{"id":4021000,"url":"https://alion.io/job/bridewell-cyber-threat-intelligence-analyst","title":"Cyber Threat Intelligence Analyst","company":{"id":53989,"name":"Bridewell","domain":"bridewell.com","url":"https://alion.io/company/bridewell","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"OpenCTI","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"MISP","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Recorded Future","optional":true},{"name":"SIEM","optional":true},{"name":"STIX","optional":true},{"name":"TAXII","optional":true}],"status":"live","first_seen_at":"2026-11-10T15:06:30Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T15:06:30Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Role Overview\nDeliver intelligence-led services across sectors, including Critical National Infrastructure (CNI), helping clients understand and respond to relevant cyber threats.\nResearch threats, produce actionable intelligence, and support threat hunting and digital risk monitoring. Work with increasing independence alongside senior analysts, security specialists, and client stakeholders.\nWhat You’ll Be Doing\nThreat Intelligence Research and Analysis\n· Monitor emerging threats, campaigns, actors, vulnerabilities, and TTPs using internal, commercial, and open sources; collect, process, analyse, and enrich intelligence against client requirements.\n· Apply structured analytic techniques and inductive/deductive reasoning; assess source credibility, reliability, access, and placement to reduce bias and strengthen judgements.\nAssess first-, second-, and third-order effects, explain client implications, and improve research, collection, and analytical workflows.\nPresent your research and findings in a confident, professional, and easy to understand manner to both technical and non-technical stakeholders.\nIntelligence Products and Reporting\n· Produce timely notifications, advisories, assessments, reports, and briefings; own monthly CTI reports for assigned clients.\n· Contribute data, trends, statistics, and commentary to monthly and quarterly service reviews; present CTI content to technical, non-technical, senior, and executive audiences.\n· Use precise, probabilistic language to distinguish judgements from facts and observations; apply frameworks such as MITRE ATT&CK to model threats, intrusions, and adversary behaviour, linking findings to business impact, cyber risk, and action.\nThreat Intelligence Platforms and Digital Risk\n· Use CTI platforms such as OpenCTI to enrich, tag, validate, maintain, and disseminate intelligence through established workflows.\n· Triage, investigate, and escalate attack surface and digital risk alerts; configure platform rules and scans, and handle appropriate junior-analyst escalations.\n· Review feeds through Feedly or similar tools; maintain keyword/entity lists and turn relevant intelligence into notifications, advisories, reports, and newsletters.\n· Monitor the CTI mailbox, respond to requests, and maintain associated planning tasks.\nThreat Hunting and Technical Analysis\n· Run, triage, investigate, and escalate threat hunts within the assigned squad; analyse actor infrastructure, indicators of compromise, malware behaviour, and attack patterns.\n· Apply enterprise-network, security-operations, and incident-response knowledge; use or develop KQL, YARA, infrastructure profiling, malware analysis, scripting, and automation skills.\n· Use generative AI and LLMs appropriately to improve workflows; integrate intelligence with SOC, Incident Response, Offensive Security, and Consulting teams.\nClient Engagement and Consulting Delivery\n· Build trusted client relationships; understand business context, threats, priorities, and outcomes, and translate stakeholder needs into clear, answerable intelligence requirements.\n· Maintain proportionate collection plans, identifying sources, gaps, dependencies, and escalation points; deliver products and briefings that answer agreed requirements.\n· Plan and contribute to client meetings, record decisions and follow-up actions, and manage deliverables to agreed quality and timescales; communicate progress, risks, dependencies, and blockers promptly.\nCollaboration and Continuous Improvement\n· Support a diverse, cohesive team; share knowledge, mentor colleagues, and guide junior analysts through established workflows.\n· Support client onboarding, undertaking defined activities when senior analysts are unavailable.\n· Improve CTI products, research, tooling, and delivery; stay current with threats, technologies, analytical techniques, and industry developments.\n· Manage assigned work through CTI planning and contribute actively to stand-ups.\nRequirements\nEssential Criteria\nExperience - Approximately 1-3 years in cyber security, CTI, security operations, incident response, or a related discipline\nCTI knowledge - Sound understanding of CTI principles, intelligence requirements, collection planning, and the intelligence lifecycle\nThreat knowledge - Foundational-to-intermediate knowledge of threat actors, TTPs, offensive operations, vulnerabilities, malware, and threat frameworks\nResearch and analysis - Research technical and non-technical sources, evaluate evidence, identify connections, and form clear judgements\nCritical thinking - Apply structured analytical techniques and inductive/deductive reasoning\nCommunication - Strong written and verbal communication, including intelligence reports and briefings\nTechnical literacy - Practical understanding of enterprise networks, security technologies, cyber security roles, and the wider security ecosystem\nClient delivery - Manage assigned deliverables and communicate effectively with client stakeholders\nTeamwork - Collaborative, dependable, curious, and improvement-minded, with sound judgement\nOrganisation - Prioritise work and deliver to agreed quality standards and timescales\nDesirable Criteria\nCTI platforms - OpenCTI, MISP, Recorded Future, or similar platforms\nDigital risk - EASM, digital risk protection, breached-credential monitoring, or related tooling\nIntelligence feeds - Feedly or comparable intelligence aggregation and monitoring platforms\nSecurity operations - SIEM, EDR, SOC, incident response, or detection engineering experience\nThreat hunting - Running, triaging, investigating, and escalating threat hunts\nTechnical skills - KQL, YARA, infrastructure profiling, malware analysis, or network analysis\nAutomation - Foundational scripting or automation using Python, PowerShell, Bash, or similar tools\nStandards - Familiarity with STIX, TAXII, JSON, and intelligence-sharing communities\nEmerging technology - Exposure to generative AI and LLMs in intelligence workflows","description_format":"text","description_chars":5973,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Cybersecurity","Managed Security"],"lifecycle":[{"event":"open","at":"2026-11-10T15:06:30Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"Licensed UK visa sponsor (Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker","cap_exempt":false,"checked_at":"2026-11-10T11:34:35+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":61,"reasons":["conf:2","win:early"],"computed_at":"2026-11-10T17:21:01Z"},"pay":null,"html_url":"https://alion.io/job/bridewell-cyber-threat-intelligence-analyst","json_url":"https://alion.io/job/bridewell-cyber-threat-intelligence-analyst.json","meta":{"generated_at":"2026-11-10T17:21:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5937,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":53989},"rest":"https://alion.io/mcp/rest/get_company?id=53989"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbridewell-cyber-threat-intelligence-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbridewell-cyber-threat-intelligence-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbridewell-cyber-threat-intelligence-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bridewell-cyber-threat-intelligence-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbridewell-cyber-threat-intelligence-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4021000}},{"tool":"search_jobs","arguments":{"company":"bridewell.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4021000},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}