Head of Threat Intelligence and Brand Protection

Head of Threat Intelligence and Brand Protection

Remote, UK Based on experience Permanent

Outbreach is seeking a Head of Threat Intelligence and Brand Protection to own our intelligence capability end to end.

Outbreach is looking for a Head of Threat Intelligence and Brand Protection to own our intelligence capability end to end. This is a build role. You would be the function on day one, with an analyst seat and a brand protection seat to recruit behind you. The work splits three ways. It enriches live incidents while they are running, it feeds a daily executive risk briefing, and it sits behind Outbreach Intelligence as a productised service our clients buy. Brand protection sits with the same function: fraudulent domains, account and brand takeover, intellectual property theft and social media takedowns.

Key Responsibilities:

• Incident Enrichment: Own the intelligence picture that supports live incident response, working alongside the Response Desk and Forensics.
• Executive Briefing: Produce and own the daily executive risk briefing, to a publication standard and to a deadline.
• Product Ownership: Own Outbreach Intelligence as a client facing service, including what it covers, what it costs to produce and what clients receive.
• Actor Tracking: Run threat actor tracking and attribution work, with confidence language that stands up when a report reaches an insurer or a regulator.
• Brand Protection: Own the brand protection service line, including monitoring, evidence gathering, takedown requests and registrar and platform escalation.
• Tooling and Sources: Maintain the intelligence tooling and source estate, including commercial feeds and the open source tradecraft behind them.
• Technical Standards: Produce IOC sets to the STIX 2.1 taxonomy and map activity to MITRE ATT&CK against specific observed behaviour rather than generic descriptions.
• Team Building: Recruit and then lead the Intelligence Analyst and Brand Protection Manager seats.
• Representation: Represent the intelligence view to clients, at briefings and occasionally on stage.

Skills and Experience:

• Intelligence Background: Real threat intelligence experience from a vendor, a national body, law enforcement, the military or a mature in house team.
• Analytical Tradecraft: Structured analytic techniques, source evaluation and calibrated confidence language you can explain and defend.
• Executive Writing: Able to write for an executive audience under time pressure. The briefing goes out whether or not the week has been kind.
• Threat Landscape: Working knowledge of ransomware and extortion ecosystems, initial access brokers and the criminal service economy.
• Investigation Skills: Practical open source investigation, including infrastructure and domain analysis.
• Operational Fit: Comfortable working directly into a live incident rather than at arm's length from it.
• Self Sufficiency: This function has no team on day one, and the first version of everything will be yours to write.
• Eligibility: Right to work in the UK.

Highly Desirable (But Not Essential):

• Experience of domain takedowns, registrar abuse processes or platform escalation routes.
• Experience running or contributing to an intelligence sharing community.
• Malware analysis or reverse engineering exposure.
• A second language, particularly Arabic or Russian.
• Published work, or a track record of speaking on threat intelligence.

This is the right role for someone who wants to own a capability rather than contribute to one. There is an on call element, because intelligence support to a live incident does not wait for office hours.