Head of Threat Intelligence and Brand Protection

Outbreach is looking for a Head of Threat Intelligence and Brand Protection to own our intelligence capability end to end. This is a build role. You would be the function on day one, with an analyst seat and a brand protection seat to recruit behind you. The work splits three ways. It enriches live incidents while they are running, it feeds a daily executive risk briefing, and it sits behind Outbreach Intelligence as a productised service our clients buy. Brand protection sits with the same function: fraudulent domains, account and brand takeover, intellectual property theft and social media takedowns. Key Responsibilities

• Incident enrichment: own the intelligence picture that supports live incident response, working alongside the Response Desk and Forensics.
• Executive briefing: produce and own the daily executive risk briefing, to a publication standard and to a deadline.
• Product ownership: own Outbreach Intelligence as a client facing service, including what it covers, what it costs to produce and what clients receive.
• Actor tracking: run threat actor tracking and attribution work, with confidence language that stands up when a report reaches an insurer or a regulator.
• Brand protection: own the brand protection service line, including monitoring, evidence gathering, takedown requests and registrar and platform escalation.
• Tooling and sources: maintain the intelligence tooling and source estate, including commercial feeds and the open source tradecraft behind them.
• Technical standards: produce IOC sets to the STIX 2.1 taxonomy and map activity to MITRE ATT&CK against specific observed behaviour rather than generic descriptions.
• Team building: recruit and then lead the Intelligence Analyst and Brand Protection Manager seats.
• Representation: represent the intelligence view to clients, at briefings and occasionally on stage. Skills and Experience
• Minimum 5 years cyber security experience is required for this role.
• Real threat intelligence experience from a vendor, a national body, law enforcement, the military or a mature in house team.
• Structured analytic techniques, source evaluation and calibrated confidence language you can explain and defend.
• Able to write for an executive audience under time pressure. The briefing goes out whether or not the week has been kind.
• Working knowledge of ransomware and extortion ecosystems, initial access brokers and the criminal service economy.
• Practical open source investigation, including infrastructure and domain analysis.
• Comfortable working directly into a live incident rather than at arm's length from it.
• This function has no team on day one, and the first version of everything will be yours to write.
• Right to work in the UK. Highly desirable, but not essential
• Experience of domain takedowns, registrar abuse processes or platform escalation routes.
• Experience running or contributing to an intelligence sharing community.
• Malware analysis or reverse engineering exposure.
• A second language, particularly Arabic or Russian.
• Published work, or a track record of speaking on threat intelligence. This is the right role for someone who wants to own a capability rather than contribute to one. There is an on call element, because intelligence support to a live incident does not wait for office hours.