Cyber Threat Intelligence Specialist

Let's get into the specifics. It’s impossible to capture every nuance of a role – especially at a rapidly growing company like Mews – but if we had to distil it into a job description (which we do because this is a job description), it would be this:

Building a threat intelligence capability from scratch is genuinely rare: most security roles inherit someone else's tooling, someone else's playbooks, someone else's definition of what "good" looks like. This one doesn't. As Mews' first Cyber Threat Intelligence Specialist, you will design and operationalise the CTI function within our Security Operations team, setting the intelligence requirements, the collection and analysis approach, and the feedback loops that will shape how the whole team detects and responds to threats. The hospitality industry is a specific and underserved target for credential phishing, account takeover, and ransomware, and Mews processes data for thousands of properties globally. There is real risk here, and real opportunity to reduce it.

You will join a Security Operations team that operates as a product security function, not a traditional IT security shop. Your work feeds directly into detection engineering, threat hunting, and incident response, and as the program matures you will help shape how intelligence can be surfaced to Mews customers as a trust capability. You will work closely with Security Engineering, Platform Engineering, Legal, and Product teams, and you will report to Roger Ribas, the Director of Security Operations.

Design and implement Mews' CTI service end-to-end: intelligence requirements, lifecycle management, collection, enrichment, dissemination, and continuous improvement

Track threat actors, campaigns, and TTPs (tactics, techniques, and procedures) relevant to SaaS platforms and the hospitality and payments ecosystem

Convert raw intelligence into actionable outcomes for detection engineers, threat hunters, and incident responders, with a strong bias toward intelligence that changes decisions rather than just informs them

Act as a trusted intelligence partner during security incidents, providing attacker context, likely objectives, and forward-looking risk assessments

Identify opportunities to automate and enrich intelligence workflows, including applying AI-assisted techniques where they meaningfully improve speed or coverage

AI Fluency Level 3: In this role, that means you have gone beyond using AI tools for your own productivity. You have redesigned how threat intelligence work gets done: building AI-assisted workflows that others on the team can adopt (for example, automated enrichment pipelines, AI-assisted TTP classification, or LLM-supported threat landscape summaries that are rigorously checked and validated before distribution). You actively interrogate what AI gives you, apply your own judgment to catch errors, and document your approaches so they can be replicated and improved.

For more information on AI fluency at Mews, please refer to "AI Fluency at Mews: A Comprehensive Guide for Candidates" on Confluence.

Hands-on CTI experience in SaaS, cloud, or technology-centric environments, with a track record of building or significantly evolving a CTI program rather than just operating within one

Experience tracking threat actors, campaigns, and TTPs relevant to online platforms and identity-centric attacks (credential phishing, account takeover, API abuse)

Demonstrated ability to translate intelligence into operational outcomes: detection rules, hunting hypotheses, IR support, control improvements

Intelligence lifecycle management from requirements to feedback, with the ability to define priority intelligence requirements (PIRs) aligned to business context and risk

AI Fluency Level 3, or equivalent hands-on experience redesigning workflows with AI and building approaches others can follow

Working knowledge of Russian for threat actor tracking and underground ecosystem monitoring

Experience with MISP, threat intelligence platforms, or integrating IOC/TTP feeds into Splunk or similar SIEM

Familiarity with RH-ISAC (the Retail and Hospitality Information Sharing and Analysis Centre)

Salary ranges are provided in good faith and reflect current market conditions and internal pay structures. Final compensation may be adjusted based on funding, budget constraints, or exceptional candidate qualifications, but will remain within reasonable proximity to the stated range.

This salary disclosure is provided in compliance with applicable pay transparency legislation. We are committed to equal pay practices and prohibit salary history inquiries during our recruitment process.

If the location you're applying from wasn't originally advertised for this role, salary range information is available upon request at any point during the application/interview process - your recruiter will be able to help.

Our success is powered by our incredible people, supported by benefits that help them thrive.

No matter where you’re based, you’ll enjoy:

Unlimited paid holiday (yes, really)

Participation in our company share program

Paid parental leave (6 months fully paid for primary caregivers, 2 months for secondary, available after one year of service)

An annual Learning budget of €300 (and more for high performers) to support your development

Monthly "EDGE" time to Explore, Develop, Grow, and Elevate yourself

A work from anywhere policy with flexibility to work abroad for a few weeks each year

Relocation options, available after one year

Flexible, hybrid working options

A home office setup budget to make your workspace your own and a monthly work-from-home allowance

Claude tokens, so you can automate workflows and build smarter, more efficient ways of working

You'll receive additional benefits that vary by location, from healthcare and retirement plans to team events, socials and other perks. Ask us about it during your interview process.

We’re an equal opportunities employer. We value teams that reflect the diversity of the customers and communities we serve. Different perspectives make better ideas, stronger products and a more welcoming company.

We also believe transparency is important when deciding if you're the right fit. Mews is an ambitious, high-pressure environment of continuous learning and high standards. Success here requires resilience, adaptability and a willingness to solve difficult problems.

A few things that define how we work:

High autonomy means high responsibility. People are expected to take ownership and drive outcomes. There isn’t a detailed playbook for everything, and that’s part of what makes the work challenging – and rewarding.

Change is constant. We’re growing quickly and adapting as we scale. Teams, processes and priorities continue to evolve, and only people who stay curious and agile will thrive.

We’re remote-first, not relationship-free. Flexibility is core to how we work, but strong relationships still matter. Our teams are global, so we need expert collaborators and communicators to help us move forward together.

AI is an integral part of our processes. It’s not here to steal people’s jobs, but to amplify efficiency and productivity. We’re motivated to proactively use the technology to seek out better ways of working and share our findings with the rest of the company.

If there's anything we can do to support you during the application process, let us know.

We don't discriminate on the basis of race, religion, colour, nationality, gender, sexual orientation, age, marital status, veteran status, disability or any other protected characteristic.

One final thing: don't hold back. If you don't meet 100% of the criteria in this job description but you're certain you could make a big impact, apply. Everyone should have equal access to opportunities, and we're committed to providing an inclusive experience.

If Mews sounds like the kind of environment where you'd thrive, we'd love to hear from you.