Threat Intelligence Manager

Project overview

Role : Threat Intelligence Manager

Role Type : Contract (Yearly Renewable)

ROLE PURPOSE

Own the bank’s cyber threat intelligence function end to end, with particular focus on threats arising from open finance — API-based data sharing, third-party fintech integrations, and consent-driven access models.

KEY RESPONSIBILITIES

MUST-HAVE SKILLSET

• Run the full CTI lifecycle: collection, processing, analysis, dissemination
• Monitor threats specific to open finance / open banking APIs — third-party and fintech partner risk, consent and data-sharing exposure, API-based attack patterns
• Build and maintain threat actor profiles relevant to regional banking (APT groups, financially motivated actors, ransomware operators)
• Deliver strategic, operational, and tactical intel to SOC, IR, fraud, and executive stakeholders
• Feed threat intel into SIEM/SOAR/EDR platforms; map findings to MITRE ATT&CK
• Support red/purple team exercises with threat-informed scenarios
• Track CBUAE regulatory advisories and coordinate response
• Manage relationships with external intel vendors and ISACs (e.g. FS-ISAC)
• 10+ years total cybersecurity experience, with demonstrated CTI leadership (banking/BFSI preferred)
• Hands-on with threat intel platforms — Recorded Future, ThreatConnect, Anomali, or MISP
• Strong grasp of MITRE ATT&CK, cyber kill chain, IOC/IOA management
• Dark web / OSINT monitoring and malware/APT analysis experience
• Working knowledge of CBUAE cybersecurity regulations and UAE IA/NESA standards
• SIEM/SOAR exposure (Splunk, QRadar, Microsoft Sentinel)
• Exposure to open banking/open finance security models — API security, OAuth/consent frameworks, third-party risk — a strong plus given the environment
• Strong stakeholder skills — able to translate technical intel into business risk language for CISO/exec audiences

Nice to have

PREFERRED CERTIFICATIONS

GCTI, CTIA, CISSP, CEH (SANS FOR578 a plus)

• Working awareness of the AI/ML threat landscape — adversarial ML, GenAI-enabled fraud, deepfake-enabled social engineering
• Any AI security exposure (not yet a common cert path, but a differentiator)

Project details

• Start: flexible
• Location: ABU DHABI, GB
• Languages: English