Team leadership and delivery management

• Lead, allocate and coordinate the work of a threat intelligence team; set clear objectives, priorities, quality expectations and delivery deadlines.
• Provide technical supervision, peer review and escalation support while enabling analysts to exercise appropriate autonomy and judgement.
• Coach and mentor team members through structured feedback, knowledge sharing, skills development plans and support for professional certification.
• Manage workload, service risks, dependencies and competing client priorities; escalate material issues with clear options and recommendations.
• Establish and monitor delivery standards, analytical tradecraft, source handling, quality assurance and reusable intelligence processes.
• Act as deputy or workstream lead when required, representing the capability in client, operational and leadership forums.

Threat intelligence direction, collection and analysis

• Define and maintain priority intelligence requirements and collection plans aligned to client assets, business exposure, threat scenarios and decision needs.
• Direct and conduct research across OSINT, commercial and government feeds, technical telemetry, malware reporting, trusted sharing communities, underground sources and other lawful intelligence sources.
• Analyse threat actors, campaigns, malware, infrastructure, indicators of compromise and tactics, techniques and procedures using structured analytical techniques.
• Assess source reliability, information credibility, confidence and intelligence gaps; distinguish verified reporting from analytical judgement.
• Produce strategic, operational and tactical intelligence explaining relevance, likely impact and recommended action rather than simply reproducing threat data.
• Maintain awareness of geopolitical, sector, regulatory and technology developments affecting UK and international clients.

Intelligence production and stakeholder influence

• Own and assure executive threat briefs, campaign assessments, actor profiles, vulnerability intelligence, sector reports and incident intelligence packages.
• Brief senior leaders, clients, SOC teams, incident responders, detection engineers, vulnerability teams and risk stakeholders using language appropriate to each audience.
• Present defensible conclusions, confidence levels, assumptions, intelligence gaps and recommended actions; respond constructively to challenge and alternative hypotheses.
• Build trusted relationships with internal teams, clients, government bodies, industry groups and intelligence-sharing communities while protecting sensitive sources and information.

Operational integration and capability improvement

• Integrate intelligence into SIEM, SOAR, TIP, threat hunting, detection engineering, incident response and vulnerability prioritisation workflows.
• Guide the use of MITRE ATT&CK, STIX/TAXII, the intelligence cycle, Diamond Model and suitable analytical techniques.
• Develop and quality-assure correlation rules, watchlists, enrichment logic, automation and playbooks, with controls to limit false positives and unmanaged operational impact.
• Use lessons learned, stakeholder feedback and measurable outcomes to improve collection, analysis, dissemination and intelligence-led decisions.
• Support service development, proposals, client workshops and the evolution of NTT DATA threat intelligence methods and offerings.