Cyber Threat Intelligence Analyst

WTW; Comunidad de Madrid; Presencial; EUR 60.000 - 90.000; Tempo integral

Benefícios oferecidos por esta vaga

Medical insurance

Resumo da vaga

WTW group is seeking a Cyber Threat Intelligence professional to lead attribution and adversary pursuit efforts. Analyze infrastructure, malware, tooling and TTPs to attribute intrusions to threat actors and campaigns.

You will track adversaries, map behavior to MITRE ATT&CK and the Diamond Model, and produce clear intelligence for technical teams, leadership and external partners. Collaborate with incident response, threat hunting, detection engineering and SOC while maintaining sources and

Qualificações

• 5+ years in cyber threat intelligence, incident response, or related field.
• Experience attributing activity and tracking threat actors using infrastructure/malware analysis.
• Knowledge of MITRE ATT&CK, Diamond Model and Cyber Kill Chain.
• Experience with TI platforms and scripting; strong written/verbal communication.

Responsabilidades

• Attribute intrusion activity to threat actors, campaigns and clusters using TTPs and victimology.
• Track adversaries over time and map behavior to MITRE ATT&CK and the Diamond Model.
• Pivot across infrastructure, domains, certificates, malware families and datasets to uncover links.
• Collaborate with IR, Threat Hunting, Detection Eng and SOC to enrich investigations.
• Produce clear, evidence-based intelligence reports and briefings for technical teams and leadership.
• Share indicators with partners, ISACs and law enforcement; manage sources and vendors.
• Champion inclusion and diversity in talent recruitment.

Conhecimentos

Attribution & adversary tracking

Infrastructure analysis

Malware analysis

Threat intel tools

Structured analytic techniques

Confidence-based assessments

Python scripting

Analytic thinking

Stakeholder communication

Formação

Bachelor’s Degree or equivalent in cybersecurity, CS, intelligence studies or related field

Certifications (GCTI, GREM, GCFA)

Ferramentas

Threat intelligence platforms

Passive DNS

Certificate transparency

Malware sandboxes

Open-source datasets

Descrição da vaga

Description

Would you like to help drive the growth of a global company that works with 91% of the Fortune Global 500? Do you have a passion for uncovering who is behind cyber threats and holding them to account? Do you have hands-on experience in threat actor attribution and adversary tracking? If so, we have an exciting opportunity to join our Cyber Threat Intelligence team where you could lead attribution and adversary pursuit efforts for WTW.

The Role

• Attribute intrusion activity to threat actors, campaigns and clusters by analysing infrastructure, malware, tooling, tradecraft (TTPs) and victimology, applying structured analytic techniques and clear confidence assessments
• Track and profile adversaries over time, including state-sponsored, financially motivated and hacktivist groups, maintaining actor dossiers and mapping behavior to MITRE ATT&CK and the Diamond Model
• Pursue adversaries proactively by pivoting across infrastructure, domains, certificates, malware families and open-source and commercial datasets to uncover new activity and links between clusters
• Partner with Incident Response, Threat Hunting, Detection Engineering and the SOC to enrich investigations with attribution context and convert findings into hunt hypotheses and detections
• Produce clear, evidence-based intelligence reports and briefings for technical teams, leadership and business stakeholders, tailored to their needs
• Collect, vet and share indicators and intelligence with trusted partners, ISACs and law enforcement, and manage external intelligence sources and vendors
• Champion inclusion and diversity to ensure that the very best talent, irrespective of age/sex/ethnicity etc., are recruited
  

Qualifications

The Requirements

• A minimum of 5 years of experience in cyber threat intelligence, incident response or a related security discipline, with demonstrable focus on attribution and adversary tracking; experience in a professional services firm or large enterprise a major plus
• Proven success attributing activity and tracking threat actors using infrastructure analysis, malware analysis and open-source and commercial intelligence tools
• Expertise in intelligence tradecraft, including structured analytic techniques, analysis of competing hypotheses and confidence-based assessments
  Strong knowledge of adversary TTPs and frameworks such as MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain
• Experience with threat intelligence platforms, passive DNS, certificate transparency, malware sandboxes and similar tooling; scripting skills (e.g. Python) a plus
• Exceptional written and verbal communication skills; ability to build strong relationships quickly and translate complex findings for non-technical audiences
• Proven success working in a fast-paced, high-pressure environment and self sufficient
• Strong organizational abilities and flexibility to work in a performance-driven environment managing multiple deliverables
• Strong analytic skills with the ability to balance depth of investigation with the needs of the business
• Bachelor’s Degree or equivalent in cybersecurity, computer science, intelligence studies or related field preferred; relevant certifications (e.g. GCTI, GREM, GCFA) a plus

Equal Opportunity Employer