Cyber Threat Intelligence Analyst

WTW; Madrid; Presencial; EUR 70.000 - 100.000; Tempo integral

Resumo da vaga

WTW group in Madrid seeks a Cyber Threat Intelligence professional to lead attribution and adversary pursuit efforts. You will analyze infrastructure, malware and TTPs, build actor dossiers, and map behavior to MITRE ATT&CK and the Diamond Model.

You will collaborate with Incident Response, Threat Hunting and SOC to enrich investigations, produce evidence-based intelligence and brief leadership. Requires 5+ years in threat intel or related security field.

Qualificações

• A minimum of 5 years of experience in cyber threat intelligence, incident response or related security discipline.
• Focus on attribution and adversary tracking; professional services or large enterprise experience is a plus.
• Knowledge of MITRE ATT&CK, Diamond Model and Cyber Kill Chain is essential.

Responsabilidades

• Attribute intrusion activity to threat actors by analysing infrastructure, malware, tooling and TTPs.
• Track adversaries over time and maintain actor dossiers.
• Pivot across infrastructure, domains and datasets to uncover new activity and links between clusters.
• Collaborate with Incident Response, Threat Hunting, Detection Engineering and SOC to enrich investigations and create hunt hypotheses.
• Produce clear, evidence-based intelligence reports and briefings for technical teams and leadership.
• Share indicators and intelligence with trusted partners and vendors.

Conhecimentos

Threat intelligence

Adversary tracking

Structured analytic techniques

MITRE ATT&CK

Diamond Model

Threat actor profiling

Incident Response

Formação

Bachelor's degree in cybersecurity/related field

Certifications (GCTI, GCFA, GREM)

Ferramentas

Threat intelligence platforms

Passive DNS

Certificate transparency

Malware sandboxes

Python

Descrição da vaga

Description

Would you like to help drive the growth of a global company that works with 91% of the Fortune Global 500? Do you have a passion for uncovering who is behind cyber threats and holding them to account? Do you have hands-on experience in threat actor attribution and adversary tracking? If so, we have an exciting opportunity to join our Cyber Threat Intelligence team where you could lead attribution and adversary pursuit efforts for WTW.

The Role

• Attribute intrusion activity to threat actors, campaigns and clusters by analysing infrastructure, malware, tooling, tradecraft (TTPs) and victimology, applying structured analytic techniques and clear confidence assessments
• Track and profile adversaries over time, including state-sponsored, financially motivated and hacktivist groups, maintaining actor dossiers and mapping behavior to MITRE ATT&CK and the Diamond Model
• Pursue adversaries proactively by pivoting across infrastructure, domains, certificates, malware families and open-source and commercial datasets to uncover new activity and links between clusters
• Partner with Incident Response, Threat Hunting, Detection Engineering and the SOC to enrich investigations with attribution context and convert findings into hunt hypotheses and detections
• Produce clear, evidence-based intelligence reports and briefings for technical teams, leadership and business stakeholders, tailored to their needs
• Collect, vet and share indicators and intelligence with trusted partners, ISACs and law enforcement, and manage external intelligence sources and vendors
• Champion inclusion and diversity to ensure that the very best talent, irrespective of age/sex/ethnicity etc., are recruited
  

Qualifications

The Requirements

• A minimum of 5 years of experience in cyber threat intelligence, incident response or a related security discipline, with demonstrable focus on attribution and adversary tracking; experience in a professional services firm or large enterprise a major plus
• Proven success attributing activity and tracking threat actors using infrastructure analysis, malware analysis and open-source and commercial intelligence tools
• Expertise in intelligence tradecraft, including structured analytic techniques, analysis of competing hypotheses and confidence-based assessments
  Strong knowledge of adversary TTPs and frameworks such as MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain
• Experience with threat intelligence platforms, passive DNS, certificate transparency, malware sandboxes and similar tooling; scripting skills (e.g. Python) a plus
• Exceptional written and verbal communication skills; ability to build strong relationships quickly and translate complex findings for non-technical audiences
• Proven success working in a fast-paced, high-pressure environment and self sufficient
• Strong organizational abilities and flexibility to work in a performance-driven environment managing multiple deliverables
• Strong analytic skills with the ability to balance depth of investigation with the needs of the business
• Bachelor’s Degree or equivalent in cybersecurity, computer science, intelligence studies or related field preferred; relevant certifications (e.g. GCTI, GREM, GCFA) a plus

Equal Opportunity Employer