Remote opportunity at
CanonicalThreat Intelligence Lead
Canonical wants a full-time Threat Intelligence Lead to take charge of the company's threat intelligence direction and delivery. The role is remote and reports to the…
Career Tools
About This Role
Canonical wants a full-time Threat Intelligence Lead to take charge of the company's threat intelligence direction and delivery. The role is remote and reports to the CISO. The lead identifies which cyber adversaries are going after Canonical and applies what is known about their tactics, techniques and procedures to strengthen products and internal safeguards. Much of the attention goes to adversaries who attack software supply chains, and to broader attack…
Job Description
Canonical wants a full-time Threat Intelligence Lead to take charge of the company's threat intelligence direction and delivery. The role is remote and reports to the CISO.
The lead identifies which cyber adversaries are going after Canonical and applies what is known about their tactics, techniques and procedures to strengthen products and internal safeguards. Much of the attention goes to adversaries who attack software supply chains, and to broader attack trends across open source. Findings go to internal security staff, and engineers receive guidance on spotting and reducing danger.
Canonical software is found in nearly all companies and homes around the globe, which makes it an attractive target. The team's purpose is to protect Canonical and the wider community of organisations that depend on open source software, and the work is judged by how well it helps them stay safe.
The ideal candidate is an experienced threat intelligence leader with a sound grasp of the open source threat landscape, networking and infrastructure, and practical skill with OSINT tools. The person would brief executives, internal teams and customers, and speak for the company in the wider threat intelligence community.
Responsibilities
- Define the threat intelligence strategy and be accountable for its delivery
- Set up and look after open source intelligence (OSINT) research environments
- Develop methods, principles and techniques for OSINT investigation
- Spot and follow targeted intrusion campaigns and emerging actor behaviour using both private and public data sets
- Coordinate efforts to track adversaries and their campaigns
- Brief product and engineering teams on threats and recommend defences
- Assist the OPSEC and IS teams in adopting and refreshing security controls
- Find gaps in intelligence and suggest tools or research to close them
- Present findings to executives, internal stakeholders and outside customers
- Contribute to the threat intelligence community and build Canonical's reputation there
Requirements
- Experience leading threat intelligence work, or in a comparable post
- Up-to-date knowledge of the open source threat landscape, plus networking and infrastructure concepts
- Strong OSINT tooling skills, including Maltego, Shodan, Buscador, OSINT Framework, the Trace Labs OSINT VM and social media scrapers
- Able to map and catalogue adversary tradecraft, often with partial information
- Experience applying threat intelligence to architecture or product decisions
- Communicates complex technical material well to different audiences
- Able to attend company events twice a year, each lasting as long as two weeks
Qualifications
- Portfolio of OSINT scripts, tools or frameworks
- Visible participation in the OSINT community
- Undergraduate qualification in computing, information security or a closely related field
- Certificates such as GOSI, SANS SEC487 or SEC587, or IntelTechniques OSIP
- Work in a technology firm, or in government or military signals intelligence
Core Skills
Benefits
- Pay weighs location, experience and results, and is reviewed annually
- Yearly performance bonus
- Learning allowance of USD 2,000 yearly
- Recognition awards
- Team gatherings in person twice a year
- Annual leave, maternity leave and paternity leave
- Support through an employee assistance scheme
- Priority Pass membership and better travel perks on long-haul company trips
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
Yes. The listing is marked remote, and the role reports to the CISO.
What employment type is it?
It is full-time.
What core skills are required?
Experience leading threat intelligence work, knowledge of the open source threat landscape, and strong skill with OSINT tools.
Is salary stated?
No figure is listed. Pay depends on location, experience and results, with a yearly performance bonus mentioned.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
