Cyber Threat Intelligence and Adversary Emulation Analyst

Job Introduction

The Opportunity and your impact

Reporting to the GSOC Cyber Threat Intelligence and Adversary Emulation manager, this role is responsible for the collection, analysis, and dissemination of closed group/open-source Cyber threat intelligence for NDA GSOC group customers. In addition, the intelligence gathered will facilitate the Cyber Adversary Emulation program via GSOC technical toolsets. The candidate will work closely with other members of the NDA GSOC and will provide (but not limited to); research to GSOC technical teams and CTI departments, group operating company ad hoc Cyber Threat Intelligence, provide Intelligence briefings, conduct analysis of threat actors / vectors / behaviours and how they impact our customers and utilise actionable Threat Intelligence to conduct technical security control validation.

What you’ll do

• Analyse intelligence and information sources, evaluating and validating the credibility, urgency and relevancy for cyber threats posed to the NDA Group.
• Supervise Apprentices / Graduates when required.
• Provide Threat Intelligence to the NDA GSOC customer base via analysis of operational security incidents, bulletins, events, and alerts.
• Provide thorough reporting on a regular frequency to NDA GSOC customers identifying monthly trends via analysis. Customisation of reporting should be performed based on the target audience.
• Provide demonstrable hypothesis via analysis of Threat intelligence data and information to ultimately codify into actionable intelligence.
• Analyse Tactical intelligence analysis of attacker techniques, tools, and procedures to inform security architects and security operations teams. 
• Analyse Operational intelligence of specific incoming threats to support security operations and incident teams.
• Periodically monitor effectiveness and efficiency of the Intelligence services delivered, suggesting alternative solutions to the teams involved and actively contribute to continuous improvement.
• Define, prepare, and manage supporting documentation, processes and procedures of the Cyber Threat Intelligence department under the guidance of the Threat Intelligence and Adversary Emulation Manager.
• Coordinate closely with the Cyber Threat Intelligence and Adversary Emulation Manager on contemporary Cyber Threats and their impact on the GSOC customer base.
• Disseminate threat assessments and indicators to support effective risk and incident management which may include delivering intelligence-led briefings.
• Collaborate and engage with Intelligence partners and Information sharing authorised centres.
• Performing adversary Emulation activities through automated toolsets for testing technical controls efficacy and whether the control could withstand exploitation.
• Performing technical report writing based on the adversary Emulation testing output.
• Participate in the on-call rota for out-of-hours events and incidents

The successful candidate will be able to demonstrate:

• Relevant knowledge and experience in Cyber Threat Intelligence, including the intelligence lifecycle, threat assessment and its role within security operations.
• Experience of collecting, analysing and interpreting technical and threat information to produce actionable intelligence.
• A good technical understanding of cyber threats, attacker behaviours, exploits, malware and attack vectors, including practical knowledge of the MITRE ATT&CK framework.
• Experience of analysing network, system or security monitoring information to identify and assess potential threats and support incident investigation.
• The ability to translate complex technical information into clear intelligence and reporting for both technical and senior stakeholders.
• Experience of working collaboratively with security specialists and stakeholders to share relevant intelligence effectively and support the resolution of complex cyber security issues.
• Relevant qualifications or equivalent professional experience in Cyber Security, Threat Intelligence, Computer Science, Digital Forensics or a related discipline. Relevant professional certifications and knowledge of the civil nuclear sector are desirable.

Your background, skills and strengths:

• You share and demonstrate the NDA values of Respect, Openness, Collaboration, Performance and Creativity.
• You have excellent written and verbal communication skills and can build effective working relationships with technical and non-technical stakeholders.
• You are comfortable sharing information, knowledge and intelligence with colleagues, third-party specialists and partner organisations.
• You are self-motivated and equally comfortable working independently or as part of a team.
• You remain calm and focused under pressure, including when responding to fast-moving or uncertain situations.
• You work methodically and accurately, including when following complex or defined procedures.
• You can operate effectively in an environment requiring resilience, agility and diplomacy, particularly when dealing with ambiguity, complexity and change.
• You demonstrate strong analytical and problem-solving skills, with the ability to investigate complex issues and interpret incomplete or unexpected information.
• You can consider the wider social, commercial, cultural, ethical and environmental consequences of decisions and actions.
• You demonstrate sound judgement, attention to detail and intellectual curiosity, particularly when investigating emerging or evolving cyber threats.
• Candidates must either hold or be capable of achieving SC security clearance. 

What we offer:

• Generous performance based annual bonus scheme.
• Defined benefit Civil Service pension scheme (please find more information here).
• 30 days annual leave per year, plus 8 statutory public and bank holidays (pro-rata for part-time employees).
• A range of family-friendly flexible working options.

We value the unique differences that each of our colleagues bring to work every day and are committed to creating an environment where everyone feels respected, included and able to perform at their best. At NDA, we are committed to creating a workplace that is diverse and inclusive. We value the diversity of our people and actively seek to have a workforce that represents the rich diversity of the communities we support. Currently, we are underrepresented in some areas, and would particularly welcome applicants from Women, Black, Asian and Ethnic Minorities, LGBTQ+ and candidates who have a disability.

NDA is a member of the disability confident scheme, when requested we will make reasonable adjustments to the recruitment process and we guarantee to interview all candidates who have a disability who meet all of the essential criteria for the vacancy.

We are happy to discuss flexible working. We will also make workplace adjustments for disabled employees if these are needed to help them perform at their best in the role, and we are happy to discuss this once a job offer has been made.