{"id":3534714,"url":"https://alion.io/job/rank-group-cyber-threat-intelligence-lead","title":"Cyber Threat Intelligence Lead","company":{"id":172402,"name":"Rank Group","domain":"rank.com","url":"https://alion.io/company/rank-group","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":{"grade":"B","score":75,"open_postings":10,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":23,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Quatre Bornes, Mauritius"],"countries":["MU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19500,"max_usd":51000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":753},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Python","optional":false},{"name":"SQL","optional":false},{"name":"STIX","optional":false},{"name":"TAXII","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"MISP","optional":true},{"name":"OpenCTI","optional":true}],"status":"live","first_seen_at":"2026-10-30T01:00:00Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-05T19:05:45Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"Job Purpose\nAs our Cyber Threat Intelligence Lead, you’ll take ownership of developing and evolving Rank’s cyber threat intelligence capability, turning intelligence into earlier warning, smarter decisions and measurable improvements to our cyber defences.\nThis is a hands-on leadership role where you’ll combine strategic thinking with technical expertise to understand the threats facing our brands, customers, colleagues and technology. You’ll work across Cyber Security, Technology, Fraud, Risk and the wider business to ensure intelligence leads to meaningful action.\nKey Requirements\nYou’ll lead the end-to-end threat intelligence lifecycle, bringing together intelligence gathering, analysis, threat hunting and defensive response. You’ll be comfortable moving between technical investigation and strategic conversations, translating complex threats into clear priorities for the business.\nOwn and continuously develop Rank’s Cyber Threat Intelligence capability, including intelligence priorities, operating standards and the capability roadmap.\nLead intelligence gathering and analysis across OSINT, commercial, deep-web and dark-web sources, identifying credible threats to Rank, our brands, customers and critical suppliers.\nTurn intelligence into action through threat hunting, detection improvements, incident support, vulnerability prioritisation and defensive recommendations.\nOwn and optimise the IOC lifecycle and Cortex XSIAM Threat Intelligence capability, including feeds, integrations, playbooks, enrichment and automation.\nUse technologies including XQL, Python, SQL and APIs, alongside frameworks such as MITRE ATT&CK, STIX/TAXII, Sigma and YARA, to enhance intelligence and hunting capabilities.\nCommunicate the “so what?” clearly, producing actionable intelligence for technical teams and senior leaders and ensuring threats have clear ownership and next steps.\nQualifications\nWe’re looking for someone who combines strong cyber threat intelligence expertise with the curiosity and technical capability to investigate threats in depth and translate intelligence into real defensive outcomes.\nPrevious relevant cyber security experience across threat intelligence, threat hunting, security operations, incident investigation, digital risk or vulnerability intelligence.\nStrong knowledge of the threat intelligence lifecycle, threat hunting, MITRE ATT&CK, source evaluation and structured analysis.\nExperience with Cortex XSIAM and XQL is highly desirable, alongside CTI platforms such as OpenCTI, MISP or equivalent.\nKnowledge of STIX/TAXII, IOC lifecycle management, Sigma, YARA, APIs and security automation, with experience using Python and/or SQL beneficial.\nExperience conducting controlled OSINT, brand/domain, credential, dark-web or cybercrime research, with appropriate evidence handling, legal, privacy and operational security awareness.\nStrong communication and stakeholder management skills, with the ability to explain complex cyber threats to both technical and executive audiences. \nExperience within regulated gambling, payments, digital or retail environments would be advantageous.","description_format":"text","description_chars":3124,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","iGaming & Gambling"],"lifecycle":[{"event":"open","at":"2026-10-30T17:11:57Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":6,"expected_fill_days":23,"reasons":["conf:2","stale_co","velocity","win:early"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/rank-group-cyber-threat-intelligence-lead","json_url":"https://alion.io/job/rank-group-cyber-threat-intelligence-lead.json","meta":{"generated_at":"2026-11-05T20:06:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27083,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":172402},"rest":"https://alion.io/mcp/rest/get_company?id=172402"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frank-group-cyber-threat-intelligence-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frank-group-cyber-threat-intelligence-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frank-group-cyber-threat-intelligence-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/rank-group-cyber-threat-intelligence-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frank-group-cyber-threat-intelligence-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3534714}},{"tool":"search_jobs","arguments":{"company":"rank.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3534714},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}