Senior Threat Intelligence Manager

THE ROLE:

AMD is seeking a Senior Threat Intelligence Manager to lead and mature the enterprise Threat Intelligence program as a strategic capability supporting cyber defense, incident response, executive decision-making, and business risk reduction. This leader will be responsible for building an intelligence-driven security function that delivers actionable, relevant, and measurable intelligence across the organization.

THE PERSON:

The ideal candidate will bring a strong blend of technical depth, operational leadership, stakeholder management, and program maturity expertise. This role requires someone who can move beyond passive feed consumption and instead establish a threat intelligence program that drives outcomes across the SOC, Incident Response, Insider Threat, Vulnerability Management, Detection Engineering, and executive leadership. The Senior Threat Intelligence Manager will be expected to improve the efficacy of intelligence operations, strengthen internal intelligence generation, optimize tooling and processes, and ensure intelligence is aligned to AMD’s assets, business priorities, and threat landscape.

KEY RESPONSIBILITIES:

Threat Intelligence Program Leadership

Lead the strategy, execution, and maturity of AMD’s Threat Intelligence program across tactical, operational, and strategic intelligence functions.

Define and maintain the program roadmap, operating model, priorities, and service catalog for intelligence support across Cyber Defense.

Evolve the program from primarily feed-driven intelligence into an intelligence function that produces high-value internal insights, directly supports investigations, and informs proactive defense decisions.

Establish clear program objectives, success criteria, and measurable outcomes tied to security operations and business risk reduction.

Drive continuous improvement in intelligence collection, analysis, production, dissemination, and feedback loops.

Intelligence Operations and Analysis

Oversee the identification, analysis, and communication of relevant adversary activity, campaigns, malware trends, geopolitical developments, and industry-specific threats that may impact AMD.

Ensure the team produces timely and actionable intelligence products for technical teams, leadership stakeholders, and cross-functional partners.

Direct intelligence support for incident response, major investigations, and emerging threat scenarios by translating external and internal indicators into operationally useful context.

Lead the prioritization of threat activity based on business relevance, internal asset exposure, adversary capability, and likelihood of exploitation.

Develop and refine intelligence requirements aligned to AMD’s threat profile, crown-jewel assets, and strategic priorities.

Internal Intelligence Generation

Expand AMD’s internal intelligence generation capabilities by improving the team’s use of internal telemetry, investigative findings, incident trends, vulnerability data, and business context.

Strengthen the team’s ability to correlate internal events with external threat reporting to produce higher-confidence assessments and better defensive recommendations.

Partner with SOC, Incident Response, Detection Engineering, Insider Threat, and Vulnerability Management to convert operational findings into durable intelligence outputs.

Drive the development of intelligence-led hypotheses, adversary tracking, and risk assessments grounded in AMD’s real environment rather than generic external reporting.

Operational Integration Across Cyber Defense

Ensure threat intelligence is deeply integrated into the SOC, detection engineering, incident response, phishing analysis, insider threat investigations, and vulnerability prioritization workflows.

Partner with SOC leadership to improve the operational relevance of intelligence, including support for alert tuning, use case development, threat-informed hunting, and detection prioritization.

Collaborate with Vulnerability Management to align threat intelligence with exploitability, active threat activity, and asset criticality in order to improve remediation prioritization.

Support Insider Threat and sensitive investigations by providing adversary context, investigative enrichment, and analytical support as needed.

Build repeatable workflows that ensure intelligence is not produced in isolation, but operationalized into defensive action.

Tooling, Automation, and Platform Maturity

Own and mature the threat intelligence tooling ecosystem, including the effective deployment, tuning, and operationalization of platforms such as TIPs, external intelligence providers, and intelligence-sharing capabilities.

Lead the implementation and operational maturity of MISP or equivalent intelligence-sharing and management capabilities, ensuring the platform is used effectively and supports the broader cyber defense mission.

Evaluate and optimize vendor intelligence sources to improve relevance, signal-to-noise ratio, and measurable analyst value.

Partner with automation and engineering teams to improve enrichment pipelines, indicator handling, intelligence dissemination, and workflow automation.

Reduce manual and low-value effort through better integration of tools, data sources, and intelligence processes.

Stakeholder Engagement and Executive Communication

Serve as the primary leader for communicating threat intelligence priorities, risk implications, and key findings to technical and non-technical stakeholders.

Provide concise, high-quality intelligence briefings to Cyber Defense leadership and executive stakeholders, including risk-based updates on significant adversary activity and emerging issues.

Build trusted relationships across legal, privacy, engineering, infrastructure, product security, and business leadership to ensure intelligence supports enterprise decision-making.

Produce leadership-ready metrics and reporting that clearly demonstrate the effectiveness, relevance, and impact of the Threat Intelligence p