Remote opportunity at
CanonicalThreat Intelligence Lead
Canonical, the publisher of Ubuntu and a remote-first company since 2004, is seeking a Threat Intelligence Lead to direct its threat intelligence operations. In this role,…
Career Tools
About This Role
Canonical, the publisher of Ubuntu and a remote-first company since 2004, is seeking a Threat Intelligence Lead to direct its threat intelligence operations. In this role, reporting to the CISO, the successful candidate will shape the overall strategy, manage open-source intelligence environments, track targeted cyber threats, and guide internal product and engineering teams on mitigation tactics. Canonical creates software that powers AI, IoT, and cloud infrastructure globally, making its software…
Job Description
Canonical, the publisher of Ubuntu and a remote-first company since 2004, is seeking a Threat Intelligence Lead to direct its threat intelligence operations. In this role, reporting to the CISO, the successful candidate will shape the overall strategy, manage open-source intelligence environments, track targeted cyber threats, and guide internal product and engineering teams on mitigation tactics. Canonical creates software that powers AI, IoT, and cloud infrastructure globally, making its software supply chain a target for malicious actors.
This position suits an experienced security professional with a strong background in open-source intelligence, adversary tracking, and cross-team collaboration. The role involves working remotely with required travel for biannual in-person company events.
Responsibilities
- Develop and manage the overall threat intelligence strategy and execution for Canonical
- Establish and maintain OSINT research environments alongside associated tradecraft and techniques
- Identify, monitor, and catalogue targeted intrusion cyber threats and adversary tradecraft trends
- Partner with product and engineering groups to explain risks and advise on mitigation strategies
- Coordinate with operational security and information security teams to update defense controls
- Analyze software supply chain threats and study attack trends across open-source ecosystems
- Deliver briefings to executives, internal teams, and external customers
- Contribute to the broader threat intelligence community to establish the organization as a thought leader
Requirements
- Experience as a threat intelligence leader or in a similar capacity
- Knowledge of the open-source threat landscape and computer networking concepts
- Proficiency with OSINT tools such as Maltego, Shodan, and Buscador
- Ability to track adversary tradecraft trends using data sets
- Experience applying threat intelligence to influence product development or enterprise architecture
- Strong communication skills with the ability to present technical information to diverse audiences
- Availability to travel up to twice a year for company events lasting up to two weeks
Qualifications
- Bachelor's degree in computer science, information security, or a related field
- Professional portfolio of OSINT scripts, frameworks, or tools
- Active involvement in the broader OSINT community
- Certifications such as GOSI, SANS SEC487, SANS SEC587, or IntelTechniques OSIP
- Background working within a technology company or government and military signal intelligence departments
Core Skills
Benefits
- Performance-driven annual bonus
- Annual compensation reviews
- Recognition rewards
- Annual holiday leave
- Maternity and paternity leave
- Employee Assistance Programme
- Personal learning and development budget of USD 2,000 per year
- Travel upgrades and Priority Pass for long-haul company events
- Twice-yearly in-person team sprints
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this role remote?
Yes, Canonical operates as a remote-first company and this position is remote, though it does require traveling twice a year for in-person company events.
Who does the Threat Intelligence Lead report to?
This position reports directly to the Chief Information Security Officer (CISO).
What travel is required for this position?
The role requires traveling twice a year for company events that can last up to two weeks long.
What is the salary for this position?
The specific salary is not stated in the job posting, though compensation is determined using geographical location, experience, and performance.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.