Threat Intelligence Analyst

at  BAE Systems

LOCATION(S): UK, EUROPE & AFRICA : UK : LEEDS

BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts. We work collaboratively across 10 countries to collect, connect and understand complex data, so that governments, nation states, armed forces and commercial businesses can unlock digital advantage in the most demanding environments.
Job Title: Lead Cyber Threat Intelligence and Vulnerability Analyst

ROLE DESCRIPTION

BAE Systems have been contracted to undertake the day to day operation of (and incremental improvement of) a dedicated Security Operations Centre (SOC) to support the defence of a major UK Critical National Infrastructure (CNI) organisation. The networks protected are predominantly hosted in Azure and AWS cloud platforms, with many hundred systems within these environments that must be protected. The customer is committed to development of this improved SOC to be a benchmark of best practice and excellence in reflection of the significant threat that the protected systems are subject to.
The SOC will be staffed by a blend of customer and BAE Systems staff, based in multiple locations, but with the day to day operations based from our Leeds office.
This role requires a minimum of DV clearance.
This role reports to the Cyber Threat Intelligence and Vulnerability Lead.

THE ROLE

You will:

• Monitor, investigate and report potential cyber threats and key vulnerabilities daily.
• Responsible for maintaining an Indicator of Compromise (IOC) database tailored to the client’s estate, directed by the Cyber Threat Intelligence and Vulnerability Lead.
• Interpret and collate tactical and operational threat intelligence into threat reports on a regular schedule (monthly, quarterly and annually).
• Research, assess and report on specific cyber threat actor’s capabilities, motivations and Tactics, Techniques and Procedures (TTPs).
• Collaborate with a range of stakeholders and teams to address key vulnerabilities across the client’s estate and support the incident response function.
• Drafting and production of technical threat hunt hypothesis which are realistic and pose a justifiable threat to the client.
• Ensure all relevant 0-Day, critical and high vulnerabilities sourced from internal tooling and open source feeds are tracked in a vulnerability register, and draft an alert and warning notice on an ADHOC basis when approved by the Cyber Threat Intelligence and Vulnerability Lead.