{"id":2289029,"url":"https://alion.io/job/csis-security-group-cyber-threat-intelligence-consultant","title":"Cyber Threat Intelligence Consultant","company":{"id":55381,"name":"CSIS Security Group","domain":"csis.com","url":"https://alion.io/company/csis-security-group","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Easycruit","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Denmark"],"countries":["DK"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":66000,"max_usd":157000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":774},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"DNS","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PKI","optional":false},{"name":"Red Teaming","optional":false},{"name":"TCP/IP","optional":false},{"name":"Censys","optional":true},{"name":"Shodan","optional":true},{"name":"VirusTotal","optional":true}],"status":"live","first_seen_at":"2026-10-02T00:00:00Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-20T07:51:11Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"Consultancy · Employee · Permanent · Full-time · Day\nCyber Threat Intelligence Consultant\nJoin one of the leading Cyber Threat Intelligence consulting teams in the world!\nPermanent, full-time position, 40 hours per week\nLocation: Hybrid (1-2 days per week at Canary Wharf, London), Remote or other European locations considered providing you have the appropriate Right to Work documentation for that country\nAbout us\nWe are a market-leading cybersecurity company built by and for technical experts. Our mission is to protect organisations from advanced cyber threats through cutting-edge research, intelligence and technical expertise. Our services span Threat Intelligence, Managed Detection & Response (MDR), Incident Response and Research. As part of Allurity (https://allurity.com), a European powerhouse of tech-enabled cybersecurity providers, we collaborate closely with sister companies across Europe.\nOur Consulting Team is one of the leading Cyber Threat Intelligence (CTI) consulting teams in the world. We are a CREST-accredited Bank of England CBEST provider, Cabinet Office GBEST provider, and have delivered over 80 TIBERs/TLPTs and 200 scheme-linked (CBEST, GBEST, STAR, STAR-FS, iCAST) or other TLPT derivatives. The team contributes research for Governments and international intelligence-sharing collectives and performs National Threat Assessments. This is a team dedicated to providing high-quality reporting at a high cadence. We are looking for a colleague who matches our capability, drive and commitment to quality.\nWe are seeking a CTI Consultant to support the production of accurate, high quality and timely intelligence products. The role will include support to management, peers and junior members of staff as well as clients. At least 3 years’ experience gained across all aspects of cyber threat intelligence is required.\nWe make Intelligence Human!\nYour new role\nThis role is focused on the technical and open-source reconnaissance of entities to support red teaming which requires a technical understanding of how to simulate threat actor reconnaissance. You will support the assessments team to generate accurate and detailed threat scenarios which are realistic and credible, to be used for emulation by Red Teams.\nYour responsibilities will include:\nSupporting Consultancy Cyber Threat Intelligence Engagements across various national and international frameworks (*BEST, TIBER/TLPT, iCAST, etc)\nFollowing intelligence collection requirements, conducting technical and OSINT collection\nHigh-quality strategic report writing using standardised reporting structures\nWorking under operational time pressure, self-managing tasks, meeting deadlines in support of client requirements\nLiaising with teams supporting the ThreatMatch platform to task them with specific collection efforts or support on bespoke RFI’s\nAbout you \nEssential requirements include:\nPrevious OSINT research and short- and long-form writing experience to a specified technical writing style.\nPrevious direct use of CTI methodologies, e.g. investigative pivoting models, investigative frameworks, MITRE ATT&CK and the Extended Cyber Kill Chain.\nA good understanding of common enterprise IT concepts, networking (DNS, TCP/IP, application layer protocols, PKI) and operating systems\nFamiliarity with major cognitive bias types, and the ability to identify those cognitive biases during research\nPrevious experience with competing hypothesis theory, and use of different tools to score those hypotheses\nAn effective communicator able to build and maintain stakeholder relationships\nAbility to analyse, evaluate and contextualise sets of information using analytical techniques and common industry tooling\nA high level of professionalism and focus\nDetailed understanding of the Threat Landscape, ideally with a financial services specialism\nDesirable requirements:\nExperience of working on national and international frameworks for TI-led testing (*BEST, TIBER/TLPT, iCAST)\nExperience with pen testing, reconnaissance or red team engagements\nExperience of core CTI components\nExperience with tools such as Shodan, Censys, VirusTotal, WHOIS domain and netblock analysis\nStrong communicator with experience of taking complex technical findings and translating into clear business impact.\nStrong presentational skills\nUse of LLMs and other AI tools to support collection and research (awareness of their strengths and weaknesses)\nTraining/qualifications desired:\nDIAC/DIAM/GIAC or other advanced analytical technique training\nCREST (CRTIA) or other Threat Intelligence qualifications (e.g. SANS, GIAC)\nCEH, CRT, OSCP or similar penetration testing certifications/training\nWe are committed to promoting equality, diversity and inclusion, and welcome applications from all suitably qualified candidates, regardless of age, sex, disability, race, ethnicity, religion or belief, sexual orientation, gender reassignment, marriage and civil partnership, or pregnancy and maternity. We are dedicated to building a diverse workforce and take steps to ensure our recruitment process is fair, accessible and inclusive.","description_format":"text","description_chars":5105,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Denmark","iso":"DK","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Cybersecurity"],"lifecycle":[{"event":"open","at":"2026-10-11T17:05:19Z"}],"visa":[],"liveness":{"score":73,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.812,"p_room":0.9,"age_days":18,"expected_fill_days":31,"reasons":["conf:2","velocity","win:mid"],"computed_at":"2026-10-20T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/csis-security-group-cyber-threat-intelligence-consultant","json_url":"https://alion.io/job/csis-security-group-cyber-threat-intelligence-consultant.json","meta":{"generated_at":"2026-10-20T10:47:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11776,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":55381},"rest":"https://alion.io/mcp/rest/get_company?id=55381"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcsis-security-group-cyber-threat-intelligence-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcsis-security-group-cyber-threat-intelligence-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcsis-security-group-cyber-threat-intelligence-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/csis-security-group-cyber-threat-intelligence-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcsis-security-group-cyber-threat-intelligence-consultant"}]}