Threat Intelligence Lead

Responsibilities

• ▹Build and own Canonical's threat intelligence strategy
• ▹Build and maintain OSINT research environments
• ▹Develop OSINT tradecraft, principles, and techniques
• ▹Identify and track targeted intrusion threats, trends, and developments through analysis of proprietary and open source datasets
• ▹Collaborate across teams to inform on activity of interest
• ▹Coordinate adversary and campaign tracking
• ▹Contribute to the wider threat intelligence community
• ▹Work with product and engineering teams to explain threats and advise on mitigation strategies
• ▹Work with the OPSEC and IS team to implement/update security controls
• ▹Identify intelligence gaps and propose new tools and research projects
• ▹Conduct briefings for executives, internal stakeholders, and external customers

Requirements

• ▹Experienced threat intelligence leader (or similar)
• ▹Knowledgeable about the open source threat landscape and networking/infrastructure concepts
• ▹Highly competent with OSINT tools (e.g. Buscador, Trace Labs OSINT VM, OSINT Framework, Maltego, Shodan, social media scraping tools)
• ▹Able to identify, organise, catalogue, and track adversary tradecraft trends, often with incomplete data
• ▹Experience using threat intelligence data to influence enterprise architecture or product development decisions
• ▹Excellent communicator able to tailor technical content to varied audiences
• ▹Able to travel twice a year for company events up to two weeks long

Nice to have

• ▹A professional portfolio of OSINT-related scripts, tools, or frameworks
• ▹Demonstrated involvement in the OSINT community
• ▹Bachelor's degree in computer science, information security, or a related field
• ▹Certifications in related areas (e.g. GOSI, SANS SEC487 & SEC587, IntelTechniques OSIP)
• ▹Experience in a tech company or government/military signal intelligence department

Soft skills

About the company

Canonical is the publisher of Ubuntu, whose products are present directly or indirectly in almost every organisation and household in the world, making it a prime target for threat actors. This team's mission is to help Canonical and the wider community secure their software infrastructure.