A

AstraZeneca

Global pharmaceutical company developing prescription medicines

Director of Cyber Threat Intelligence - Cyber Threat Intelligence

Security Operations & Incident ResponseUpdated on Nov 6
Full-timeGaithersburg, MD, USA

About the Job

Requirements

  • At least 10 years of experience in cyber threat intelligence, detection engineering, incident response, or related domains, including at least 5 years leading technical CTI teams in global enterprises.
  • Demonstrated ability to set vision, influence strategy, and deliver outcomes tied to enterprise risk reduction.
  • Proven ownership of adversary-centric cyber threat intelligence programs that drive vulnerability prioritization, detections-as-code, hunts, and incident response, with data-driven decisions and clear trade-offs and confidence levels.
  • Deep expertise mapping tactics, techniques, and procedures to MITRE ATT&CK Enterprise and ICS, defining coverage strategies, translating gaps into high-fidelity detections and hunt hypotheses, and working in industrial or operational technology contexts.
  • Hands-on experience delivering end-to-end attack paths across IT-to-OT pivots, clinical platforms, and R&D environments; validating paths through purple-team exercises or adversary emulation; and translating findings into prioritized control roadmaps and measurable risk reduction.
  • Experience designing and operating tailored actor scoring based on intent, capability, tactics/techniques/procedures emergence and prevalence, organizational exposure to CVEs, and global events; maintaining dynamic watchlists and escalation triggers.
  • Experience applying the Diamond Model and complementary attribution frameworks, documenting hypotheses, caveats, disconfirming evidence, and confidence statements, and producing reusable actor profiles and pivot paths.
  • Experience building mean time-to-impact metrics per actor and comparing them with incident response mean time-to-containment to guide control improvements and track program effectiveness.
  • Experience delivering contextual CVE analysis, including exploitability, weaponization, external scanning telemetry, and compensating controls, and risk-based patch recommendations across IT, OT/ICS, clinical, and lab environments.
  • Experience co-developing detections-as-code using tools such as Sigma, KQL, or SPL; tuning content to reduce false positives; and closing ATT&CK coverage gaps using feedback from hunts and incidents.
  • Experience providing real-time adversary context, kill-chain reconstruction, containment recommendations, and post-incident retrospectives that inform detection and architectural improvements.
  • Experience operating dark web and closed-source monitoring; integrating findings into TIP/SIEM/EDR pipelines; managing indicator lifecycles; automating enrichment; and measuring source fidelity and bias.
  • Ability to communicate complex technical intelligence clearly to executives and cross-functional partners, including Vulnerability Management, Detection Engineering, SOC/IR, OT Security, Clinical Ops, and Research IT, and to influence without authority.
  • A bachelor's degree in a relevant field such as Computer Science, Information Security, or Intelligence Studies, or equivalent experience.

