[6468] Cyber Threat Intelligence Researcher

Start date: Negotiable
Clearance Required: NATO Secret
Location: Brussels, Belgium

Requirements
• NATO SECRET security clearance.
• University degree from a nationally recognised/certified university in a quantitative discipline (e.g. Computer Science, Engineering, Statistics or Operations Research), with substantial computer science content and at least 2 years of specific experience; or at least 4 years of experience in similar duties, supported by relevant industry-recognised certifications.
• Knowledge and experience analysing threat actor groups, attack patterns, tactics, techniques and procedures (TTPs), producing actionable threat intelligence to support network and host defences.
• Experience with the intelligence lifecycle, analytical tradecraft and frameworks such as MITRE ATT&CK.
• Strong written and verbal communication skills, including the ability to translate complex technical topics for non-technical audiences.
• Ability to collaborate with other threat researchers, provide feedback and incorporate feedback from others.
• Knowledge of network and system fundamentals.
• Experience in at least one of the following cybersecurity areas:
• Network monitoring.
• Threat hunting.
• Incident response.
• Red teaming.
• Host or network forensics.
• Reverse engineering.
• Experience programming in scripting languages such as Python.
• English proficiency in accordance with the AAS+ Framework Agreement requirements.

Duties and Role
• Research prioritised cyber threat actors using the CTAB Cyber Threat Intelligence Platform and other commercial and open-source sources.
• Identify new threat actor infrastructure and capabilities under the direction of the team lead.
• Conduct pattern analysis of threat actor infrastructure to identify new malicious infrastructure.
• Develop scripts and automate threat detection and tracking to support intelligence gathering at scale.
• Identify and analyse potential new cyber threats to NATO using existing or novel techniques and scripts.
• Correlate information from available sources to establish an accurate threat picture.
• Translate threat actor tactics, techniques and procedures into actionable intelligence for network defenders, including:
• Creating detection signatures.
• Contextualising indicators of compromise (IoCs).
• Producing standardised cyber threat intelligence (CTI) products.
• Translate technical cyber threat intelligence into strategic intelligence products for decision-makers.
• Support other threat researchers and advise strategic cyber threat analysts on complex technical topics.
• Provide regular project updates during team and branch meetings.
• Deliver findings on emerging threat actors, including indicators of compromise and MITRE techniques.
• Develop scripts and methodologies to improve existing processes and tooling and enhance NATO's ability to track adversaries in cyberspace.
• Produce deliverables in accordance with task orders and submit them for quality review, testing or inspection.
• Continuously validate deliverables with the NATO Project Manager and CTAB colleagues.
• Attend periodic review sessions to ensure deliverables meet NATO's expectations.
• Maintain appropriate quality control before submitting products for acceptance.

Specific Working Conditions
• Location: NATO Headquarters.
• Security clearance: NATO SECRET.
• Working arrangement: Expected minimum of 2 days per week on-site, with the remaining 3 days working remotely.
• Working hours: Normally 08:30–18:00 Monday to Thursday and 08:30–16:00 Friday when working at NATO sites.
• Occasional work outside normal working hours may be required.
• Occasional travel to other locations for project-related meetings may be required, with associated travel costs reimbursed.
• Leave must be agreed with the designated NATO Project Manager.
• NATO will provide a secure working environment and access to the CTAB cyber threat intelligence platform.
• The contractor must provide all other equipment and services required to perform the contract.