Senior Threat Intelligence Analyst

The team you';ll be working with: Senior Threat Intelligence Analyst UK Security Practice | Birmingham / UK-based with flexible hybrid working | Specialist and team lead Role summary The Senior Threat Intelligence Analyst leads the delivery of high-quality cyber threat intelligence for clients and the NTT DATA UK Security Practice. The role combines hands-on analysis with day-to-day leadership of threat intelligence analysts, setting priorities, assuring analytical quality, developing team capability and translating intelligence into decisions across security operations, incident response, threat hunting, vulnerability management and risk leadership. The postholder operates with substantial autonomy, manages complex assignments, influences technical and non-technical stakeholders, and is accountable for the quality, timeliness, legality and ethical integrity of intelligence outputs. What you';ll be doing: Team leadership and delivery management Lead, allocate and coordinate the work of a threat intelligence team; set clear objectives, priorities, quality expectations and delivery deadlines. Provide technical supervision, peer review and escalation support while enabling analysts to exercise appropriate autonomy and judgement. Coach and mentor team members through structured feedback, knowledge sharing, skills development plans and support for professional certification. Manage workload, service risks, dependencies and competing client priorities; escalate material issues with clear options and recommendations. Establish and monitor delivery standards, analytical tradecraft, source handling, quality assurance and reusable intelligence processes. Act as deputy or workstream lead when required, representing the capability in client, operational and leadership forums. Threat intelligence direction, collection and analysis Define and maintain priority intelligence requirements and collection plans aligned to client assets, business exposure, threat scenarios and decision needs. Direct and conduct research across OSINT, commercial and government feeds, technical telemetry, malware reporting, trusted sharing communities, underground sources and other lawful intelligence sources. Analyse threat actors, campaigns, malware, infrastructure, indicators of compromise and tactics, techniques and procedures using structured analytical techniques. Assess source reliability, information credibility, confidence and intelligence gaps; distinguish verified reporting from analytical judgement. Produce strategic, operational and tactical intelligence explaining relevance, likely impact and recommended action rather than simply reproducing threat data. Maintain awareness of geopolitical, sector, regulatory and technology developments affecting UK and international clients. Intelligence production and stakeholder influence Own and assure executive threat briefs, campaign assessments, actor profiles, vulnerability intelligence, sector reports and incident intelligence packages. Brief senior leaders, clients, SOC teams, incident responders, detection engineers, vulnerability teams and risk stakeholders using language appropriate to each audience. Present defensible conclusions, confidence levels, assumptions, intelligence gaps and recommended actions; respond constructively to challenge and alternative hypotheses. Build trusted relationships with internal teams, clients, government bodies, industry groups and intelligence-sharing communities while protecting sensitive sources and information. Operational integration and capability improvement Integrate intelligence into SIEM, SOAR, TIP, threat hunting, detection engineering, incident response and vulnerability prioritisation workflows. Guide the use of MITRE ATT&CK, STIX/TAXII, the intelligence cycle, Diamond Model and suitable analytical techniques. Develop and quality-assure correlation rules, watchlists, enrichment logic, automation and playbooks, with controls to limit false positives and unmanaged operational impact. Use lessons learned, stakeholder feedback and measurable outcomes to improve collection, analysis, dissemination and intelligence-led decisions. Support service development, proposals, client workshops and the evolution of NTT DATA threat intelligence methods and offerings. What experience you';ll bring: 3-5 years practical experience delivering cyber threat intelligence, including complex assessments and review of other analysts’ work. Demonstrable experience leading, coordinating or technically supervising a team, workstream or intelligence function and managing delivery through others. Strong knowledge of the intelligence cycle, structured analytical techniques, collection management, source evaluation, threat actor analysis and intelligence reporting. Deep working knowledge of MITRE ATT&CK and platforms such as MISP, ThreatConnect, Anomali or equivalent; practical experience of SIEM, SOAR and security operations integration. Ability to analy