[6468] Cyber Threat Intelligence Researcher

Start date: Negotiable Clearance Required: NATO Secret

Location:
Brussels, Belgium Requirements
- NATO SECRET security clearance.
- University degree from a nationally recognised/certified university in a quantitative discipline (e.g. Computer Science, Engineering, Statistics or Operations Research), with substantial computer science content and at least 2 years of specific experience; or at least 4 years of experience in similar duties, supported by relevant industry-recognised certifications.
- Knowledge and experience analysing threat actor groups, attack patterns, tactics, techniques and procedures (TTPs), producing actionable threat intelligence to support network and host defences.
- Experience with the intelligence lifecycle, analytical tradecraft and frameworks such as MITRE ATT&CK.
- Strong written and verbal communication skills, including the ability to translate complex technical topics for non-technical audiences.
- Ability to collaborate with other threat researchers, provide feedback and incorporate feedback from others.
- Knowledge of network and system fundamentals.
- Experience in at least one of the following cybersecurity areas:
- Network monitoring.
- Threat hunting.
- Incident response.
- Red teaming.
- Host or network forensics.
- Reverse engineering.
- Experience programming in scripting languages such as Python.
- English proficiency in accordance with the AAS+ Framework Agreement requirements. Duties and Role
- Research prioritised cyber threat actors using the CTAB Cyber Threat Intelligence Platform and other commercial and open-source sources.
- Identify new threat actor infrastructure and capabilities under the direction of the team lead.
- Conduct pattern analysis of threat actor infrastructure to identify new malicious infrastructure.
- Develop scripts and automate threat detection and tracking to support intelligence gathering at scale.
- Identify and analyse potential new cyber threats to NATO using existing or novel techniques and scripts.
- Correlate information from available sources to establish an accurate threat picture.
- Translate threat actor tactics, techniques and procedures into actionable intelligence for network defenders, including:
- Creating detection signatures.
- Contextualising indicators of compromise (IoCs).
- Producing standardised cyber threat intelligence (CTI) products.
- Translate technical cyber threat intelligence into strategic intelligence products for decision-makers.
- Support other threat researchers and advise strategic cyber threat analysts on complex technical topics.
- Provide regular project updates during team and branch meetings.
- Deliver findings on emerging threat actors, including indicators of compromise and MITRE techniques.
- Develop scripts and methodologies to improve existing processes and tooling and enhance NATO's ability to track adversaries in cyberspace.
- Produce deliverables in accordance with task orders and submit them for quality review, testing or inspection.
- Continuously validate deliverables with the NATO Project Manager and CTAB colleagues.
- Attend periodic review sessions to ensure deliverables meet NATO's expectations.
- Maintain appropriate quality control before submitting products for acceptance. Specific Working Conditions
-

Location:
NATO Headquarters.
- Security clearance: NATO SECRET.
- Working arrangement: Expected minimum of 2 days per week on-site, with the remaining 3 days working remotely.
-

Working hours
Normally 08:30–18:00 Monday to Thursday and 08:30–16:00 Friday when working at NATO sites.
- Occasional work outside normal

working hours
may be required.
- Occasional travel to other locations for project-related meetings may be required, with associated travel costs reimbursed.
- Leave must be agreed with the designated NATO Project Manager.
- NATO will provide a secure working environment and access to the CTAB cyber threat intelligence platform.
- The contractor must provide all other equipment and services required to perform the contract. Login and apply | Register and apply |