> Markdown version of [/jobs/ext/2603605-manager-threat-intelligence](https://www.wearedevelopers.com/jobs/ext/2603605-manager-threat-intelligence). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Manager, Threat Intelligence - **Company:** The Coca-Cola Company - **Location:** Atlanta, GA, United States - **Experience:** Expert - **Salary:** $124,600.0 - $148,200.0 - **Contract:** Permanent contract - **Skills:** Agile Methodology, Data Analysis, Cyber Security, Information Systems, Computer Programming, Computer Telephony Integration, System Configuration, Data Presentation, Systems Analysis, Python (Programming Language), Windows PowerShell, Systems Development Life Cycle, Security Information and Event Management, Software Engineering, Software Requirements Analysis, SQL Databases, Systems Integration, Delivery Pipeline, Mitre Att&ck, Malware, Cyber Threat Analysis, Information Technology, Cyber Warfare, Security Orchestration, Automation & Response - **Published:** August 6, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=bd735fa7ac704634 ## About the Role * Minimum 6-10 years of progressive cybersecurity experience, with a significant portion in cyber threat intelligence roles within large or complex organizations. * Demonstrated experience in the full threat intelligence lifecycle, including collection, analysis, production, and dissemination of tactical, operational, and strategic intelligence. * Hands-on experience building CTI automation pipelines, including integration with SIEM, SOAR, and detection platforms. * Proficiency with threat intelligence platforms and tools such as CrowdStrike Falcon Intelligence, Google Threat Intelligence, Recorded Future, MISP, or similar. * Strong working knowledge of adversary tradecraft, MITRE ATT&CK framework, indicator management, and malware analysis fundamentals. * Experience providing operational direction to managed service providers, contractors, or distributed analyst teams. * Familiarity with intelligence-sharing standards and protocols such as STIX/TAXII, and participation in ISACs or similar communities. * Strong written and verbal communication skills, with the ability to produce intelligence products for audiences ranging from SOC analysts to senior executives. * Relevant certifications such as GCTI, GIAC (any), CISSP, CISM, or CTIA are preferred. * Scripting and automation skills (Python, PowerShell, or equivalent) for building intelligence workflows and integrations. Education * Bachelor's degree in Cybersecurity, Intelligence Studies, Computer Science, Information Systems, or related field required. * Master's degree or relevant professional certification (GCTI, CISSP, CISM, or equivalent) highly desirable., Agile Methodology, Business Requirements, Communication, Computer Programming, Configuring (Inactive), Data Analysis, Financial Processing, Information Systems, Software Development, Structured Query Language (SQL), Systems Analysis, Systems Development Lifecycle (SDLC), Teamwork, Test Environments, Troubleshooting, Waterfall Model, Workflow Management ## Description The Manager, Threat Intelligence is The Coca-Cola Company's hands-on leader for cyber threat intelligence (CTI) operations. This role is responsible for sourcing, producing, and disseminating actionable threat intelligence that informs the Company's defensive posture, supports incident investigations, and enables proactive risk decisions across the Coca-Cola System. The Manager builds and operates the intelligence pipelines, automation, and analyst workflows that keep the Company ahead of evolving adversary tradecraft., Reporting to the Senior Manager, Cyber Threat, this is an individual-contributor role that also provides day-to-day operational leadership of the managed security service provider (MSSP) threat intelligence analysts. The Manager sets priorities, maintains quality standards, and ensures the MSSP team delivers timely, relevant, and accurate intelligence products. The role partners closely with Cybersecurity Operations, Incident Response, Threat Simulation, and external intelligence-sharing communities to ensure threat intelligence is integrated into every layer of the Company's cyber defense., Threat Intelligence Operations * Lead the end-to-end cyber threat intelligence lifecycle: requirements definition, collection, processing, analysis, production, and dissemination. * Produce tactical, operational, and strategic intelligence products tailored to diverse audiences, from SOC analysts to senior leadership. * Monitor the threat landscape continuously for adversary activity, campaigns, vulnerabilities, and trends relevant to The Coca-Cola Company, its subsidiaries, bottling partners, and supply chain. * Support incident response investigations with real-time intelligence, adversary attribution, indicators of compromise, and contextual analysis. * Maintain and curate threat intelligence platforms and feeds, ensuring data quality, relevance, and timely integration into defensive tooling. CTI Automation & Engineering * Design, build, and maintain automated intelligence collection, enrichment, correlation, and dissemination pipelines. * Integrate threat intelligence feeds and platforms with SIEM, SOAR, EDR, and other security tools to enable automated detection, blocking, and alerting. * Develop and maintain custom tooling, scripts, and integrations that improve the speed and accuracy of intelligence operations. * Evaluate and recommend new intelligence sources, tools, and technologies to enhance coverage and reduce manual effort. MSSP Analyst Leadership * Provide day-to-day operational direction to MSSP threat intelligence analysts, setting priorities, reviewing deliverables, and maintaining quality standards. * Define standard operating procedures, playbooks, and training materials for the MSSP team. * Monitor MSSP performance against service-level expectations and drive continuous improvement. Intelligence Sharing & Partnerships * Support Coca-Cola System-wide dissemination of cyber threat intelligence to subsidiaries, bottling partners, and key stakeholders. * Engage with external intelligence-sharing communities, ISACs, government agencies, and industry peers to exchange threat intelligence and stay current on adversary activity. * Coordinate with law enforcement and external partners on threat investigations and takedown efforts as needed. Reporting & Continuous Improvement * Produce clear, executive-framed threat intelligence briefings and reports for Cyber Threat leadership, the CISO, and senior management. * Track and report on intelligence program metrics, including coverage, timeliness, accuracy, and impact on defensive outcomes. * Continuously improve intelligence processes, templates, and tooling based on feedback and lessons learned., * Data-Driven Storytelling - Translate complex threat data into clear, actionable briefings and reports for technical and executive audiences. Reporting Relationship Reports to the Senior Manager, Cyber Threat, within the Cyber Defense team of the Chief Information Security Office (CISO) organization. No direct reports. Provides day-to-day operational leadership of MSSP threat intelligence analysts. ## Related Videos - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Data Science in Retail](https://www.wearedevelopers.com/videos/586-data-science-in-retail) - [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Data Science on Software Data](https://www.wearedevelopers.com/videos/162-data-science-on-software-data) - [Full Spectrum File Uploads](https://www.wearedevelopers.com/videos/870-full-spectrum-file-uploads) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf)