Senior Threat Intelligence Specialist

🏗 We're Hiring: Senior Threat Intelligence Specialist

📍 Location: United Arab Emirates (Remote)

🕒 Employment Type: Full-Time

💼 Experience Level: Mid-Level to Senior

🌐 Work Arrangement: Fully Remote

About Us

We are a construction-focused organization committed to delivering complex projects through operational excellence, effective risk management, secure technology infrastructure, and collaborative project delivery. Our distributed teams work across Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership to protect business-critical information, maintain operational resilience, and support secure project delivery.

As our digital environment expands across enterprise systems, cloud platforms, project sites, remote workforces, and third-party business relationships, understanding the evolving cyber threat landscape is essential to protecting organizational assets. We value professionals who combine intelligence analysis, technical investigation, strategic thinking, and proactive risk management to anticipate threats and provide actionable insights that strengthen our security posture.

The Role

We are seeking an experienced Senior Threat Intelligence Specialist to lead and enhance the organization's cyber threat intelligence capabilities. The successful candidate will collect, analyze, validate, and disseminate intelligence concerning cyber adversaries, emerging attack techniques, malicious infrastructure, vulnerabilities, threat campaigns, and potential risks affecting the organization.

This role will focus on strategic, operational, and tactical threat intelligence, adversary profiling, threat hunting support, intelligence-driven detection engineering, external threat monitoring, and cyber risk assessment. The specialist will collaborate with Security Operations, Incident Response, Vulnerability Management, Network Security, Endpoint Security, Cloud Security, Identity and Access Management, Risk, Legal, and other relevant stakeholders to translate intelligence into practical security improvements and informed business decisions.

The ideal candidate will possess strong analytical capabilities, hands-on experience with threat intelligence platforms and investigation tools, a solid understanding of attacker behaviors, and the ability to communicate complex intelligence findings clearly to both technical teams and executive leadership.

Key Responsibilities1. Cyber Threat Intelligence Collection and Analysis

• Develop and maintain structured cyber threat intelligence collection processes aligned with organizational security priorities and business risks.
• Collect threat information from approved intelligence platforms, commercial intelligence providers, open-source intelligence (OSINT), security advisories, industry reports, vendor disclosures, and trusted information-sharing communities.
• Analyze information concerning threat actors, malware families, ransomware groups, advanced persistent threats, cybercrime operations, and emerging attack campaigns.
• Evaluate the credibility, reliability, relevance, and timeliness of intelligence sources before using them to support security decisions.
• Correlate information from multiple sources to identify relationships between threat actors, attack infrastructure, vulnerabilities, and observed campaigns.
• Distinguish verified intelligence from unconfirmed reporting, assumptions, and low-confidence indicators.
• Assess the potential impact of identified threats on the organization's technology environment, business operations, geographic footprint, and third-party relationships.
• Maintain structured intelligence records covering indicators, adversary techniques, campaign timelines, affected technologies, confidence levels, and recommended actions.
• Identify intelligence gaps and recommend collection priorities to improve visibility into relevant threats.
• Establish repeatable analytical procedures to improve the consistency, accuracy, and usefulness of intelligence products.
• Maintain awareness of developments in cybercrime, state-sponsored activity, ransomware, cyber espionage, and other relevant threat categories.

2. Strategic Threat Intelligence

• Assess long-term cyber threat trends that may affect the organization's business operations, strategic objectives, technology investments, and risk exposure.
• Prepare strategic intelligence assessments explaining emerging threats, adversary motivations, likely targets, and potential business consequences.
• Evaluate geopolitical, economic, technological, and industry developments that may influence cyber threat activity.
• Identify potential risks associated with critical infrastructure, construction projects, engineering environments, supply chains, and geographically distributed operations.
• Analyze how changes in the threat landscape may affect confidentiality, integrity, availability, safety, and business continuity.
• Provide executive leadership and risk management teams with concise intelligence briefings and actionable recommendations.
• Develop threat outlooks and scenario-based assessments for significant emerging risks.
• Assess the potential impact of ransomware campaigns, disruptive attacks, cyber espionage, data theft, and third-party compromises.
• Support strategic security planning by identifying areas where additional controls, monitoring, or defensive investment may be warranted.
• Translate technical intelligence into business risk language that supports prioritization and informed decision-making.
• Review strategic assessments periodically as new evidence, campaigns, or threat developments emerge.

3. Operational and Tactical Intelligence

• Produce operational intelligence assessments covering active threat campaigns, adversary infrastructure, attack preparation, and likely targeting patterns.
• Develop tactical intelligence describing attacker techniques, procedures, tools, indicators, and observable behaviors.
• Track adversary tactics, techniques, and procedures (TTPs) using the MITRE ATT&CK framework where appropriate.
• Analyze relationships between threat actors, command-and-control infrastructure, malicious domains, IP addresses, file hashes, and attack tools.
• Identify opportunities to detect adversary behavior through endpoint telemetry, network traffic, identity events, email activity, and cloud audit logs.
• Provide intelligence-driven recommendations to Security Operations and Incident Response teams.
• Develop threat profiles that include known capabilities, preferred attack vectors, targeting patterns, operational objectives, and confidence assessments.
• Identify relevant indicators of compromise and behavioral detection opportunities.
• Support the prioritization of intelligence findings according to threat credibility, exposure, potential impact, and defensive relevance.
• Maintain intelligence products that help analysts understand the context behind security alerts and ongoing incidents.
• Review tactical intelligence following significant changes in adversary behavior or newly observed attack methods.

4. Threat Actor Profiling and Adversary Tracking

• Research and profile cyber threat actors, ransomware operators, financially motivated criminal groups, state-sponsored groups, and other relevant adversaries.
• Analyze publicly reported campaigns, malware capabilities, infrastructure patterns, attack techniques, and historical targeting.
• Identify likely motivations, operational objectives, capability levels, and target-selection patterns where evidence supports such assessments.
• Maintain structured profiles of relevant threat actors and their associated tools, techniques, indicators, and campaigns.
• Track changes in adversary behavior, infrastructure, tooling, and attack methods over time.
• Correlate new observations with existing intelligence to identify possible campaign continuity or previously unseen relationships.
• Apply confidence ratings and distinguish confirmed attribution from analytical hypotheses.
• Avoid unsupported attribution and clearly document alternative explanations when evidence is incomplete.
• Identify adversaries with demonstrated interest in construction, engineering, infrastructure, financial operations, or related supply chains where supported by credible reporting.
• Prepare targeted threat assessments for business-critical systems, project environments, and sensitive organizational functions.
• Share relevant adversary profiles with authorized security stakeholders to improve threat awareness and defensive planning.

5. Threat Hunting and Detection Engineering Support

• Translate intelligence findings into actionable threat-hunting hypotheses, detection use cases, and security monitoring recommendations.
• Collaborate with Security Operations and Threat Hunting teams to identify suspicious activity associated with known adversary behaviors.
• Develop intelligence-driven queries and detection logic using relevant security analytics platforms and query languages.
• Support the use of Kusto Query Language (KQL), Structured Query Language (SQL), Sigma rules, YARA rules, and other appropriate detection formats where applicable.
• Map intelligence findings to MITRE ATT&CK techniques to identify defensive coverage gaps.
• Recommend new detection rules based on emerging campaigns, attack techniques, and verified indicators.
• Help validate detection logic against available telemetry and controlled security testing results.
• Assess whether current security controls can identify relevant adversary behaviors and recommend improvements where gaps exist.
• Provide threat intelligence context for suspicious endpoint, network, email, identity, and cloud security events.
• Conduct retrospective searches when new intelligence suggests that previously observed activity may be malicious.