At Bupa, purpose meets possible . Join us and help shape a future where healthcare is more connected, morepersonaland more human.

We’rea global healthcare leader trusted by millions and committed to helping people to live longer, healthier, happier lives and making a better world. Healthcare is changing, and so are we.We’reinvesting in more clinics, bettersystemsand smarter, more connected ways to help our customers. As we continue to expand our services and invest in innovation,you’llhelp create a healthcare system that meets people where they are, responds to what they need and leaves them better than before. Here, your work has purpose, your voice matters and your future is full of possibility.

Just imagine the impact you could make.

Prospect snapshot- Permanent role

The Bupa Threat Intelligence Team sits within the newly formed Cyber Threat Management (CTM) function, delivering relevant, timely, actionable intelligence through a 360-degree contextualised view of threats that could affect Bupa before they have an adverse impact.

As a Cyber Threat Intelligence Engineer, you will be analysing threats, producing intelligence, and making sure the right people across Bupa have what they need to make informed decisions. What makes this role different is that you will also have the engineering skills to build and operate the tooling, automation, and AI powered capabilities that make the function faster and smarter. Both skills live in one role, and both matter equally.

Responsibilities

- Conduct all-source intelligence analysis (OSINT, commercial, and internal telemetry) and produce clear, actionable assessments for technical and non-technical audiences.
- Produce high-quality intelligence outputs – reports, advisories, briefings,



and executive presentations – and manage the IOC lifecycle from review and validation through to platform ingestion.
- Align intelligence findings to MITRE ATT&CK;, Diamond Model, and Cyber Kill Chain to drive threat led detection use cases, and support CSIRT and Threat Hunting teams during investigations and hunts.
- Own the end-to-end CTI communications process, ensuring the right intelligence reaches the right stakeholders in the right format – including executive summaries, tactical advisories, and sector threat briefs.
- Develop and maintain a structured stakeholder engagement model across Cyber Defence, Security Architecture, Risk, and business leadership, acting as a trusted intelligence adviser.
- Manage and evolve the CTI collaboration platform, maintaining documentation standards, version control, templates, and workflows across all intelligence products.
- Design and build AI-powered agents and agentic workflows from the ground up – covering CTI collection, enrichment, analysis, and dissemination pipelines – and operate and prompt those agents day-to-day to accelerate intelligence work.
- Embed AI-assisted development tools (such as GitHub Copilot) and LLMs into everyday working practice – whether writing scripts, automating workflows, accelerating intelligence production, or improving the quality and consistency of outputs.




- Develop and maintain Python and/or PowerShell scripts to automate CTI workflows including IOC processing, threat feed ingestion, platform integrations, and reporting pipelines.
- Contribute to the CTI technology stack (TIP, OpenCTI, SIEM/SOAR integrations) and co-develop agentic use cases as part of Bupa’s AI transformation.

Requirements

- 3–5 years’ experience working as a Threat Intelligence Analyst or in a closely related cyber security role with a demonstrable analytical component.
- Hands-on experience producing structured threat intelligence products (reports, advisories, briefings) for both technical and non-technical audiences.
- Strong understanding of the threat intelligence lifecycle and key frameworks including MITRE ATT&CK;, D3FEND, Diamond Model, and Cyber Kill Chain, with demonstrated ability to apply these to real-world threats.
- Proven experience using and correlating data from multiple intelligence sources and commercial threat intelligence platforms (e.g., Recorded Future, Mandiant, MISP, OpenCTI, or equivalent).
- Practical scripting or automation experience in Python and/or PowerShell, with a track record of building tools that improve CTI workflows.
- Demonstrated experience using AI tools (e.g., GitHub Copilot, LLM-based assistants) to accelerate development or analytical work.
- Relevant certifications in Cyber Threat Intelligence, Incident Response, or Threat Hunting (e.g., SANS FOR578, FOR508, CREST CTA, or equivalent).
- Experience with agentic frameworks (e.g., LangChain, AutoGen, CrewAI, or equivalent) and working knowledge of LLM APIs (OpenAI, Anthropic, or similar).
- Familiarity with SOAR platforms, SIEM query langu

📌 Cyber Threat Intelligence Engineer (Melbourne)
🏢 Bupa Australia
📍 Melbourne