Principal Consultant, Threat Intelligence Advisory (Unit 42)

About the role

Palo Alto Networks is hiring a Principal Consultant for its Unit 42 Threat Intelligence Advisory team, a senior-level consulting position within Unit 42 Proactive Services. The role works alongside the Consulting Director of Threat Intelligence Advisory EMEA to give clients threat intelligence insights through threat assessments and advice on improving threat intelligence capabilities. The position is remote, with the majority of time spent on client engagements.

Key responsibilities

• Develop and deliver threat-informed services to international clients within the Unit 42 Threat Intelligence Advisory team.
• Lead engagements such as threat assessments, threat intelligence maturity assessments, threat intelligence capability building and threat-led offensive security testing.
• Provide intelligence input for risk management consulting engagements such as SOC assessments, cloud assessments and AI security assessments.
• Use internal Unit 42 datasets, finished intelligence and OSINT to identify threats to organisations across sectors and geographies.
• Work with client security teams (TI, CISO, SOC, threat hunting, red team) to turn threat intelligence into measurable outcomes.
• Build Unit 42's market presence through thought leadership, including speaking engagements and blog articles.
• Leverage in-house AI platforms to streamline existing methods and processes.

Required profile

• Excellent written and spoken English, able to tailor messages from technical analysts to executives.
• Demonstrable experience improving CTI processes and procedures in large enterprises, in-house or as a consultant.
• Deep understanding of cybercriminal and state-sponsored groups, their TTPs and mitigations.
• Ability to engage with business and security stakeholders and to travel up to 30% of the time.

Required skills

• Practical application of intelligence tradecraft following Analytic Standards (ICD 203).
• Strong familiarity with the MITRE ATT&CK framework.
• Preferred: intelligence-led red team exercises (CBEST, TIBER, iCAST, Corie), threat actor hunting tools, incident response, digital forensics, risk management consulting, additional languages, AI agentic workflows, and certifications such as CRTIA, CCTIM, GCTI.