Responsibilities

  • Define the cyber threat intelligence vision, operating model, and roadmap in alignment with enterprise cyber risk reduction, with emphasis on manufacturing continuity, clinical data integrity, and R&D intellectual property protection.
  • Design and operate an adversary-prioritization scoring framework using intent, capability, relevance, tactics/techniques/procedures emergence and prevalence, organizational exposure to known vulnerabilities/CVEs, and global events; maintain dynamic watchlists and escalation triggers.
  • Implement analytic methods to estimate mean time-to-impact per adversary using internal telemetry, historical incidents, industry reporting, and confidence levels; compare results with incident response mean time-to-containment to drive control improvements.
  • Build and maintain end-to-end attack-path models from initial access to material impact across IT-to-OT pivots, clinical platforms, and R&D environments; map paths to MITRE ATT&CK Enterprise and ICS, identify control gaps and choke points, derive detections-as-code and hunt hypotheses, and support purple-team exercises and adversary emulation.
  • Establish monitoring of dark web forums, marketplaces, breach dumps, and closed channels for emerging tactics, techniques, and procedures, credential leaks, data exposure, access-broker listings, and targeting of manufacturing, clinical, or R&D assets; integrate validated findings into TIP/SIEM pipelines, initiate takedown requests where feasible, and deliver rapid advisories with confidence ratings and specific actions for Vulnerability Management, Detection Engineering, and Incident Response.
  • Deliver risk insights for CROs, CMOs, logistics providers, and technology vendors; monitor credential leakage and domain spoofing; and support or coordinate takedown operations when needed.
  • Lead structured attribution using the Diamond Model and complementary frameworks; correlate tactics, techniques, and procedures, tooling lineage, code reuse, infrastructure overlaps, and victimology with confidence levels and analytic caveats; document hypotheses, alternative explanations, and disconfirming evidence; and produce reusable actor profiles and pivot paths.
  • Partner with Vulnerability Management to contextualize CVEs, including exploitability, weaponization, external scanning telemetry, and compensating controls, and deliver risk-based patch prioritization across IT/OT, clinical platforms, and lab environments.
  • Support Detection Engineering by developing detection use cases for the detections-as-code pipeline, mapping ATT&CK coverage, tuning content, reducing false positives, and using feedback from hunts and incidents to improve detection quality.
  • Provide real-time adversary context to GSOC and Incident Response, including technical kill-chain reconstruction, containment recommendations, and countermeasures; produce post-incident intelligence retrospectives and detection or architecture improvements.
  • Produce daily threat intelligence highlights, threat actor and campaign profiles, quarterly threat briefings, and ad hoc intelligence products with quantified risk narratives for senior leadership aligned to regulatory expectations and business impact.
  • Optimize integrations across TIP, SIEM, EDR, case management, and telemetry; manage indicator lifecycles, automate enrichment, and measure source fidelity and bias.
  • Lead participation with sector bodies such as H-ISAC, peer-sharing groups, and government and industry partners; track global events and translate them into actionable enterprise guidance.
  • Recruit, mentor, and develop a diverse team of CTI analysts; build career paths, training plans, and knowledge-sharing practices; and foster technical excellence and clear, actionable communication.
  • Demonstrate a mindset of embracing, adopting, and appropriately using AI and digital tools in day-to-day work to improve outcomes and ways of working.

Desired Qualifications

  • Experience in pharmaceuticals, life sciences, healthcare, or manufacturing; familiarity with GMP/CSV, clinical data obligations, and R&D intellectual property protection.
  • Hands-on experience with MES, SCADA, or PLC ecosystems; use of ATT&CK for ICS; and understanding of OT-safe response practices and production continuity implications.
  • Exposure to CTMS, EDC, IRT, ELN, LIMS, HPC, and data lake environments, and experience safeguarding data integrity and sensitive research or intellectual property.
  • Experience building dashboards that track mean time-to-impact by actor, ATT&CK coverage indices, intelligence-informed patch service-level agreements, hunter return on investment, and executive risk narratives; experience presenting to senior leadership and risk committees.
  • Experience with TIP administration, SIEM/EDR content engineering, enrichment and orchestration pipelines, case-management integration, and indicator-lifecycle automation at enterprise scale.
  • Ability to translate attack paths into quantified risk scenarios and prioritized control investments aligned to business objectives and critical assets.
  • Active engagement with H-ISAC/ISAOs and government or industry partners, with a record of converting global cyber events into enterprise defenses and executive guidance.
  • One or more of GCTI, GREM, GRID, GCIH, or CISSP certifications, or equivalent demonstrated expertise.
  • Experience building diverse, high-performing teams; establishing career paths and coaching frameworks; and fostering analytic rigor, technical excellence, and continuous improvement.

About the Company

AstraZeneca

Global pharmaceutical company developing prescription medicines

AstraZeneca develops and markets prescription medicines and vaccines worldwide, with a focus on oncology, cardiovascular/metabolic, respiratory, and infectious diseases. Its products work by targeting specific biological pathways or cells, using small-molecule therapies, biologics, and vaccines to treat diseases or prevent infections. It differentiates itself through its dual heritage from Sweden and the UK, a broad pipeline, and strong R&D and collaborations that move from discovery to patient access. Its goal is to improve people’s health by discovering, developing, and delivering medicines and vaccines to patients worldwide.

Company size
10,001+
Company stage
IPO
Headquarters
Cambridge, United Kingdom
Founded
1913

Recently Posted Jobs

Explore more opportunities at AstraZeneca

See more jobs