Manager, Threat Intelligence

Mimecast is a leading cybersecurity company that secures Human, Data and AI, protecting organizations across the people who work for them, the data they rely on, and the AI systems now woven through how they operate. With over 42,000 customers worldwide, we analyse more than 18 billion security events daily to stop attacks before they cause harm.

Our business is to secure Human, Data and AI. People remain both an organization's greatest asset and its most targeted point of attack, the data they create and depend on needs protecting wherever it moves, and the AI systems now embedded in daily work introduce a new surface that has to be defended. Our platform combines advanced threat detection, awareness training, and Incydr data protection to reduce the likelihood and impact of security incidents across all three.

• Monitor and analyze the global threat landscape to identify emerging threats, adversary TTPs, vulnerabilities, and industry-specific risks.
• Collect, analyze, and produce actionable cyber threat intelligence at the tactical and operational level.
• Produce threat reports, indicators of compromise (IOCs), adversary profiles, and briefings for security operations, incident response, and vulnerability management stakeholders.
• Track phishing, business email compromise (BEC), and other email-borne social engineering campaigns targeting Mimecast customers.
• Analyze phishing kits, malicious URLs, and email-based malware delivery techniques to identify emerging tactics.
• Produce intelligence on social engineering trends, including impersonation, pretexting, and credential-harvesting techniques used in email attacks.
• Partner with detection engineering to translate email threat intelligence into improved phishing and social engineering detection.
• Track and map adversary tactics, techniques, and procedures against frameworks such as MITRE ATT&CK.
• Support the integration of threat intelligence into detection engineering, vulnerability prioritization, and other security tooling and workflows.
• Help define and refine intelligence requirements and collection priorities.
• Use threat intelligence platforms (TIPs) and automation to improve the speed, accuracy, and scale of intelligence production.
• Conduct quality reviews of intelligence products to ensure consistency, accuracy, and actionable outcomes.
• Act as an intelligence resource during security incidents, providing adversary context and threat assessments to support response.
• Track geopolitical events, cybercriminal activity, nation-state operations, and emerging technologies that may impact the organization or our customers.
• Maintain working relationships with commercial intelligence vendors, ISACs, and industry-sharing communities to source and validate intelligence.

• Experience conducting cyber threat intelligence analysis at the tactical, operational, or strategic level.
• Working knowledge of the MITRE ATT&CK framework and threat-informed defense concepts.
• Experience with threat intelligence platforms.
• Familiarity with OSINT collection techniques and tools.
• Experience analyzing malware, phishing campaigns, and indicators of compromise (IOCs).
• Experience analyzing business email compromise (BEC) and other email-borne social engineering threats.
• Understanding of email authentication and anti-spoofing standards (SPF, DKIM, DMARC).
• Familiarity with phishing kit analysis, URL and domain reputation analysis, and email header forensics.
• Strong analytical writing skills, with the ability to produce clear, actionable intelligence reports and briefings.
• Familiarity with intelligence-sharing standards such as STIX/TAXII.
• Bachelor's degree in a related field or equivalent experience; industry certifications (e.g., GCTI, CTIA) are a plus.

• Experience producing and delivering recurring intelligence products, such as quarterly threat landscape reports and executive-level threat briefs.
• Experience developing and presenting webinars, briefings, or other public-facing threat intelligence content to customers, partners, or industry audiences.
• Experience integrating threat intelligence feeds with SIEM or SOAR platforms.
• Familiarity with dark web monitoring and closed-source intelligence sources.
• Experience with email security platforms or secure email gateways.

This role follows Mimecast's hybrid working model, with employees expected in the office at least two days per week. Working together in person fosters collaboration, communication, and learning, drives innovation between teams, and strengthens the interpersonal connections that keep a global team running smoothly.

Join our Threat Intelligence team to accelerate your career, working with cutting-edge technologies and contributing to analysis that has real, direct customer impact. You will be immersed in a dynamic environment that recognizes and celebrates your achievements.

Mimecast is on a path of steady, healthy growth, investing in people who bring the skills and expertise to raise our technical capability, operational maturity, and customer success to the next level. Every voice and every action matters here.

Mimecast offers formal and on-the-job learning opportunities, maintains a comprehensive benefits package that helps our employees and their family members sustain a healthy lifestyle, and offers the chance to work across cross-functional teams to build your knowledge.

The base salary range for this position is $148,000-$222,000 plus benefits. This range represents the minimum and maximum new hire compensation for this role. The position may also be eligible for incentive plans and additional benefits, in accordance with company policy and local regulations. Our salary ranges are determined by role, level, and location with individual compensation also dependent on factors such as qualifications, experience, and skills. Final offers will reflect these considerations and may vary accordingly.

Belonging at Mimecast

Cybersecurity is a community effort. That's why we're committed to building an inclusive, diverse community that celebrates and welcomes everyone - unless they're a cybercriminal, of course.

We're proud to be an Equal Opportunity and Affirmative Action Employer, and we'd encourage you to join us whatever your background. We particularly welcome applicants from traditionally underrepresented groups.

We consider everyone equally: your race, age, religion, sexual orientation, gender identity, ability, marital status, nationality, or any other protected characteristic won't affect your application.

If you require any adjustments or accommodations due to a disability, or any other reason that may help you in your interview process, please let us know by emailing careers@mimecast.com.

Due to certain obligations to our customers, an offer of employment will be subject to your successful completion of applicable background checks, conducted in accordance with local law.

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment.