Threat Intelligence Specialist

Join to apply for the Threat Intelligence Specialist role at BAE Systems.

Hybrid – can be based from Frimley, London or Manchester offices; required minimum one day per week in office.

BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts across 10 countries, collecting and analysing data to enable governments, nation states, armed forces and businesses to unlock digital advantage.

We are looking for an experienced Threat Intelligence Specialist focused on threats to the Middle East region as part of our global Threat Intelligence team.

• Investigating cyber intrusions and threat activity in the Middle East region.
• Discover, analyse, document, and track advanced threat actor campaigns.
• Conduct research on threat actors (from hacktivist to criminal to state) and their tools, techniques, and procedures (TTPs) using commercial and open sources.
• Produce finished intelligence reports related to state and criminal threats, with insights into attacker techniques and identified campaigns, including actionable mitigation and detection guidance.
• Work in a collaborative environment with other technical specialists, intelligence analysts, and customer‑facing consultants.
• Support intelligence analysts with malware analysis and incident responders with technical expertise.

• Experience tracking actors or campaigns and their associated tactics, techniques, and tools.
• Strong understanding of the cyber threat landscape and ability to communicate relevant insights to customers.
• Self‑starter with ability to identify problems early and develop solutions using own initiative.
• Technical skills with interest in one or more of: open source intelligence investigations, digital forensics, infrastructure analysis, threat hunting, or malware reverse engineering.
• Understanding of networking fundamentals such as HTTP, TCP/IP, DNS and other core protocols.
• Experience writing Python scripts.
• Ability to document and explain technical details clearly and concisely in writing and graphics for technical and non‑technical audiences.

• Experience querying commercial and open sources, such as Shodan, Censys, etc.
• Familiarity with malware sandboxing and using the output to pivot and find additional activity.
• Experience in threat hunting and creating file/network traffic signatures using Yara and Snort.
• Experience with cloud environments, including AWS and Azure.
• Experience writing Python scripts.

Competitive pension scheme, employee share plans, extensive range of flexible discounted health, wellbeing & lifestyle benefits, green car scheme, private health plans, shopping discounts, and eligibility for an annual incentive.

We are an inclusive culture that values diversity, integrity, merit, and empowers you to fulfil your potential. We welcome people from all backgrounds and provide reasonable adjustments for people with disabilities or health conditions. Many roles are subject to security and export control restrictions, requiring baseline personnel security and potentially higher levels of national security vetting.

We are embracing hybrid working – commuting may vary, working from home or client sites. We focus on collaboration, flexibility, and well‑being, with a culture built on diversity and inclusion.