Program Lead, Threat Intelligence

Your Impact

The Program Lead, Threat Intelligence will own the end-to-end program management of threat intelligence initiatives within Cisco's Security & Networking business unit. This role bridges threat research, engineering, and product teams to ensure timely, accurate, and actionable intelligence is embedded into Cisco's security portfolio (e.g., Talos, SecureX/XDR, firewall, endpoint, and cloud security products). The ideal candidate combines strong program/project management subject area with deep knowledge of threat intelligence lifecycle, risk management, and cross-functional software integration testing.

Key Responsibilities

• Program Leadership
  • Own the roadmap, planning, and execution of threat intelligence programs across multiple product lines within the Security BU.
  • Drive cross-functional alignment across Threat Research (e.g., Talos), Product Engineering, Data Science, and Product Management teams.
  • Define program milestones, dependencies, resourcing plans, and success metrics (objectives and key results).
  • Provide regular status reporting and executive-level updates on program health, risks, and outcomes.
• Risk Identification & Management
  • Establish and maintain a risk register for threat intelligence programs, covering technical, operational, data-quality, and third-party/vendor risks.
  • Proactively identify risks related to intelligence feed reliability, false-positive/false-negative rates, data pipeline integrity, and coverage gaps.
  • Partner with security, legal, and compliance teams to assess risks tied to data sourcing, sharing agreements, and regulatory requirements (e.g., export controls, data privacy).
  • Develop and track mitigation plans; raise high-severity risks to leadership with clear options and recommendations.
  • Conduct periodic risk reviews and post-incident/lessons-learned assessments.
• Integration Testing & Quality Assurance
  • Coordinate integration testing of threat intelligence feeds and services into downstream security products (firewalls, IPS/IDS, XDR, cloud security, endpoint).
  • Define test plans and acceptance criteria in partnership with QA/engineering, covering data ingestion, correlation accuracy, latency, and system performance under load.
  • Oversee regression and interoperability testing when new intelligence sources, detection signatures, or product releases are introduced.
  • Validate that intelligence outputs meet accuracy, timeliness, and actionability requirements before production release.
  • Manage defect triage and resolution tracking through to closure with engineering teams.
• Program Operations & Stakeholder Management
  • Facilitate program ceremonies (planning, stand-ups, retrospectives) using Agile/Scrum or hybrid methodologies.
  • Manage program budget, vendor relationships, and third-party intelligence feed contracts as applicable.
  • Serve as the main point of contact between the Threat Intelligence function and Security BU leadership, product management, and customer-facing teams.
  • Support go-to-market readiness by ensuring intelligence capabilities are documented, tested, and communicated to sales engineering and customer success teams.
  • Drive continuous improvement of program processes, tooling, and reporting frameworks.
• Cross-Functional Collaboration
  • Work closely with Talos (or equivalent threat research organization) to translate research findings into product and program requirements.
  • Partner with Data Engineering to ensure scalable, reliable pipelines for intelligence data ingestion and distribution.
  • Collaborate with Security Compliance and Legal on data handling, sharing agreements (e.g., STIX/TAXII, ISACs), and regulatory obligations.
  • Engage with customer-facing and support teams to incorporate field feedback into program priorities.

Minimum Qualifications

• Bachelor's + 12 years, a Master's + 8 years, or PhD + 5 years of complex program management (preferred in software cloud environments), using both agile and waterfall, with at least 2–3 years in cybersecurity, threat intelligence, or security operations.
• Education should be in Engineering, Computer Science or related technical field.
• Experience managing multi-functional technical programs involving engineering, data, and research teams.
• Knowledge of threat intelligence concepts (IOCs, TTPs, MITRE ATT&CK, threat feeds, STIX/TAXII).
• Experience with risk identification, tracking, and mitigation frameworks in a technical/product environment.
• Familiarity with integration and QA testing practices for software/data platforms.
• Experience with program management tools (e.g., Jira, Confluence, Smartsheet, MS Project).

Preferred Qualifications

• PMP, PgMP, CSM, or SAFe certification.
• Security certifications such as GCTI, CISSP, or CEH.
• Prior experience at a network/security vendor (Cisco, Palo Alto Networks, Fortinet, CrowdStrike, etc.).
• Familiarity with Cisco's security portfolio (Talos, SecureX, XDR, Firepower/Secure Firewall, Umbrella, Duo).
• Experience with cloud-native security architectures and DevSecOps practices.
• Exposure to data science/ML-driven threat detection pipelines.
• Good communication skills with experience presenting to senior leadership and technical stakeholders.