Threat-Intelligence Fusion Leader — Aerospace Defence Systems

The mandate

The group requires a capability to fuse observations from commercial intelligence, authentication systems and programme reporting into escalated operational decisions. Analysts routinely tag actor infrastructure, identity teams monitor access patterns and programme security tracks document interest, yet no systematic requirement connects those observations into defence actions.

The interim begins within two weeks for eight fixed months across Tel Aviv and programme sites, with daily early briefings during supplier containment and a weekly prioritisation forum thereafter. Permanent selection starts after the first intelligence-led defence cycle in month four; four weeks of transfer are planned, with no extension if source access, clearance or recruitment moves more slowly than expected.

Handover requires priority requirements tied to named programmes and assets, governed source handling, fused supplier and enterprise analysis, intelligence-triggered detection or access decisions and a successor-led executive warning cycle. Three earlier assessments must also be reviewed for missed indicators, and each high-confidence warning must have a recorded recipient, decision and feedback path.

The leader may set collection priorities, restrict dissemination, escalate suppliers and redirect analytic capacity. The remit includes withdrawing an assessment whose sourcing or confidence language cannot withstand challenge. Offensive activity, classified release, supplier termination, permanent hiring and public attribution remain authorised executive or state decisions, and intelligence cannot silently become operational command.

Geopolitical forecasting, physical intelligence and product roadmap ownership are excluded. Programme security continues to own handling and need-to-know decisions outside cyber reporting. The remit turns cyber intelligence into timely defensive choices without claiming certainty it cannot support or expanding into a general strategic-intelligence office.

Why this seat is open

The missed intrusion exposed organisational separation between analysts and defenders. Prior leadership reported indicators without owning warning outcomes. Temporary authority must rebuild fusion, credibility and succession.

What you will own

• Define intelligence requirements from crown-jewel programmes, supplier dependencies, likely collection objectives, warning thresholds and accountable defensive decisions.
• Establish source grading, confidence language and dissemination controls across sensitive holdings.
• Fuse identity, endpoint, supplier, vulnerability and external reporting into decision-ready assessments.
• Trigger targeted hunts, detection changes, access restrictions and supplier assurance from assessed threats.
• Create warning thresholds that distinguish weak signals, collection gaps and urgent operational escalation under stated confidence.
• Review analytic misses and rejected hypotheses without hindsight distortion.
• Transfer requirements, source restrictions, analytic misses, decision history and briefing cadence through two successor-led warning cycles.

Candidate qualifications

• Led cyber threat intelligence in aerospace, defence or another sensitive technology environment under formal source-handling constraints.
• Can evidence fusion of classified or restricted and commercial sources into defensive action.
• Governed confidence, source protection, dissemination and executive warning under uncertainty, including withdrawal or correction of assessments.
• Connected supplier intelligence to identity, detection, access restriction and programme-security decisions with retained feedback evidence.
• Briefed boards or senior authorities on attribution, intent and likely impact without overstating incomplete evidence.
• Built a successor-operated intelligence cycle after a material miss.