244 jobs for “Threat Intelligence Analyst”
CrowdStrike United Kingdom
Serve as technical lead on front-page incident response engagements for Fortune 100 organisations, conducting host and network forensics across Windows, Mac and Linux and hunting adversaries in large data sets. Work under outside counsel on intrusion investigations and present findings to executives, regulators and legal teams.
CrowdStrike Reading
Internship on CrowdStrike's Technical Analysis Cell, researching nation-state and criminal intrusions through reverse engineering of malware and tooling. The intern builds automation for malware analysis, creates host- and network-based detection signatures, and produces threat intelligence reporting for varied audiences.
Appcast Enterprise Farnborough
Lead protective and information security engineering on a critical MOD programme, shaping secure designs, assuring controls, and managing vulnerabilities across infrastructure, endpoints, identity and AWS cloud. Combines hands-on hardening, incident response leadership and ST&V with governance, reporting and mentoring, working largely autonomously on-site in Farnborough with some remote work.
Cloudflare London US$215,000 – US$225,000 pa
Lead research, design and evaluation of detection models identifying automated, fraudulent and malicious activity across Internet-scale traffic. Own the detection measurement framework for noisy or delayed ground truth, mentor others, and drive cross-functional detection strategy with ML, data and product teams.
University of Bristol Bristol £40,704 – £59,390 pa
Conducts novel academic and high-TRL research into agentic AI security assurance for autonomous network management, characterising threat landscapes, running adversarial testing, and building runtime decision validation and dynamic trust scoring. Develops automated mitigation such as rollback and agent isolation, with experimental evaluation on a partner's agentic AI platform and the JOINER national open-networks testbed.
Cloudflare London
Builds and operates Cloudflare's Chromium-based browser isolation engine, working across C++, Rust, Go and TypeScript on remote rendering, streaming and distributed session services. The role spans systems programming, distributed systems and security, leading multi-component initiatives and on-call incident response.
Darktrace Cambridge
Acts as the go-to authority in a chosen reliability specialism—observability, performance engineering, data infrastructure, security-focused SRE or network reliability—defining standards and best practices across SRE, Platform Engineering and DevSecOps. Builds tooling and automation, leads deep-dive investigations into systemic issues, and contributes to incident response and on-call rotations in a cloud-native, Kubernetes-based environment.
Amazon London
Builds and operates automation platforms that onboard threat detection, remediate security risk and accelerate incident response across every AWS account. Day to day involves designing loosely specified features, writing well-tested Python and TypeScript on AWS services, instrumenting systems for operational excellence, and participating in an on-call rotation. The team runs foundational services at very high scale with a strong 'you build it, you run it' culture.
Amazon London
Builds and operates automation platforms that onboard threat detection, remediate security risk and accelerate incident response across every AWS account. The role spans designing loosely specified features, owning operational health through instrumentation and automation, and participating in an on-call rotation, using AWS services, Python and TypeScript at very high scale.
Pertemps Thames Water Reading £72,000 pa
Supports the design, implementation and maintenance of threat and vulnerability management controls across a large water utility's IT estate. Conducts network, application and code penetration testing, exploits vulnerabilities via proof-of-concept testing, and helps build an internal pen testing function. Works hybrid in Reading, liaising with Digital teams on remediation, patching and threat hunting.
NCC Group Remote
Oversee Security Operations Centre activities, lead incident response efforts, and mentor a team of analysts. The role centres on cyber threat detection and incident investigation, with strong hands-on use of the Splunk Enterprise Security platform. It is a lead-level position within a remote security operations team.
Humanoid London
Lead product cybersecurity assurance across the HMND 01 humanoid robot platforms, defining security requirements, threat modelling and risk artefacts for safety-critical electromechanical systems. Own TARA, security management plans and remediation actions, drive compliance with IEC 62443, the EU Machinery Regulation and the Cyber Resilience Act, and build a PSIRT process while guiding a cross-functional security team.
Experis United Kingdom
Supports the delivery of security architecture and cyber security services across Defence and Government projects, including security assessments, risk analysis, threat identification and security documentation. Works alongside experienced Security Architects and technical specialists on areas such as Identity & Access Management, Security Testing, Privacy and Cloud Security, and requires SC Clearance.
Adecco United Kingdom £90,000 – £110,000 pa
Designs and builds security reference architectures for public, private and hybrid cloud environments, supporting clients in developing enterprise security use cases aligned to their cloud strategy. Works with cross-functional teams to select technologies, integrate hybrid IT ecosystems, and apply zero trust, threat modelling and secure-by-design principles. Involves coaching clients and internal teams, plus automation and orchestration tooling for secure deployments.
Global Technology Solutions Ltd Reading £50,000 – £60,000 pa
Senior technical authority in Security Operations, leading serious incidents, forensic investigations and root cause analysis while improving detection and response. Engineers Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune and Darktrace, develops automation and conducts proactive threat hunting, and mentors colleagues.
