Threat Intelligence Analyst (Threat Actor Tracking, Detection Signatures) for NATO with security clearance

WLG; Brussel; On-site; EUR 60,000 - 90,000; Full time

Job summary

WLG in Brussels is seeking a cyber threat intelligence researcher to join a small team that translates technical research into actionable reports for network defenders and decision makers.

You will work closely with researchers to track threat actors, develop detection signatures, and turn findings into operational and strategic assessments. The role emphasizes Python scripting and clear writing for non-specialists; the work feeds into a large alliance's defense.

Qualifications

• A degree in a quantitative field with strong computer science content.
• 2 years of relevant experience, or 4 years of similar work plus recognised certifications.
• Hands-on analysis of threat actors, attack patterns and TTPs with real impact on defence.
• Working knowledge of the intelligence lifecycle, analytic tradecraft and MITRE ATT&CK.
• Solid network and system fundamentals and experience in at least one of: network monitoring, threat hunting, incident response, red teaming, forensics or reverse engineering.
• Scripting in Python.
• Clear writing that non-specialists can follow.

Responsibilities

• Research threat actor groups and their tactics, techniques and procedures.
• Writing scripts and queries that track adversary infrastructure and tooling automatically.
• Producing technical intelligence, including detection signatures, for defenders and threat hunters.
• Helping turn technical findings into operational and strategic assessments.
• Working closely with other researchers, giving and taking feedback.

Skills

Threat intelligence analysis

Python scripting

MITRE ATT&CK knowledge

Network fundamentals

Threat hunting

Incident response

Technical writing

Education

Quantitative degree with CS content

Recognised certifications

Tools

Python scripting

Job description

Follow the adversary, map how they work, and help defenders stay a step ahead.

A multinational defence headquarters in Brussels is looking for a cyber threat intelligence researcher to join a small team that turns technical research into reporting for network defenders and decision makers.

What You Would Be Doing

• Researching threat actor groups and their tactics, techniques and procedures
• Writing scripts and queries that track adversary infrastructure and tooling automatically
• Producing technical intelligence, including detection signatures, for defenders and threat hunters
• Helping turn technical findings into operational and strategic assessments
• Working closely with other researchers, giving and taking feedback

What you would bring

• A degree in a quantitative field with strong computer science content and 2 years of relevant experience, or 4 years of similar work plus recognised certifications
• Hands‑on analysis of threat actors, attack patterns and TTPs with real impact on defence
• Working knowledge of the intelligence lifecycle, analytic tradecraft and MITRE ATT&CK
• Solid network and system fundamentals and experience in at least one of: network monitoring, threat hunting, incident response, red teaming, forensics or reverse engineering
• Scripting in Python
• Clear writing that non-specialists can follow

Why this one is worth a look

Your research feeds straight into how a large alliance defends its networks.