Threat Intelligence Lead

The Threat Intelligence Lead will own Canonical's threat intelligence strategy and execution, focusing on understanding which cyber threat actors target Canonical and leveraging intelligence on tactics, techniques, and procedures (TTP) to enhance products and internal cybersecurity controls.The Threat Intelligence Lead collaborates with internal stakeholders and the broader cybersecurity community to position Canonical as a thought leader in open-source threat intelligence.This role reports to the CISO and focuses on threat actors targeting software supply chains.What you'll do in this roleBuild and own Canonical's threat intelligence strategy.Build and maintain OSINT research environments.Develop OSINT tradecraft, principles, and techniques.Identify and track targeted intrusion cyber-threats, trends, and new developments by analyzing proprietary and open-source datasets.Collaborate across teams to inform on activity of interest.Coordinate adversary/campaign tracking.Contribute to the wider threat intelligence community, establishing Canonical as a key contributor and thought leader.Work with product and engineering teams to explain cybersecurity threats and advise on mitigation strategies.Work with the OPSEC and IS team to help implement or update security controls prioritizing cyber defence.Identify intelligence gaps and propose new tools and research projects to fill them.Conduct briefings for executives, internal stakeholders and external customers.The successful Threat Intelligence Lead will beAn experienced threat intelligence leader (or similar).Knowledgeable about the current open-source threat landscape and computer networking/infrastructure concepts.Highly competent with OSINT tools (e.g., Buscador, Trace Labs OSINT VM, OSINT Framework, Maltego, Shodan, social-media scraping tools, etc.).Able to identify, organise, catalogue, and track adversary tradecraft trends—even with incomplete data.Experienced using threat intelligence data to influence enterprise architecture or product development decisions.An excellent communicator who can clearly articulate and tailor technical content to diverse audiences.Willing to travel twice a year for company events up to two weeks long.Desired CharacteristicsA professional portfolio of OSINT-related scripts, tools, or frameworks.Demonstrated involvement in the larger OSINT community (share relevant links).Bachelor's degree in computer science, information security, or related field.Certifications in related areas (e.g., GOSI, SANS SEC487 & SEC587, IntelTechniques OSIP).Experience in a tech company or government/military signal-intelligence departments.What we offer youCompetitive total compensation, reviewed annually and more frequently for graduates and associates.Performance-driven annual bonus.Personal learning and development budget of USD 2,000 per year.Recognition rewards and annual compensation reviews.Annual holiday leave, maternity and paternity leave.Employee Assistance Programme.Opportunity to travel to new locations and meet colleagues.Priority Pass and travel upgrades for long-haul company events.We recruit on a global basis and set a very high standard for people joining the company.We expect excellence; to succeed, you must be the best at what you do.Canonical has been a remote-first company since its inception.Canonical is an equal-opportunity employer.We are proud to foster a workplace free from discrimination.Diversity of experience, perspectives, and background create a better work environment and better products.Whatever your identity, we will give your application fair consideration.#J-*****-Ljbffr