Cyber Threat Intelligence Lead

Job Purpose

As our Cyber Threat Intelligence Lead, you’ll take ownership of developing and evolving Rank’s cyber threat intelligence capability, turning intelligence into earlier warning, smarter decisions and measurable improvements to our cyber defences.

This is a hands-on leadership role where you’ll combine strategic thinking with technical expertise to understand the threats facing our brands, customers, colleagues and technology. You’ll work across Cyber Security, Technology, Fraud, Risk and the wider business to ensure intelligence leads to meaningful action.

Key Requirements

You’ll lead the end-to-end threat intelligence lifecycle, bringing together intelligence gathering, analysis, threat hunting and defensive response. You’ll be comfortable moving between technical investigation and strategic conversations, translating complex threats into clear priorities for the business.

• Own and continuously develop Rank’s Cyber Threat Intelligence capability, including intelligence priorities, operating standards and the capability roadmap.
• Lead intelligence gathering and analysis across OSINT, commercial, deep-web and dark-web sources, identifying credible threats to Rank, our brands, customers and critical suppliers.
• Turn intelligence into action through threat hunting, detection improvements, incident support, vulnerability prioritisation and defensive recommendations.
• Own and optimise the IOC lifecycle and Cortex XSIAM Threat Intelligence capability, including feeds, integrations, playbooks, enrichment and automation.
• Use technologies including XQL, Python, SQL and APIs, alongside frameworks such as MITRE ATT&CK, STIX/TAXII, Sigma and YARA, to enhance intelligence and hunting capabilities.
• Communicate the “so what?” clearly, producing actionable intelligence for technical teams and senior leaders and ensuring threats have clear ownership and next steps.

Qualifications

We’re looking for someone who combines strong cyber threat intelligence expertise with the curiosity and technical capability to investigate threats in depth and translate intelligence into real defensive outcomes.

• Previous relevant cyber security experience across threat intelligence, threat hunting, security operations, incident investigation, digital risk or vulnerability intelligence.
• Strong knowledge of the threat intelligence lifecycle, threat hunting, MITRE ATT&CK, source evaluation and structured analysis.
• Experience with Cortex XSIAM and XQL is highly desirable, alongside CTI platforms such as OpenCTI, MISP or equivalent.
• Knowledge of STIX/TAXII, IOC lifecycle management, Sigma, YARA, APIs and security automation, with experience using Python and/or SQL beneficial.
• Experience conducting controlled OSINT, brand/domain, credential, dark-web or cybercrime research, with appropriate evidence handling, legal, privacy and operational security awareness.
• Strong communication and stakeholder management skills, with the ability to explain complex cyber threats to both technical and executive audiences.
• Experience within regulated gambling, payments, digital or retail environments would be advantageous.