Cyber Threat Intelligence Researcher

Brevco Services; Brussel Hoofdstad; Híbrido; EUR 90 000 - 130 000; Tempo integral

Resumo da oferta

Brevco Services conducts a NATO cyber threat intelligence program, focusing on scalable detection and threat actor research. The contractor will leverage CTAB and other sources to analyze threat infrastructure and produce actionable intelligence for network defenders and strategic analysts.

The role emphasizes automation, collaboration with threat researchers, and delivering consistent results aligned with NATO expectations through periodic reviews and updated methodologies.

Qualificações

• University degree in a quantitative discipline with substantial CS content or 4+ years of relevant experience.
• Experience analyzing threat actor groups, TTPs and producing actionable threat intelligence.
• Familiarity with intelligence lifecycle and MITRE ATT&CK framework.
• Excellent written and oral communication; ability to convey complex topics to non-domain experts.
• Strong knowledge of network/system fundamentals and cybersecurity domains.
• Proficiency in Python scripting for automation and tooling.

Responsabilidades

• Conduct cloud engineering to support NATO’s cyber threat intelligence production.
• Translate threat actor tactics into actionable intelligence for defenders and strategic analysts.
• Deliver scripts and methodologies to improve NATO’s ability to track adversaries and provide TICs and detections.

Conhecimentos

Threat intelligence analysis

MITRE ATT&CK

Communications

Cybersecurity fundamentals

Python scripting

Formação académica

Quantitative degree with CS content

Descrição da oferta de emprego

• A university degree from a nationally recognised/certified university in a quantitative discipline (Computer Science, Engineering, Statistics, Operations Research, etc.) with substantial computer science content and 2 years of specific experience – OR - at least 4 years experience similar to the tasks described in this SoW and relevant industry recognized certificates
• Knowledge and experience in analysis of various threat actor groups, attack patterns and tactics, techniques, and procedures (TTPs) to produce actionable threat intelligence to enable network and host defences in organizations with demonstrable impact
• Experience with and knowledge of the intelligence lifecycle, analytical tradecraft and frameworks such as MITRE ATT&CK
• Good communication skills, both orally and written. Able to translate complex technical topics into information conveyable to non-domain experts. Can easily cooperate with other threat researchers by taking and giving feedback
• Knowledge of network and system fundamentals and experience in any of the following cybersecurity fields: network monitoring, threat hunting, incident response, red teaming, host/network forensics, or reverse engineering
• Experience with programming in scripting languages such as Python

DUTIES/ROLE

• The Contractor will be responsible for conducting cloud engineering to support NATO’s cyber threat intelligence production. The Contractor must:
  • Use the CTAB Cyber Threat Intelligence Platform and other sources to conduct research into prioritized cyber threat actors to discover new infrastructure and capabilities under the direction of the team lead. Conduct pattern analysis on threat actor infrastructure to detect new malicious infrastructure, and script and automate that detection to allow for threat intelligence at scale. Find and analyse potential new cyber threats to NATO based on existing or novel techniques and scripts, and correlate with all available sources to establish an adequate threat picture
  • Translate threat actor tactics, techniques and procedures into actionable intelligence for 1) network defenders through creating detection signatures, contextualising IoC’s, and writing standardized CTI products, and 2) strategic cyber analysts for use in intelligence production to decision makers. Support other threat researchers in their activities, and advise and assist strategic cyber threat analysts in understanding complex technical topics
  • Participate in team and branch calls as required by the team lead to give status updates on projects and developments pertinent to the Contractor’s tasks, and ensure constant delivery of findings, mostly comprising indicators of compromise and MITRE techniques, on novel threat actors. Equally deliver scripts and methodologies that improve on current processes and tooling and enhance NATO’s ability to track adversaries in cyberspace
• Development of specialist products
  • The Contractor shall produce the Deliverables as specified in the task order management under supervision of the NATO Project Manager. The Contractor shall submit Deliverables to the NATO Project Manager for Quality Review, test or inspection not later than the dates specified by the NATO Project Manager
  • The Contractor shall continuously validate any deliverables with the NATO Project Manager and peers within CTAB
  • The Contractor shall hold periodic sessions with the NATO Project Manager to make sure that the deliverables are aligned with NATO’s expectations

Job requirements

• A university degree from a nationally recognised/certified university in a quantitative discipline (Computer Science, Engineering, Statistics, Operations Research, etc.) with substantial computer science content and 2 years of specific experience – OR - at least 4 years experience similar to the tasks described in this SoW and relevant industry recognized certificates (Mandatory)
• Knowledge and experience in analysis of various threat actor groups, attack patterns and tactics, techniques, and procedures (TTPs) to produce actionable threat intelligence to enable network and host defences in organizations with demonstrable impact (Mandatory)
• Experience with and knowledge of the intelligence lifecycle, analytical tradecraft and frameworks such as MITRE ATTCK (Mandatory)
• Good communication skills, both orally and written. Able to translate complex technical topics into information conveyable to non-domain experts. Can easily cooperate with other threat researchers by taking and giving feedback (Mandatory)
• Knowledge of network and system fundamentals and experience in any of the following cybersecurity fields: network monitoring, threat hunting, incident response, red teaming, host/network forensics, or reverse engineering (Mandatory)
• Experience with programming in scripting languages such as Python (Mandatory)