Cyber Threat Intelligence Analyst – Cyber Direct Entry
| Posting date: | 22 December 2025 |
|---|---|
| Salary: | £42,782 to £60,000 per year, pro rata |
| Additional salary information: | Additional cyber-skills payments: From £6,270 per year for junior operators to £26,125 per year for highly experienced individuals |
| Hours: | Full time |
| Closing date: | 21 January 2026 |
| Location: | Multiple, including Southwest and Northwest England |
| Remote working: | On-site only |
| Company: | Ministry of Defence - ZigZag Careers Pathway |
| Job type: | Permanent |
| Job reference: | Cyber Direct Entry |
Summary
Cyber Threat Intelligence Analyst – Cyber Direct Entry
JPAN: n/a
Grade: Mil OR4
Location: Multiple, including Southwest and Northwest England
Contract: Regular Military Commitment with bespoke TACOS
Security clearance: DV
Closing date: 28 Feb 2025
All offers of employment are subject to achieving UK security clearance. Applicants normally need at least five years of UK residency to gain this clearance.
Overview
Cyber Direct Entry offers an accelerated route into military cyber roles for individuals with proven cyber skills or aptitude. This programme strengthens the UK’s ability to respond to growing cyber threats.
You’ll receive tailored training focused on essential skills for operating in cyberspace. Traditional medical and fitness standards are not our immediate concern, and waivers can be applied where appropriate.
We value diversity and encourage applications from all backgrounds. Cyber talent comes from every identity, and we know that a diverse workforce makes us stronger.
The cyber sector includes many neurodivergent professionals, and we embrace neurodiversity. Different ways of thinking often lead to unique insights.
Formal qualifications are not essential. If you can show your skills and passion for cyber, we want to hear from you. Successful applicants will be fast-tracked into operational cyber roles.
The below role represents one of many opportunities that will be available to you throughout your career. Final confirmation of cyber roles and locations will be made on completion of your initial training; decisions will take into account your skills, preferences and the needs of Defence.
The Role
Analyses intrusion data and adversary tactics to maintain a deep understanding of threat actors’ intent and techniques. Produces actionable intelligence to support incident response, malware analysis, and intelligence-led threat hunting.
Key Responsibilities
Analyse Threat Data and Identify Trends - Conduct in-depth analysis of intrusion data, log files, and network traffic to identify emerging trends, adversary tactics, techniques, and procedures (TTPs), and provide actionable intelligence to support incident response and threat hunting.
Develop and Deliver Intelligence Reports - Produce technical summaries, incident reports, and trend analysis documents, ensuring findings are clearly communicated to stakeholders and leadership through well-prepared briefings and technical documentation.
Collaborate with Cybersecurity Teams - Coordinate with Cyber Defence Analysts and intelligence teams to update detection rules, signatures, and blacklists, ensuring the organisation’s defences are aligned with the latest threat intelligence.
Monitor and Respond to Threats - Use cyber defence tools to monitor system activity, analyse network alerts, and identify potential security violations. Escalate incidents, document event history, and provide recommendations for immediate remediation.
Stakeholder Engagement and Guidance - Establish and maintain communication channels with internal and external stakeholders, share insights on the organisation’s threat environment, and provide cybersecurity guidance to improve risk management and resilience.
About You
We’re looking for someone who:
Has a passion for cybersecurity and an interest in protecting digital environments, shown through qualifications or practical experience
Can use or is willing to learn programming or scripting languages (e.g., Python, Java, PowerShell)
Understands or has experience in areas like network security, digital forensics, penetration testing, or incident response
Brings strong analytical and problem-solving skills and can adapt to complex challenges
Works well in diverse teams and can explain technical concepts clearly to non-technical audiences
Preferred Qualifications: Professional certifications such as CEH, OSCP, or CompTIA Security+ are desirable, as is knowledge of cybersecurity frameworks (e.g., NIST, ISO 27001) and incident response methodologies.
Security requirement: Candidates must achieve and maintain Developed Vetting (DV). Failure to do so may result in termination of employment.
Training
Fast-tracked basic military training will introduce you to the Armed Forces without some traditional military skills (e.g., weapon training)
Bespoke professional training will provide foundational cyber skills for Defence and show how your work supports national security
Ongoing specialist training and mentoring, including industry courses (e.g., SANS), will be available throughout your role
Salary & Benefits
Base Salary: Starting at £42,782, with progression to over £60,000
Additional cyber-skills payments: From £6,270 per year for junior operators to £26,125 per year for highly experienced individuals
Pension: Automatic enrolment in the non-contributory Armed Forces Pension Scheme 2015 (opt-out available)
Leave: 30 days annual leave plus eight UK bank holidays
Other benefits: Free medical and dental care, childcare benefits, enhanced parental leave, and flexible service arrangements
Application process
Application: submit a CV via the SERVE portal. Eligibility checks are completed, and applications are sifted for suitability.
Interview: shortlisted candidates are invited to an interview covering technical skills, qualifications and suitability for military service (command, leadership and management experience).
