Internal and External Threat Intelligence Manager

Team IT

Location: AMAZE Central - Holborn

County: Greater London

Ref #: POS_18473

Closing Date: 04-Nov-2026

At Metro Bank, we believe the best banking experience starts with people who genuinely care. We’re not just delivering banking services - we’re building trust through authentic connections. Here, our people come first; our colleagues are part of a team that values individuality, collaboration, and long-standing relationships. We are also all about balance so most of our jobs offer the opportunity for hybrid working built around your role and home life, wherever possible.

What you will do:

• Deliver specialist cyber threat intelligence outputs that are timely, relevant, accurate, and aligned to agreed intelligence requirements.
• Translate external and internal threat information into tactical and operational intelligence for SOC, detection engineering, threat hunting, incident response, vulnerability management, architecture, and security engineering teams.
• Maintain threat actor, campaign, sector, horizon, and emerging threat assessments relevant to financial services, including AI-enabled cyber activity, digital channels, suppliers, cloud services, colleagues, and customers.
• Produce clear CTI reporting, briefings, and recommendations that help stakeholders prioritise detection, response, remediation, and control improvement activity.
• Support teams responsible for insider risk, fraud, physical security, investigations, HR, Legal, and Risk with relevant intelligence, indicators, trends, and external context; ownership of those domains remains with the accountable teams.
• Contribute intelligence-led input into horizon threats, AI-enabled attack techniques, emerging threat, zero-day, exploit activity, and high-risk vulnerability discussions, without owning vulnerability management decisions, remediation plans, or formal risk acceptance.
• Operate and suggest improvements to CTI processes, tooling, source management, reporting standards, and metrics within the strategic direction set by senior management.
• Support operational management of CTI suppliers, feeds, and intelligence-sharing relationships, escalating service, budget, or strategic issues to senior management.
• Promote consistent analytical standards through peer review, good practice sharing, and clear documentation of intelligence judgements.
• Provide evidence, insight, and management information to support senior manager ownership of cyber defence strategy, risk posture, regulatory engagement, and executive reporting.

And... we are a bank so risk is a part of everything we do. We love people who take responsibility, do the right thing for customers, colleagues and Metro Bank and have the ability to call out any concerns.

What you will need:

• A minimum of 6-8 years’ experience within cyber security, threat intelligence, security operations, incident response, vulnerability management, or a closely related discipline.
• Recognised industry qualification such as CISSP, CISM, CISMP, GCTI, GCIH, GCIA, GCFA, or equivalent experience.
• Experience with threat intelligence platforms, OSINT tools, reporting frameworks, and intelligence-sharing communities is highly desirable.
• Experience with threat intelligence platforms, OSINT tools, and reporting for both technical and executive audiences.
• Strong understanding of cyber threat intelligence lifecycle principles, including direction, collection, processing, analysis, dissemination, and feedback.
• Strong understanding of threat actor behaviours, MITRE ATT&CK, cyber kill chain concepts, intelligence confidence levels, source reliability, and analytical bias.
• Knowledge of the financial services threat landscape, including cyber crime, ransomware, supply chain compromise, credential theft, fraud-enabling cyber activity, AI-enabled threats, and other emerging technology risks.
• Awareness of insider and internal threat indicators, control environments, and investigation support needs, with clear understanding that ownership sits with the relevant accountable teams.
• Understanding of horizon scanning methods and emerging technology threat themes, including malicious use of AI, synthetic identity, deepfake-enabled social engineering, automated reconnaissance, and AI-assisted phishing or malware development.
• Knowledge of SOC operations, detection engineering, incident response, vulnerability management, cloud security, identity, and data protection controls.
• Understanding of regulatory expectations relevant to cyber resilience, operational resilience, risk management, and evidence-based control improvement.

Our promise to you…

• We will make sure that you are well-rewarded by providing you with a competitive salary, discretionary annual bonus, and a wide range of benefits, including generous holiday allowance, attractive pension scheme, healthcare, life assurance, and a number of colleague discounts!
• We will give you the training to ensure you succeed in your role and plenty of internal opportunities to progress your career (around 40% of our recruitment comes from internal promotions!

Important Footnote: Diverse teams really are the best teams. We know that candidates (especially women, research tells us) may be put off applying for a job unless they can tick every box. We also know that ‘normal’ office hours aren’t always doable, and while we can’t accommodate every flexible working request we are happy to be asked. So if you are excited about working with us and think you can do much of what we are looking for but aren’t sure if you are 100% there yet… why not give it a whirl? Good luck!