Cyber Threat Intelligence Researcher (TTPs, MITRE ATT&CK, Python) for NATO with security clearance

WLG; Brussel; On-site; EUR 70,000 - 110,000; Full time

Job summary

WLG in Brussels is seeking a Cyber Threat Intelligence Researcher to join a small team that translates technical research into actionable reports for network defenders and decision makers.

You will research threat actor groups, write automation scripts, and produce technical intelligence for defenders and threat hunters, turning findings into operational assessments while collaborating with colleagues.

Qualifications

• Degree in a quantitative field with strong computer science content and 2 years of relevant experience, or 4 years of similar work plus recognised certifications.
• Hands‑on analysis of threat actors, attack patterns and TTPs with real impact on defence.
• Working knowledge of the intelligence lifecycle, analytic tradecraft and MITRE ATT&CK.
• Solid network and system fundamentals and experience in at least one of: network monitoring, threat hunting, incident response, red teaming, forensics or reverse engineering.
• Scripting in Python
• Clear writing that non-specialists can follow.

Responsibilities

• Researching threat actor groups and their tactics, techniques and procedures
• Writing scripts and queries that track adversary infrastructure and tooling automatically
• Producing technical intelligence, including detection signatures, for defenders and threat hunters
• Helping turn technical findings into operational and strategic assessments
• Working closely with other researchers, giving and taking feedback

Skills

Python scripting

Threat intelligence

Threat actor analysis

MITRE ATT&CK

Technical report writing

Analytic tradecraft

Communication to non specialists

Education

Degree in quantitative field with CS content

Recognised certifications

Tools

Python

Network monitoring

Threat hunting

Incident response

Reverse engineering

Forensics

Job description

Follow the adversary, map how they work, and help defenders stay a step ahead.

A multinational defence headquarters in Brussels is looking for a cyber threat intelligence researcher to join a small team that turns technical research into reporting for network defenders and decision makers.

What You Would Be Doing

• Researching threat actor groups and their tactics, techniques and procedures
• Writing scripts and queries that track adversary infrastructure and tooling automatically
• Producing technical intelligence, including detection signatures, for defenders and threat hunters
• Helping turn technical findings into operational and strategic assessments
• Working closely with other researchers, giving and taking feedback

What you would bring

• A degree in a quantitative field with strong computer science content and 2 years of relevant experience, or 4 years of similar work plus recognised certifications
• Hands‑on analysis of threat actors, attack patterns and TTPs with real impact on defence
• Working knowledge of the intelligence lifecycle, analytic tradecraft and MITRE ATT&CK
• Solid network and system fundamentals and experience in at least one of: network monitoring, threat hunting, incident response, red teaming, forensics or reverse engineering
• Scripting in Python
• Clear writing that non-specialists can follow

Why this one is worth a look

Your research feeds straight into how a large alliance defends its networks.