Medical Assessment: all candidates must pass a medical screening.
Offer: successful candidates receive terms and conditions, and a job offer letter.
Don’t meet all the requirements? Get in touch anyway – we are keen to hear from talented individuals from diverse backgrounds. For questions or more information, contact: People-Tx-ZigZagCareers@mod.gov.uk.
JPAN: n/a
Grade: Mil OR4
Location: Multiple, including Southwest and Northwest England
Contract: Regular Military Commitment with bespoke TACOS
Security clearance: DV
Closing date: 28 Feb 2025
All offers of employment are subject to achieving UK security clearance. Applicants normally need at least five years of UK residency to gain this clearance.
Overview
Cyber Direct Entry offers an accelerated route into military cyber roles for individuals with proven cyber skills or aptitude. This programme strengthens the UK’s ability to respond to growing cyber threats.
You’ll receive tailored training focused on essential skills for operating in cyberspace. Traditional medical and fitness standards are not our immediate concern, and waivers can be applied where appropriate.
We value diversity and encourage applications from all backgrounds. Cyber talent comes from every identity, and we know that a diverse workforce makes us stronger.
The cyber sector includes many neurodivergent professionals, and we embrace neurodiversity. Different ways of thinking often lead to unique insights.
Formal qualifications are not essential. If you can show your skills and passion for cyber, we want to hear from you. Successful applicants will be fast-tracked into operational cyber roles.
The below role represents one of many opportunities that will be available to you throughout your career. Final confirmation of cyber roles and locations will be made on completion of your initial training; decisions will take into account your skills, preferences and the needs of Defence.
The Role
Analyses intrusion data and adversary tactics to maintain a deep understanding of threat actors’ intent and techniques. Produces actionable intelligence to support incident response, malware analysis, and intelligence-led threat hunting.
Key Responsibilities
Analyse Threat Data and Identify Trends - Conduct in-depth analysis of intrusion data, log files, and network traffic to identify emerging trends, adversary tactics, techniques, and procedures (TTPs), and provide actionable intelligence to support incident response and threat hunting.
Develop and Deliver Intelligence Reports - Produce technical summaries, incident reports, and trend analysis documents, ensuring findings are clearly communicated to stakeholders and leadership through well-prepared briefings and technical documentation.
Collaborate with Cybersecurity Teams - Coordinate with Cyber Defence Analysts and intelligence teams to update detection rules, signatures, and blacklists, ensuring the organisation’s defences are aligned with the latest threat intelligence.
Monitor and Respond to Threats - Use cyber defence tools to monitor system activity, analyse network alerts, and identify potential security violations. Escalate incidents, document event history, and provide recommendations for immediate remediation.
Stakeholder Engagement and Guidance - Establish and maintain communication channels with internal and external stakeholders, share insights on the organisation’s threat environment, and provide cybersecurity guidance to improve risk management and resilience.
About You
We’re looking for someone who:
Has a passion for cybersecurity and an interest in protecting digital environments, shown through qualifications or practical experience
Can use or is willing to learn programming or scripting languages (e.g., Python, Java, PowerShell)
Understands or has experience in areas like network security, digital forensics, penetration testing, or incident response
Brings strong analytical and problem-solving skills and can adapt to complex challenges
Works well in diverse teams and can explain technical concepts clearly to non-technical audiences
Preferred Qualifications: Professional certifications such as CEH, OSCP, or CompTIA Security+ are desirable, as is knowledge of cybersecurity frameworks (e.g., NIST, ISO 27001) and incident response methodologies.
Security requirement: Candidates must achieve and maintain Developed Vetting (DV). Failure to do so may result in termination of employment.
Training
Fast-tracked basic military training will introduce you to the Armed Forces without some traditional military skills (e.g., weapon training)
Bespoke professional training will provide foundational cyber skills for Defence and show how your work supports national security
Ongoing specialist training and mentoring, including industry courses (e.g., SANS), will be available throughout your role
Salary & Benefits
Base Salary: Starting at £42,782, with progression to over £60,000
Additional cyber-skills payments: From £6,270 per year for junior operators to £26,125 per year for highly experienced individuals
Pension: Automatic enrolment in the non-contributory Armed Forces Pension Scheme 2015 (opt-out available)
Leave: 30 days annual leave plus eight UK bank holidays
Other benefits: Free medical and dental care, childcare benefits, enhanced parental leave, and flexible service arrangements
Application process
Application: submit a CV via the SERVE portal. Eligibility checks are completed, and applications are sifted for suitability.
Interview: shortlisted candidates are invited to an interview covering technical skills, qualifications and suitability for military service (command, leadership and management experience).
Medical Assessment: all candidates must pass a medical screening.
Offer: successful candidates receive terms and conditions, and a job offer letter.
Don’t meet all the requirements? Get in touch anyway – we are keen to hear from talented individuals from diverse backgrounds. For questions or more information, contact: People-Tx-ZigZagCareers@mod.gov.uk.