Threat Intelligence Lead

Job Title

Threat Intelligence Lead

Position Summary (Summary of the Role)

You own the threat intelligence function, setting collection priorities, intelligence standards, and reporting cadence for the organization. You lead a team of analysts, direct their day-to-day work, and are personally accountable for the quality, timeliness, and actionability of intelligence delivered to Security Operations, Incident Response, Vulnerability Management, and executive stakeholders. You represent threat intelligence in leadership forums, own vendor and feed decisions, and build the program''s maturity year over year.

Key Responsibilities

Lead the threat intelligence program

• Set intelligence collection priorities and requirements based on organizational risk, industry targeting, and stakeholder needs

• Own the threat intelligence roadmap, including program maturity, tooling, staffing, and process improvements

• Establish and enforce standards for finished intelligence products, source reliability, and confidence-level reporting

• Define and track program KPIs, such as report timeliness, actionability, detection coverage, and stakeholder satisfaction

Manage and develop the analyst team

• Hire, coach, and manage threat intelligence analysts, including workload prioritization and quality review of their work

• Set individual and team goals, conduct performance reviews, and build career development plans for analysts

• Run the team''s intelligence cycle end to end: tasking, collection, analysis, production, and dissemination

• Build team proficiency in structured analytic techniques, adversary tracking, and the MITRE ATT&CK framework

Deliver strategic and operational intelligence

• Personally author and quality-check high-stakes intelligence products, including executive and board-level briefings

• Lead intelligence support during major incidents, providing attribution, actor intent, and containment guidance to IR leadership

• Direct the organization''s threat landscape assessment, including sector-specific and geopolitical risk

• Prioritize vulnerability remediation guidance in partnership with Vulnerability Management using exploitation and actor-interest data

Own detection enablement and adversary emulation

• Partner with detection engineering to convert intelligence into SIEM/EDR detection logic and hunting programs

• Direct threat-informed red team, purple team, and adversary emulation exercises using current TTPs

• Review and approve detection and hunting priorities to ensure they reflect the current threat landscape

Vendor, platform, and cross-functional leadership

• Own the threat intelligence platform (TIP) strategy, feed and vendor selection, licensing, and renewal decisions

• Build and maintain relationships with industry ISACs/ISAOs, law enforcement, and peer intelligence leads for information sharing

• Represent threat intelligence in leadership, risk, and governance forums, including budget and staffing discussions

• Partner with Security Architecture, IR, Vulnerability Management, and Product Security leads to align intelligence with broader security strategy

Expectations

· This is a full-time, on-site position based in Irving, TX.

· Occasional after-hours support may be required.

· Set the team''s quarterly collection priorities based on a shift in the organization''s threat landscape or business footprint

· Lead intelligence support for a major incident, briefing executive leadership on likely actor, objectives, and containment status

· Negotiate and onboard a new commercial threat intelligence feed, defining success metrics before renewal

· Review and elevate an analyst''s actor profile before it goes to the CISO and board

· Direct a purple team exercise built around a threat actor actively targeting the organization''s sector

Years of Experience

• 6+ years of experience in threat intelligence, security operations, or incident response, including prior experience mentoring or leading analysts

Required Qualifications (Non-Negotiable)  

• Deep working knowledge of MITRE ATT&CK, the intelligence cycle, and structured analytic techniques

• Demonstrated experience producing and delivering intelligence to executive and board-level audiences

• Experience directing threat intelligence platform and vendor strategy, including feed evaluation and management

• Experience partnering with detection engineering, incident response, and vulnerability management on intelligence-driven prioritization

• Strong people-leadership skills, including hiring, coaching, and performance management of analysts

• Excellent written and verbal communication skills, with the ability to translate technical findings into business risk

• Sound analytic judgment, including the ability to state and defend confidence levels under scrutiny

Nice-to-Have Qualifications (Desired but Not Required)

• Threat Intelligence Platforms (TIPs): MISP, ThreatConnect, Anomali, Recorded Future

• SIEM/SOAR: Splunk, Palo Alto Cortex XSOAR

• Malware and sandbox analysis: VirusTotal, Any.Run, Hybrid Analysis, Joe Sandbox

• Frameworks: MITRE ATT&CK, Diamond Model, Cyber Kill Chain, Traffic Light Protocol (TLP)

• OSINT and dark web tooling: Maltego, Shodan, Censys, dark web monitoring services

• Vulnerability and exposure data: CVE/NVD, EPSS, CISA KEV catalog

• Program and reporting: KPI dashboards, ticketing/workflow tools, executive reporting templates

Education & Certification Requirements

• Bachelor''s degree in Cybersecurity, Computer Science, Intelligence Studies, or related field, or equivalent experience

Preferred Industry Experience

· Convenience Retail, Fuel Operations, Supply Chain