> Markdown version of [/jobs/ext/2009723-cyber-threat-intelligence-analyst](https://www.wearedevelopers.com/jobs/ext/2009723-cyber-threat-intelligence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Threat Intelligence Analyst

- **Company:** Lloyds Banking Group
- **Location:** Milton Bridge, UK
- **Salary:** £48,987.0 - £54,430.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Computer Telephony Integration, Graph Database, Data Intelligence, Open Source Intelligence, Phishing, Mitre Att&ck, Cyber Threat Analysis, Cybercrime
- **Published:** August 10, 2026
- **Apply:** https://jobs.theguardian.com/job/10170185/cyber-threat-intelligence-analyst/

## About the Role

* Understanding of cyber threat intelligence concepts, threat actor monitoring, campaign evaluation, intelligence lifecycle oversight, and intelligence documentation.
 * Strong technical curiosity and desire to continuously learn new technologies and analytical approaches.
 * Experience examining threat infrastructure, indicators of compromise, adversary TTPs, phishing activity, malware campaigns, or cyber criminal ecosystems.
 * Strong analytical approach with the ability to assess technical threat information and communicate findings clearly.
 * Understanding of APIs, data enrichment pipelines, workflow automation, and intelligence data management.
 * Experience applying OSINT techniques as part of structured intelligence collection and analysis activities to develop actionable intelligence on threat actors, infrastructure, data breaches, and emerging threats.

And any experience of these would be great

 * Knowledge of MITRE ATT&CK, Diamond Model, Cyber Kill Chain, STIX/TAXII, and structured analytic techniques.
 * Experience building enrichment or collection workflows using APIs.
 * Experience using graph databases, knowledge graphs, or relationship analysis platforms.
 * Understanding of cloud-hosted infrastructure, adversary infrastructure abuse, and cybercrime ecosystem monitoring.

We know that great talent comes from many backgrounds. Whilst this job advert may reference specific years of experience, we recognise that skills are developed in many ways, so if you have relevant, transferable experience, we encourage you to apply.

## Description

In this role you'll be conducting intelligence collection, monitoring infrastructure, analysing threat actors, and investigating campaigns. These activities help pinpoint threats relevant to the Group and assist in making timely operational decisions.

Alongside core intelligence responsibilities, you will help advance automated intelligence workflows, AI-assisted analysis capabilities, and intelligence tooling that boost the speed, quality, and scalability of CTI operations.

The role provides the chance to build expertise in threat actor tracking, infrastructure analysis, CTI platforms, automation, AI, and intelligence engineering while directly supporting cyber defence operations.

Why join us?

We're investing billions in our people, places and tech to change the way we meet the needs of our 28 million customers. We're growing, and we'd love you to be part of the journey., Our ambition is to be the leading UK business for diversity, equity and inclusion supporting our customers, colleagues and communities, and we're committed to creating an environment in which everyone can thrive, learn and develop.


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls)
- [Getting under the skin: The Social Engineering techniques](https://www.wearedevelopers.com/videos/38-getting-under-the-skin-the-social-engineering-techniques)
- [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)

## Related Articles

- [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk)
- [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)
- [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)