Cyber Threat Intelligence Researcher

Brussels (Belgium), Belgium | Posted on 11/04/2026

• Date Opened 11/04/2026
• City Brussels (Belgium)
• Job Posting ID ZR_4532_JOB

What is the mission about?

The Cyber Threat Intelligence Researcher will support NATO’s Cyber Threat Analysis Branch (CTAB) in strengthening the Alliance’s cyber defence and situational awareness through advanced cyber threat intelligence research, technical analysis, and automated threat tracking. The role focuses on identifying and analysing sophisticated cyber threat actors, investigating their infrastructure, tools, tactics, techniques and procedures (TTPs), and translating technical findings into accurate, actionable intelligence to support network defence, threat hunting, incident response, and strategic decision‑making.

Job Description

Job Overview

Nextlink is seeking Cyber Threat Intelligence Researcher to support NATO’s Cyber Threat Analysis Branch (CTAB) within the Joint Intelligence and Security Division (JISD). The successful candidate will contribute to strengthening NATO’s cyber defence capabilities by researching, analysing and tracking sophisticated cyber threat actors, their infrastructure, tools, tactics, techniques and procedures (TTPs).

Working alongside cyber threat researchers and intelligence analysts, the individual will translate complex technical findings into clear, evidence‑based intelligence that supports NATO’s operational and strategic decision‑making.

Key Responsibilities

• Cyber Threat Intelligence Research: Research and analyse prioritized cyber threat actors, their infrastructure, tools, capabilities, attack patterns and evolving TTPs using commercial, open-source and internal intelligence sources.
• MITRE ATT&CK Framework: Apply established intelligence methodologies and frameworks, particularly MITRE ATT&CK, to classify adversary behaviours, map TTPs and communicate threat findings consistently.
• Collaboration and Knowledge Sharing: Work closely with CTAB researchers, strategic cyber analysts and other intelligence stakeholders, sharing findings, methodologies, scripts and technical expertise.
• Reporting and Stakeholder Engagement: Present research findings, provide regular project updates, participate in team meetings and communicate complex technical subjects to both technical and non-technical audiences.
• A university degree in Computer Science, Engineering, Statistics, Operations Research or another relevant quantitative discipline with substantial computer science content, accompanied by at least two years of relevant experience; alternatively, a minimum of four years of relevant professional experience supported by industry-recognised certifications.
• Demonstrable experience researching and analysing cyber threat actors, their attack patterns, infrastructure, tools and TTPs.
• Practical experience applying the MITRE ATT&CK framework to cyber threat research and intelligence analysis.
• Experience with Python or other scripting languages for automation, data analysis and intelligence collection.
• Strong analytical, research and problem‑solving capabilities.
• Ability to collaborate effectively with multidisciplinary teams and incorporate constructive feedback.
• Valid NATO SECRET security clearance.
• Experience working within military, government, defence or intelligence organisations.
• Familiarity with commercial and open‑source cyber threat intelligence platforms and tools.
• Experience developing network detection signatures and technical indicators for defensive security operations.
• Understanding of cloud environments, network infrastructure and enterprise security architectures.

Requirements

. Education and Qualifications

• Bachelor's degree from a nationally recognised or accredited university in Computer Science, Engineering, Statistics, Operations Research or a related quantitative discipline with substantial computer science content, plus at least two years of relevant experience.
• Alternatively, a minimum of four years of relevant professional experience in comparable cyber threat intelligence or cybersecurity roles, supported by relevant industry-recognised certifications.