit and Vulnerability Intelligence (VA/VM) - Deliver exploit-informed vulnerability intelligence, assessing technical severity, exploitation potential, credible attack paths and service or data impact. - Evaluate evidence of exploitation, relevant threat interest, available exploit capability, customer exposure, existing controls, and operational impact. - Analyse root cause, exploitation mechanics, chaining opportunities, and attacker workflow where required to support defensible decisions. D. Zero-day Response and Vulnerability Management - Lead monitoring and rapid advice for zero-day and emerging vulnerabilities, defining customer impact, priority, and proportionate defensive recommendations. - Support vulnerability actions through established governance and service management processes, maintaining accountability and traceability. - Contribute to Vulnerability Management Working Groups through agendas, actions, management information, and trend analysis. E. Operationalisation into the CSOC Toolchain (Detection & Automation) - Collect and assess intelligence from approved open, commercial, internal and specialist sources, applying relevance and quality controls. - Manage indicators and intelligence through their lifecycle, including confidence, attribution, review, and false-positive reduction. - Enable effective use of curated intelligence within approved CSOC platforms, including Microsoft Sentinel and Microsoft Defender where appropriate. - Partner with detection, engineering and automation colleagues using structured sharing, STIX/TAXII 2.x, APIs, webhooks and Logic Apps/playbooks where applicable. F. Customer Engagement & Reporting (Trusted Advisor, No Alarmism) - Produce customer-ready executive and technical intelligence products covering threats, campaigns, and vulnerabilities. - Explain risk, impact, confidence, and required decisions clearly to leadership, operational and engineering audiences. - Work calmly under pressure, handling challenging discussions with diplomacy and sound professional judgement. G. Service Maturity & Differentiation - Sustain consistent, efficient, and customer-relevant CTI delivery across multi-customer MSSP operations, with appropriate data separation and prioritisation. - Identify opportunities that shorten time to action, support automation and strengthen measurable cyber resilience. Measures of Success: Within 3-6 months, you will have: - Established reliable customer and sector intelligence baselines. - Delivered vulnerability intelligence that informs remediation priorities and reduces material exposure. - Embedded relevant CTI into detection, hunting, enrichment, and vulnerability-management activity. - Produced consistent, high-quality intelligence that enables timely customer action. Ongoing, success will be demonstrated through: - Timely and effective responses to exploited or high-likelihood vulnerabilities. - Defensive coverage and detection or hunting outcomes informed by CTI. - Intelligence outputs that lead to tracked defensive or risk-reduction actions. - Clear, proportionate advice that sustains customer trust without unnecessary alarmism. - Automation-ready workflows, playbook steps, and integration pathways that reduce time to action. Essential Experience and Technical Capability: - Proven CTI delivery experience in a SOC or CSOC, with demonstrable operational outcomes. - Ability to translate intelligence into clear defensive actions and decisions. - Strong technical understanding of vulnerabilities, exploitation concepts, chaining, credible attack paths and business or service impact. - Experience producing customer-specific exposure assessments and proportionate remediation priorities. - Experience supporting rapid responses to zero-day or emerging vulnerability events across multiple stakeholders. - Experience using vulnerability assessment or management tools, such as Microsoft Defender Vulnerability Management or Nessus, and interpreting results for decisionmakers. Benefits: - Contributory Pension Scheme - Private Medical Insurance - 33 days Annual Leave (including public and privilege holidays) - Access to Flexible benefits (including life assurance, health schemes, gym memberships, annual buy and sell holidays and a cycle to work scheme) - Flexi-Time For more fresh new jobs, check out [yubhub.co](https://yubhub.co/). ## Skills ### Required - CTI - Vulnerability Assessment - Vulnerability Management - MITRE ATT&CK - Threat Intelligence - Cyber Threat Intelligence ### Nice to have - CTI or VM experience in UK Government, MOD, CNI or another high-assurance environment - Experience in multi-tenant or MSSP operations and data-segregation requirements - Experience with CTI platforms supporting correlation, analytics, or campaign reconstruction - Experience building or using MISP --- Source: [Apply at leidos.wd5.myworkdayjobs.com](https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Farnborough-Hampshire-UK/Cyber-Threat-Intelligence-Analyst_R-00196382?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)