Analyst, Cyber Threat Intelligence

Analyst, Cyber Threat Intelligence – S-RM

Join to apply for the Analyst, Cyber Threat Intelligence role at S-RM.

S-RM is a global intelligence and cyber security consultancy. Since 2005, we've helped some of the most demanding clients in the world solve some of their toughest information security challenges. We are committed to developing sharp, curious, driven individuals who think critically, solve complex problems, and achieve success. Work is about the lives and careers it helps build. We invest in our people's wellbeing, learning, and ideas every day.

Our Cyber Security division is the fastest-growing part of S-RM. The cyber sector is always evolving, and our Incident Response and Managed Services practices are in more demand than ever. We build a team to meet this challenge, quick to respond, innovate, and improve. We empower ideas and offer support across the team with no bureaucracy.

Cyber Threat Intelligence (CTI) is an integral part of our Incident Response (IR) and Managed Services practices. As a CTI analyst you will be a critical part of our wider cyber team's success. You will work across the full intelligence cycle to help our clients respond and recover from security incidents, and stay ahead of evolving threats, including:

• Threat Actor Intelligence: Track developments in the ransomware and cybercrime ecosystem, write and update profiles on key threat actors shared with clients and externally as thought leadership.
• Threat Actor Engagement: Monitor leak sites and negotiation portals across our global IR cases, inform case leads of regular developments, and research attestations on sanctions exposure for threat actors.
• Dark Web Monitoring: Use threat intelligence platforms to conduct targeted research on the dark web, set up and deliver regular monitoring engagements, and assist with renewals.
• Technical IOC Management: Collate technical indicators of compromise from across our global IR team, enrich and classify them, and disseminate to improve operational effectiveness.
• Incident Data Collection and Analysis: Ensure accuracy and consistency of incident data from IR engagements, manage the dataset, and analyze to produce reporting on trends and insights for presentations, events, and training.
• CTI-led Analysis: Conduct in-depth investigations with strong threat intelligence component, and draft client-facing reports.
• Blockchain Analysis: Trace ransom payments to identify sanctions exposure or compliance risks, and draft findings for clients.
• Thought Leadership: Contribute to public write-ups and presentations on new vulnerabilities, trends, and threat actor techniques.
• Domain Expertise Development: Grow cyber expertise and share it with the wider team through internal initiatives and programs.
• Business Development Support: Cultivate and manage close relationships with external partners, share intelligence, and identify business development opportunities.

• Variety of casework: Respond to a wide range of incidents for public and corporate clients.
• Range of opportunities: Broadening security awareness into testing and advisory projects, deepening CTI and IR expertise.
• Flexible working practices: Support high‑pressure incident work with flexible options to maintain work/life balance.

Candidates with the following qualifications and experience are likely to succeed as Cyber Threat Intelligence Analysts at S-RM. We value candidates strong in a few areas and interested in others; apply if you’re passionate about the role.

• Excellent written and verbal communication skills to produce clear, concise reports.
• Strong analytical and problem‑solving skills, working with incomplete, ambiguous, or conflicting information.
• Understanding of foundational cyber concepts such as common attack vectors, security terminology, and threat actor motivations.
• Understanding of core intelligence concepts, lifecycle, requirements gathering, and tactical/operational/strategic outputs.
• A demonstrated interest in cyber threats, particularly financially motivated activity such as ransomware and extortion.

• Academic…