{"id":77151,"url":"https://alion.io/job/wpp-security-threat-intelligence-analyst","title":"Security Threat Intelligence Analyst","company":{"id":5467,"name":"WPP","domain":"wpp.com","url":"https://alion.io/company/wpp","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":88,"open_postings":33,"ghost_share":0,"stale_share":0.485,"repost_share":0,"time_to_fill_p50_days":56,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["São Paulo, Brazil"],"countries":["BR"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":36000,"max_usd":105000,"period":"year","method":null,"sample_n":4941},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Recorded Future","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-06-16T09:23:46Z","employer_posted_date":"2026-06-16","last_verified_at":"2026-10-18T06:31:29Z","board_verified":true,"closed_at":null,"days_open":123,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":123},"description":"WPP is the trusted growth partner for the world’s leading brands. \nWe unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company - powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. \n\nWe work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.\n\nOur people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. \n\nFor more information, visit WPP.com.\n\nWhy we're hiring:\nThe Threat Intelligence Engineer is responsible for engineering, operating, and continuously improving WPP’s cyber threat intelligence platforms, integrations, and enrichment pipelines. This role focuses on how threat intelligence is ingested, processed, correlated, and operationalised at scale across security operations. The position is an engineering-led individual contributor role with no people management responsibilities.\nWhat you'll be doing:\nEngineer and maintain threat intelligence platforms and data sources.\nDesign ingestion pipelines for external, internal, and open-source intelligence feeds.\nMaintain centralised repositories for indicators, threat actor artefacts, and metadata.\nIntegrate threat intelligence into SIEM, SOAR, EDR/XDR, email, identity, and cloud tooling.\nBuild enrichment pipelines linking incidents to threat actors, campaigns, and TTPs.\nPartner with Automation Engineering to ensure intelligence is automation-first.\nProvide engineered intelligence support to Incident Response during active incidents.\nEnable Detection Engineering and Threat Hunting with structured intelligence outputs.\nSupport Vulnerability Management with intelligence on actively exploited vulnerabilities.\nBuild automation hooks between CTI platforms and SOAR workflows.\nEnable safe, explainable intelligence use for agentic and automated decision support.\nImprove intelligence delivery speed, accuracy, and signal-to-noise ratio.\nDefine and maintain engineering standards for CTI integrations.\nMonitor feed efficacy and deprecate low-value intelligence sources.\nSupport audits, assurance, and documentation activities related to CTI.\nWhat you'll need:\nExperience engineering or operating enterprise threat intelligence platforms.\nHands-on experience integrating CTI with SIEM, SOAR, or EDR/XDR.\nStrong capability in APIs, data transformation, enrichment logic, and automation.\nSolid understanding of threat intelligence concepts and operationalisation.\nExperience with Google Threat Intelligence, Recorded Future, or similar platforms.\nFamiliarity with MITRE ATT&CK and threat-led detection models.\nExperience supporting incident response or detection engineering teams.\nRelevant certifications (GCTI, GCIA, GCED, cloud security certifications).\nFluent in written and spoken English.\nWho you are:\nYou're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.\nYou're optimistic: We believein the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.\nYou're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.\nWhat we'll give you:\nPassionate, inspired people - We aim to create a culture in which people can do extraordinary work.\nScale and opportunity - We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.\nChallenging and stimulating work - Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?\n#LI-Hybrid \nWe believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.\nWPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.\nPlease read our Privacy Notice (https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment) for more information on how we process the information you provide.","description_format":"text","description_chars":4989,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"Brazil","iso":"BR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Digital Marketing","Media & Audience Measurement"],"lifecycle":[{"event":"open","at":"2026-06-16T09:23:46Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.38,"p_room":0.28,"age_days":122,"expected_fill_days":56,"reasons":["conf:1","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/wpp-security-threat-intelligence-analyst","json_url":"https://alion.io/job/wpp-security-threat-intelligence-analyst.json","meta":{"generated_at":"2026-10-18T09:02:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13457,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5467},"rest":"https://alion.io/mcp/rest/get_company?id=5467"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwpp-security-threat-intelligence-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwpp-security-threat-intelligence-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwpp-security-threat-intelligence-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/wpp-security-threat-intelligence-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwpp-security-threat-intelligence-analyst"}]}