Threat Intelligence Lead

The Threat Intelligence Lead is responsible for building, leading, and operationalizing a proactive threat intelligence program that enables the organization to anticipate, detect, and respond to cyber threats. This role involves strategic analysis, threat hunting, intelligence dissemination, and cross-functional collaboration to enhance the organization’s security posture. The lead will oversee the collection, analysis, and production of actionable intelligence tailored to the organization’s risk profile and ensure its integration into security operations, incident response, and business decision-making.

Location
Riyadh, Riyadh, Saudi Arabia

Key Responsibilities

• Lead the company’s Threat Intelligence program, roadmap, and operating model to support business risk reduction and regulatory alignment.
• Define intelligence requirements and priorities focused on fintech/payment threats, fraud ecosystems, and emerging risks.
• Collect and analyze intel from internal telemetry and external sources (commercial feeds, OSINT, dark web, sector sharing).
• Produce actionable outputs: IOCs/IOAs, threat actor profiles, campaign tracking, and executive-ready briefings.
• Embed intelligence into SOC, incident response, threat hunting, vulnerability management, and detection engineering.
• Drive CTI tooling and automation (TIP/SIEM/SOAR integrations) to improve speed, accuracy, and signal quality.
• Coordinate secure intel sharing with regulators and trusted partners; ensure audit-ready documentation.
• Mentor CTI analysts and set standards for intel tradecraft, QA, and continuous improvement.

Qualifications

• Bachelor’s in Cybersecurity, Computer Science, or related field (Master’s a plus).
• 7–10+ years in CTI / SOC / threat hunting / incident response, with 2–3+ years leading CTI programs or teams (fintech/financial sector preferred).
• Strong expertise in intelligence lifecycle, threat actor/TTP analysis, MITRE ATT&CK, and campaign/malware tracking.
• Hands-on with TIP, SIEM, SOAR, OSINT/dark-web tooling, and enrichment/automation workflows.