Manager, Threat Intelligence

Summary

Threat Intelligence Manager About Mimecast Mimecast is a leading cybersecurity company that secures Human, Data and AI, protecting organizations across the people who work for them, the data they rely on, and the AI systems now woven through how they operate. With over 42,000 customers worldwide, we analyse more than 18 billion security events daily to stop attacks before they cause harm. Our business is to secure Human, Data and AI. People remain both an organization's greatest asset and its most targeted point of attack, the data they create and depend on needs protecting wherever it moves, and the AI systems now embedded in daily work introduce a new surface that has to be defended. Our platform combines advanced threat detection, awareness training, and Incydr data protection to reduce the likelihood and impact of security incidents across all three. The Opportunity The Threat Intelligence Manager oversees the strategic and operational activities of the Threat Intelligence program, ensuring alignment with organizational goals and industry best practices. This role is responsible for managing personnel, maturing intelligence capabilities, driving intelligence-driven decision-making, and fostering cross-departmental collaboration. The manager provides leadership for the organization's cyber threat intelligence (CTI) program, ensuring actionable intelligence is delivered to stakeholders to strengthen the organization's security posture and support informed risk management. What You'll Do - Monitor and analyze the global threat landscape to identify emerging threats, adversary TTPs, vulnerabilities, and industry-specific risks. - Collect, analyze, and produce actionable cyber threat intelligence at the tactical and operational level. - Produce threat reports, indicators of compromise (IOCs), adversary profiles, and briefings for security operations, incident response, and vulnerability management stakeholders. - Track phishing, business email compromise (BEC), and other email-borne social engineering campaigns targeting Mimecast customers. - Analyze phishing kits, malicious URLs, and email-based malware delivery techniques to identify emerging tactics. - Produce intelligence on social engineering trends, including impersonation, pretexting, and credential-harvesting techniques used in email attacks. - Partner with detection engineering to translate email threat intelligence into improved phishing and social engineering detection. - Track and map adversary tactics, techniques, and procedures against frameworks such as MITRE ATT&CK. - Support the integration of threat intelligence into detection engineering, vulnerability prioritization, and other security tooling and workflows. - Help define and refine intelligence requirements and collection priorities. - Use threat intelligence platforms (TIPs) and automation to improve the speed, accuracy, and scale of intelligence production. - Conduct quality reviews of intelligence products to ensure consistency, accuracy, and actionable outcomes. - Act as an intelligence resource during security incidents, providing adversary context and threat assessments to support response. - Track geopolitical events, cybercriminal activity, nation-state operations, and emerging technologies that may impact the organization or our customers. - Maintain working relationships with commercial intelligence vendors, ISACs, and industry-sharing communities to source and validate intelligence. What You'll Bring Experience conducting cyber threat intelligence analysis at the tactical, operational, or strategic level. Working knowledge of the MITRE ATT&CK framework and threat-informed defense concepts. Experience with threat intelligence platforms. Familiarity with OSINT collection techniques and tools. Experience ana

Job Description

Threat Intelligence Manager About Mimecast Mimecast is a leading cybersecurity company that secures Human, Data and AI, protecting organizations across the people who work for them, the data they rely on, and the AI systems now woven through how they operate. With over 42,000 customers worldwide, we analyse more than 18 billion security events daily to stop attacks before they cause harm. Our business is to secure Human, Data and AI. People remain both an organization's greatest asset and its most targeted point of attack, the data they create and depend on needs protecting wherever it moves, and the AI systems now embedded in daily work introduce a new surface that has to be defended. Our platform combines advanced threat detection, awareness training, and Incydr data protection to reduce the likelihood and impact of security incidents across all three. The Opportunity The Threat Intelligence Manager oversees the strategic and operational activities of the Threat Intelligence program, ensuring alignment with organizational goals and industry best practices. This role is responsible for managing personnel, maturing intelligence capabilities, driving intelligence-driven decision-making, and fostering cross-departmental collaboration. The manager provides leadership for the organization's cyber threat intelligence (CTI) program, ensuring actionable intelligence is delivered to stakeholders to strengthen the organization's security posture and support informed risk management. What You'll Do - Monitor and analyze the global threat landscape to identify emerging threats, adversary TTPs, vulnerabilities, and industry-specific risks. - Collect, analyze, and produce actionable cyber threat intelligence at the tactical and operational level. - Produce threat reports, indicators of compromise (IOCs), adversary profiles, and briefings for security operations, incident response, and vulnerability management stakeholders. - Track phishing, business email compromise (BEC), and other email-borne social engineering campaigns targeting Mimecast customers. - Analyze phishing kits, malicious URLs, and email-based malware delivery techniques to identify emerging tactics. - Produce intelligence on social engineering trends, including impersonation, pretexting, and credential-harvesting techniques used in email attacks. - Partner with detection engineering to translate email threat intelligence into improved phishing and social engineering detection. - Track and map adversary tactics, techniques, and procedures against frameworks such as MITRE ATT&CK. - Support the integration of threat intelligence into detection engineering, vulnerability prioritization, and other security tooling and workflows. - Help define and refine intelligence requirements and collection priorities. - Use threat intelligence platforms (TIPs) and automation to improve the speed, accuracy, and scale of intelligence production. - Conduct quality reviews of intelligence products to ensure consistency, accuracy, and actionable outcomes. - Act as an intelligence resource during security incidents, providing adversary context and threat assessments to support response. - Track geopolitical events, cybercriminal activity, nation-state operations, and emerging technologies that may impact the organization or our customers. - Maintain working relationships with commercial intelligence vendors, ISACs, and industry-sharing communities to source and validate intelligence. What You'll Bring Experience conducting cyber threat intelligence analysis at the tactical, operational, or strategic level. Working knowledge of the MITRE ATT&CK framework and threat-informed defense concepts. Experience with threat intelligence platforms. Familiarity with OSINT collection techniques and tools. Experience ana