# Director of Cyber Threat Intelligence (CTI) at AstraZeneca

AstraZeneca is hiring a Director of Cyber Threat Intelligence (CTI). It pays $163k-$244k a year and Level rates it Little AI ●○○○; you can [apply on AstraZeneca](https://jobsbylevel.com/go/83fa21f2-0662-4503-935a-b867868b82cc?utm_medium=ai-agent).

AI Level 1, AI centrality 34 out of 100. US - Gaithersburg - MD.

## Details

- Company: [AstraZeneca](https://jobsbylevel.com/companies/astrazeneca)
- AI level: AI Level 1 (score 34 out of 100)
- Location: US - Gaithersburg - MD
- Salary: $163k-$244k
- Posted: September 23, 2026
- Apply: https://jobsbylevel.com/go/83fa21f2-0662-4503-935a-b867868b82cc?utm_medium=ai-agent
- Free CV review for this job: https://jobsbylevel.com/cv-review?job=director-of-cyber-threat-intelligence-cti-at-astrazeneca-ca8c97

## Description

About AstraZeneca AstraZeneca is a global, science-led, patient-focused biopharmaceutical company dedicated to discovering, developing, and commercialising prescription medicines for serious disease. We’re committed to being a Great Place to Work. About the Role The Director of Cyber Threat Intelligence will lead a highly technical CTI function within AstraZeneca’s Cybersecurity Operations division, managing a team of analysts to deliver strategic, operational, and tactical intelligence that measurably reduces risk across the enterprise, including manufacturing, clinical trial platforms, and R&D environments. This role anchors CTI to “intel-to-action” outcomes, partnering closely with Vulnerability Management, Detection Engineering, and Incident Response to harden controls, prioritize patching, improve detections, and accelerate response. Key Responsibilities Program Leadership and Strategy: Define CTI vision, operating model, and roadmap aligned to AstraZeneca’s cyber risk reduction strategy, with special emphasis on manufacturing continuity, clinical data integrity, and R&D IP protection. Adversary Prioritization Framework: Design and operate a scoring rubric that ranks actors based on intent/capability/relevance, TTP emergence and prevalence, organization-specific exposure to known vulnerabilities/CVEs, and global “viral” events, maintaining dynamic watchlists and escalation triggers. MTTI Metric and Analytics: Implement analytic methods to estimate mean time-to-impact per adversary (from initial access to material business impact) using internal telemetry, historical incidents, industry reporting, and confidence levels, performing comparisons with IR’s MTTC to drive control improvements. Attack Path Modeling: Build and maintain end-to-end attack path models from initial access to material impact across IT-to-OT pivots, clinical platforms, and R&D environments, mapping steps to MITRE ATT&CK (Enterprise/ICS), identify control gaps and choke points, derive detections-as-code and hunt hypotheses, and support validation efforts including purple-team exercises and adversary emulation to ensure enterprise hardening and measurable risk reduction. Dark Web and Closed-Source Monitoring: Establish collection and monitoring across dark web forums, marketplaces, breach dumps, and closed channels to identify emerging TTPs, credential leaks, data exposure, access-broker listings, and targeting of manufacturing, clinical, or R&D assets, integrating validated findings into TIP/SIEM pipelines, trigger takedown requests where feasible, and deliver rapid advisories with confidence ratings and specific actions for Vulnerability Management, Detection Engineering, and IR. Third-Party and Ecosystem Intelligence: Deliver risk insights for CROs/CMOs/logistics/technology vendors, monitor credential leakage and domain spoofing, and support/coordinate takedown operations when needed. Structured Threat Actor Attribution (Diamond Model): Lead disciplined attribution using the Diamond Model (adversary, capability, infrastructure, victim) and complementary frameworks, correlating TTPs, tooling lineage, code-reuse, infrastructure overlaps, and victimology with confidence levels and analytic caveats, documenting hypotheses, alternative explanations, and disconfirming evidence, and producing reusable actor profiles and pivot paths that inform prioritization, detections, hunts, and incident response playbooks. Support Vulnerability Management: Partner with Vulnerability Management to contextualize CVEs (exploitability, weaponization, external scanning telemetry, compensating controls) and deliver risk-based patching prioritization across AstraZeneca’s estate including IT/OT, clinical platforms, and lab environments. Support Detection Engineering: Develop detection use cases to feed our detection-as-code pipeline and support detection ATT&CK coverage mapping, content tuning, and false-positive reduction, ensuring feedback loops from hunts and incidents

The description is cut here. Read the full offer: https://jobsbylevel.com/jobs/director-of-cyber-threat-intelligence-cti-at-astrazeneca-ca8c97

Source: https://jobsbylevel.com/jobs/director-of-cyber-threat-intelligence-cti-at-astrazeneca-ca8c97

## Cite this page

Level. https://jobsbylevel.com/jobs/director-of-cyber-threat-intelligence-cti-at-astrazeneca-ca8c97.

Get job alerts: https://jobsbylevel.com/newsletter