Cyber Threat Intelligence Analyst

Cyber Threat Intelligence (CTI) Analyst with Vulnerability Assessment and Vulnerability Management Responsibility

Location:

Farnborough

Clearance - SC to start, DV for role

Everything we do is built on a commitment to do the right thing for our customers, our people and our community. Our mission and our values guide the way we do business. The foundations of our Leidos culture are our Values, Beliefs and Expectations by which we select, recognise and reward employees. They create the environment that drives us toward our mission.

Your role and responsibilities:

This is a pivotal Cyber Threat Intelligence role within a 24x7x365 CSOC. You will deliver targeted, customer-relevant threats and vulnerability intelligence that enables timely defensive decisions and strengthens cyber resilience. You will convert customer, sector, adversary, and vulnerability intelligence into clear priorities for detection, threat hunting, incident readiness, and remediation.

The role focuses on:

• Exploit-prevention-led intelligence that helps reduce credible attack paths before impact.
• Rapid, proportionate response to zero-day and emerging vulnerability events.
• Translation of geopolitical, sector and technical developments into customer-relevant cyber risk and action.

2) Intelligence Delivery Approach

Your mission is to turn relevant internal and external developments into customer-specific defensive advantage:

• Customer and Sector Context:
  Maintain an informed view of customer environments, critical services, technologies, and sector threat conditions.
• Adversary Relevance:
  Assess the actors, motivations, campaigns, and outcomes most relevant to each customer.
• Threat Behaviour:
  Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities.
• Vulnerability Intelligence:
  Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure.
• CSOC Integration:
  Ensure intelligence supports detection, hunting, incident handling, and operational decision-making.
• Preventive Outcomes:
  Inform proportionate vulnerability treatment and risk reduction through established VA/VM and service-management processes.

3)

Key Responsibilities (Outcome-led)
A. Customer ->
Sector ->
Adversary Intelligence (Targeted CTI Delivery)

• Build and maintain customer and sector intelligence profiles covering relevant threats, attack paths, critical technologies, and exposure.
• Produce strategic, operational, and tactical intelligence that informs defensive decisions, detections, hunts, and readiness.
• Deliver timely, evidence-led outputs with clear confidence assessments and proportionate actions.
• Identify and analyse relevant threat actors, campaigns, malware, and infrastructure.

B. Threat Behaviour and Defensive Relevance

• Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities.
• Maintain structured analysis that supports early warning, prioritisation and repeatable operational use.

C. Exploit and Vulnerability Intelligence (VA/VM)

• Deliver exploit-informed vulnerability intelligence, assessing technical severity, exploitation potential, credible attack paths and service or data impact.
• Evaluate evidence of exploitation, relevant threat interest, available exploit capability, customer exposure, existing controls, and operational impact.
• Analyse root cause, exploitation mechanics, chaining opportunities, and attacker workflow where required to support defensible decisions.

D. Zero-day Response and Vulnerability Management

• Lead monitoring and rapid advice for zero-day and emerging vulnerabilities, defining customer impact, priority, and proportionate defensive recommendations.
• Support vulnerability actions through established…