Cyber Threat Intelligence Researcher

pBrussels (Belgium), Belgium | Posted on 11/04/2026 /p ulliDate Opened 11/04/2026 /liliCity Brussels (Belgium) /liliJob Posting ID ZR_4532_JOB /li /ul h3What is the mission about? /h3 pThe Cyber Threat Intelligence Researcher will support NATO’s Cyber Threat Analysis Branch (CTAB) in strengthening the Alliance’s cyber defence and situational awareness through advanced cyber threat intelligence research, technical analysis, and automated threat tracking. The role focuses on identifying and analysing sophisticated cyber threat actors, investigating their infrastructure, tools, tactics, techniques and procedures (TTPs), and translating technical findings into accurate, actionable intelligence to support network defence, threat hunting, incident response, and strategic decision‑making. /p h3Job Description /h3 h3Job Overview /h3 pNextlink is seeking Cyber Threat Intelligence Researcher to support NATO’s Cyber Threat Analysis Branch (CTAB) within the Joint Intelligence and Security Division (JISD). The successful candidate will contribute to strengthening NATO’s cyber defence capabilities by researching, analysing and tracking sophisticated cyber threat actors, their infrastructure, tools, tactics, techniques and procedures (TTPs). /p pWorking alongside cyber threat researchers and intelligence analysts, the individual will translate complex technical findings into clear, evidence‑based intelligence that supports NATO’s operational and strategic decision‑making. /p h3Key Responsibilities /h3 ul liCyber Threat Intelligence Research: Research and analyse prioritized cyber threat actors, their infrastructure, tools, capabilities, attack patterns and evolving TTPs using commercial, open-source and internal intelligence sources. /li liMITRE ATTCK Framework: Apply established intelligence methodologies and frameworks, particularly MITRE ATTCK, to classify adversary behaviours, map TTPs and communicate threat findings consistently. /li liCollaboration and Knowledge Sharing: Work closely with CTAB researchers, strategic cyber analysts and other intelligence stakeholders, sharing findings, methodologies, scripts and technical expertise. /li liReporting and Stakeholder Engagement: Present research findings, provide regular project updates, participate in team meetings and communicate complex technical subjects to both technical and non-technical audiences. /li liA university degree in Computer Science, Engineering, Statistics, Operations Research or another relevant quantitative discipline with substantial computer science content, accompanied by at least two years of relevant experience; alternatively, a minimum of four years of relevant professional experience supported by industry-recognised certifications. /li liDemonstrable experience researching and analysing cyber threat actors, their attack patterns, infrastructure, tools and TTPs. /li liPractical experience applying the MITRE ATTCK framework to cyber threat research and intelligence analysis. /li liExperience with Python or other scripting languages for automation, data analysis and intelligence collection. /li liStrong analytical, research and problem‑solving capabilities. /li liAbility to collaborate effectively with multidisciplinary teams and incorporate constructive feedback. /li liValid NATO SECRET security clearance. /li liExperience working within military, government, defence or intelligence organisations. /li liFamiliarity with commercial and open‑source cyber threat intelligence platforms and tools. /li liExperience developing network detection signatures and technical indicators for defensive security operations. /li liUnderstanding of cloud environments, network infrastructure and enterprise security architectures. /li /ul h3Requirements /h3 h3. Education and Qualifications /h3 ul liBachelor's degree from a nationally recognised or accredited university in Computer Science, Engineering, Statistics, Operations Research or a related quantitative discipline with substantial computer science content, plus at least two years of relevant experience. /li liAlternatively, a minimum of four years of relevant professional experience in comparable cyber threat intelligence or cybersecurity roles, supported by relevant industry-recognised certifications. /li /ul