Security Threat Intelligence Analyst

Start free →

Or apply yourself on the official page →

About the role

WPP is the trusted growth partner for the world’s leading brands. We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise. Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. For more information, visit WPP.com. Why we're hiring: The Threat Intelligence Engineer is responsible for engineering, operating, and continuously improving WPP’s cyber threat intelligence platforms, integrations, and enrichment pipelines. This role focuses on how threat intelligence is ingested, processed, correlated, and operationalised at scale across security operations. The position is an engineering-led individual contributor role with no people management responsibilities. What you'll be doing: • Engineer and maintain threat intelligence platforms and data sources. • Design ingestion pipelines for external, internal, and open-source intelligence feeds. • Maintain centralised repositories for indicators, threat actor artefacts, and metadata. • Integrate threat intelligence into SIEM, SOAR, EDR/XDR, email, identity, and cloud tooling. • Build enrichment pipelines linking incidents to threat actors, campaigns, and TTPs. • Partner with Automation Engineering to ensure intelligence is automation-first. • Provide engineered intelligence support to Incident Response during active incidents. • Enable Detection Engineering and Threat Hunting with structured intelligence outputs. • Support Vulnerability Management with intelligence on actively exploited vulnerabilities. • Build automation hooks between CTI platforms and SOAR workflows. • Enable safe, explainable intelligence use for agentic and automated decision support. • Improve intelligence delivery speed, accuracy, and signal-to-noise ratio. • Define and maintain engineering standards for CTI integrations. • Monitor feed efficacy and deprecate low-value intelligence sources. • Support audits, assurance, and documentation activities related to CTI. What you'll need: • Experience engineering or operating enterprise threat intelligence platforms. • Hands-on experience integrating CTI with SIEM, SOAR, or EDR/XDR. • Strong capability in APIs, data transformation, enrichment logic, and automation. • Solid understanding of threat intelligence concepts and operationalisation. • Experience with Google Threat Intelligence, Recorded Future, or similar platforms. • Familiarity with MITRE ATT&CK and threat-led detection models. • Experience supporting incident response or detection engineering teams. • Relevant certifications (GCTI, GCIA, GCED, cloud security certifications). • Fluent in written and spoken English. Who you are: You're open : We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working. You're optimistic : We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected. You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creati

View the official posting →