Cyber Threat Intelligence Researcher

NextLink Group; Brussel Hoofdstad; On-site; EUR 90,000 - 130,000; Full time

Job summary

NextLink Group seeks a Cyber Threat Intelligence Researcher to support NATO’s CTAB within JISD. You will study cyber threat actors, their infrastructure and TTPs, translating findings into actionable intelligence for defence and incident response.

Ideal candidates have MITRE ATT&CK experience, Python scripting skills, and a background in cyber threat research within military or government contexts; NATO SECRET clearance is required.

Qualifications

• Degree in Computer Science, Engineering, Statistics, OR a related quantitative discipline with substantial CS content.
• At least two years of relevant cyber threat intelligence experience or four years with certifications.
• Demonstrable experience researching cyber threat actors, TTPs and infrastructure.
• Experience applying MITRE ATT&CK to threat research and intelligence analysis.
• Experience using Python or other scripting languages for automation and data analysis.
• Valid NATO SECRET security clearance and prior work in military/government environments.

Responsibilities

• Research prioritized cyber threat actors and infrastructure using multiple sources.
• Apply MITRE ATT&CK to classify adversary behaviours and map TTPs.
• Collaborate with CTAB researchers and other intelligence stakeholders.
• Present findings clearly to technical and non-technical audiences.
• Develop network detection signatures and indicators for defensive operations.

Skills

Python scripting

Analytical thinking

Threat intelligence

Collaboration

Problem solving

Education

Bachelor's degree in Computer Science or related quantitative discipline

Tools

MITRE ATT&CK

Job description

Brussels (Belgium), Belgium | Posted on 11/04/2026

• Date Opened 11/04/2026
• City Brussels (Belgium)
• Job Posting ID ZR_4532_JOB

What is the mission about?

The Cyber Threat Intelligence Researcher will support NATO’s Cyber Threat Analysis Branch (CTAB) in strengthening the Alliance’s cyber defence and situational awareness through advanced cyber threat intelligence research, technical analysis, and automated threat tracking. The role focuses on identifying and analysing sophisticated cyber threat actors, investigating their infrastructure, tools, tactics, techniques and procedures (TTPs), and translating technical findings into accurate, actionable intelligence to support network defence, threat hunting, incident response, and strategic decision‑making.

Job Description

Job Overview

Nextlink is seeking Cyber Threat Intelligence Researcher to support NATO’s Cyber Threat Analysis Branch (CTAB) within the Joint Intelligence and Security Division (JISD). The successful candidate will contribute to strengthening NATO’s cyber defence capabilities by researching, analysing and tracking sophisticated cyber threat actors, their infrastructure, tools, tactics, techniques and procedures (TTPs).

Working alongside cyber threat researchers and intelligence analysts, the individual will translate complex technical findings into clear, evidence‑based intelligence that supports NATO’s operational and strategic decision‑making.

Key Responsibilities

• Cyber Threat Intelligence Research: Research and analyse prioritized cyber threat actors, their infrastructure, tools, capabilities, attack patterns and evolving TTPs using commercial, open-source and internal intelligence sources.
• MITRE ATT&CK Framework: Apply established intelligence methodologies and frameworks, particularly MITRE ATT&CK, to classify adversary behaviours, map TTPs and communicate threat findings consistently.
• Collaboration and Knowledge Sharing: Work closely with CTAB researchers, strategic cyber analysts and other intelligence stakeholders, sharing findings, methodologies, scripts and technical expertise.
• Reporting and Stakeholder Engagement: Present research findings, provide regular project updates, participate in team meetings and communicate complex technical subjects to both technical and non-technical audiences.
• A university degree in Computer Science, Engineering, Statistics, Operations Research or another relevant quantitative discipline with substantial computer science content, accompanied by at least two years of relevant experience; alternatively, a minimum of four years of relevant professional experience supported by industry-recognised certifications.
• Demonstrable experience researching and analysing cyber threat actors, their attack patterns, infrastructure, tools and TTPs.
• Practical experience applying the MITRE ATT&CK framework to cyber threat research and intelligence analysis.
• Experience with Python or other scripting languages for automation, data analysis and intelligence collection.
• Strong analytical, research and problem‑solving capabilities.
• Ability to collaborate effectively with multidisciplinary teams and incorporate constructive feedback.
• Valid NATO SECRET security clearance.
• Experience working within military, government, defence or intelligence organisations.
• Familiarity with commercial and open‑source cyber threat intelligence platforms and tools.
• Experience developing network detection signatures and technical indicators for defensive security operations.
• Understanding of cloud environments, network infrastructure and enterprise security architectures.

Requirements

. Education and Qualifications

• Bachelor's degree from a nationally recognised or accredited university in Computer Science, Engineering, Statistics, Operations Research or a related quantitative discipline with substantial computer science content, plus at least two years of relevant experience.
• Alternatively, a minimum of four years of relevant professional experience in comparable cyber threat intelligence or cybersecurity roles, supported by relevant industry-recognised certifications.