Senior Threat Intelligence Consultant (m/w/d)

NVISO Security; Frankfurt; On-site; EUR 69,000 - 87,000; Full time

Benefits offered by this job

Training budget

Flexible hours & home office

30 holidays

Company pension

Public transport benefit

Job summary

NVISO is seeking a Senior Threat Intelligence Consultant to join our TI team in Germany. You will deliver strategic, operational and tactical threat intelligence, monitor open, deep and dark web sources, and support incident response, MDR, and Red Team engagements with timely intelligence.

You will contribute to TIBER-EU and TLPT exercises, foster collaboration across teams, and communicate insights clearly during client meetings. Fluency in German and English is required.

Qualifications

• Citizenship of a NATO member state or Austrian citizenship.
• 2–5 years of professional experience, incl. 1–3 years in threat intel.
• Hands-on experience in strategic, operational or tactical TI use cases.
• Exposure to TIBER-EU, TLPT or similar frameworks is a plus.
• Understanding of threat actors, ATT&CK, and the intelligence lifecycle.
• Experience with open-source, deep and dark web research.
• Independent worker who collaborates well in teams; strong writing.
• German and English at C1+ for client-facing work.

Responsibilities

• Deliver high-quality threat intelligence across strategic, operational and tactical use cases.
• Produce threat landscapes, adversary and campaign analyses, sector intelligence reports.
• Monitor open, deep and dark web sources for threats and risks.
• Provide actionable intel to support incident response and detection engineering.
• Support MDR and Red Team with intelligence for detections and emulation.
• Contribute to intelligence-led security assessments like TIBER-EU and TLPT.
• Assist in TI maturity assessments and intelligence process implementation.
• Present findings in client meetings and briefings; maintain clarity.

Skills

Threat intelligence

Open-source research

Analytical writing

Client communication

Team collaboration

Job description

It all starts with the mission: NVISO is here to protect European society from potentially devastating cyber attacks! This means we offer cyber security services to private and governmental organizations to help them better prepare for, prevent, detect and respond to cyber security incidents.

All of this is built on four fundamental values that define who we are: We are Proud, We Break Barriers, We Care and No BS!

Tasks

As a Senior Threat Intelligence Consultant (m/w/d) located in Germany, you will be a key contributor within NVISO’s Threat Intelligence (TI) team, working closely with colleagues across our DACH and international teams to deliver high-quality threat intelligence services to our clients and to support other teams across the organization. Your work will help organizations better understand their threat landscape, anticipate emerging threats, and respond effectively to real-world adversary activity.

You will contribute across a broad range of threat intelligence activities, including strategic and operational intelligence, sector‑specific threat landscapes, and continuous monitoring of open, deep, and dark web sources. Your intelligence will support not only incident response engagements, but also other NVISO services such as Managed Detection & Response (MDR) and Red Team operations, enabling detection, response, and adversary simulation activities with relevant and timely intelligence.

You will also contribute to intelligence‑led security assessments such as TIBER‑EU and TLPT, collaborating with experienced team members to develop realistic threat scenarios and actionable intelligence.

Working in a highly collaborative environment, you will focus on delivering accurate, relevant, and well‑communicated intelligence outputs, while actively sharing knowledge and contributing to the continuous improvement of our services and ways of working.

• Contribute to the delivery of high‑quality threat intelligence services across strategic, operational, and tactical use cases.
• Produce threat intelligence deliverables such as threat landscapes, adversary and campaign analysis, and sector‑specific intelligence reports.
• Perform continuous monitoring of open, deep, and dark web sources to identify relevant threats, exposures, and emerging risks.
• Provide actionable threat intelligence in support of incident response engagements, helping to contextualize attacks and inform response decisions.
• Support other NVISO teams such as MDR and Red Team by delivering intelligence that informs detection engineering, threat hunting, and adversary emulation activities.
• Contribute to intelligence‑led security assessments (e.g. TIBER‑EU, TLPT), supporting threat research, scenario development, and reporting.
• Support capability‑building engagements such as TI maturity assessments, operating model design, and intelligence process implementation.
• Participate in client‑facing meetings and briefings, clearly communicating intelligence findings and insights.
• Collaborate closely with team members to ensure consistency, quality, and continuous improvement of threat intelligence deliverables and processes.

Requirements

• You hold citizenship in one of the 32 NATO member states or the Austrian citizenship;
• 2–5 years of professional experience, including 1–3 years in cyber threat intelligence or a closely related cybersecurity role.
• Hands‑on experience contributing to strategic, operational, or tactical threat intelligence use cases.
• Exposure to intelligence‑led assessments such as TIBER‑EU, TLPT, or comparable frameworks is a plus.
• Solid understanding of threat actors, attacker tradecraft, and intelligence frameworks (e.g. MITRE ATT&CK), as well as the intelligence lifecycle.
• Experience with open‑source, deep, and dark web research and monitoring techniques.
• Ability to work independently on defined tasks and collaborate effectively within a team on larger engagements.
• Strong analytical and writing skills, with the ability to produce clear, structured, and high‑quality intelligence deliverables.
• Effective communication and interpersonal skills to work collaboratively with clients and cross‑functional internal teams.
• Up‑to‑date knowledge of current cyber threats, attacker TTPs, and emerging trends.
• Language: German and English at C1+ proficiency for client‑facing work across DACH.
• Standard business hours with occasional flexibility required during active client engagements and incident response support.

Travel

• Some limited travel within DE/AT/CH (~10%) for onsite engagements, workshops, and stakeholder meetings

At NVISO, we care. We are committed to offering you a highly competitive remuneration package including financial and non‑financial components:

• Working and learning from the best people in the European cyber security industry. We have multiple SANS Instructors working at NVISO, our staff has presented at popular hacking conferences (BlackHat, BruCON, OWASP, etc) and all of our technical staff can acquire deep technical security certifications (GSE, GXPN, GREM, GCFA, OSCP, etc);
• Generous training budget of 10.000 EUR + 10 man days for attending lectures rolling over 2 years;
• An annual gross base salary between 69.000 EUR and 87.228 EUR, depending on your experience;
• Regular team‑building and fun events;
• Our commitment to coach and counsel you and help you grow; each employee receives a personal coach within the team, whose role is to ensure your well‑being and helps you grow in your career!
• Flexible working hours and home office possibilities (incl. working abroad weeks within the EU);
• Business Bike Leasing;
• BahnCard 50 1st class + public transfer ticket or EGYM WellPass;
• 30 holidays;
• Company Pension Scheme;
• Cool offices in the center of Frankfurt and Munich (with BBQ, kicker table, table tennis, etc.).

Disclaimer on the Use of AI Tools in the Application Process

Please be aware that the creation and submission of application documents (e.g. CV, cover letter, case studies, etc.) using AI‑powered tools is only permitted to a limited extent.

• Application documents must authentically reflect your own qualifications, personality, and motivation.
• The use of AI for supportive purposes (e.g. spell‑checking, improving wording) is acceptable.
• Fully generated application documents created by AI without personal adaptation or review are not permitted.
• Under no circumstances may NVISO information, data, or documents be uploaded to or processed by external AI tools.

We reserve the right to exclude applications from the selection and interview process that are clearly created primarily or exclusively by AI and show no recognizable personal input.

The purpose of this policy is to ensure a fair and transparent recruitment process and to obtain an authentic impression of our applicants.