Cyber Threat Intelligence Analyst

WTW group; Madrid; Presencial; EUR 70.000 - 100.000; Tempo integral

Resumo da vaga

WTW is seeking a Cyber Threat Intelligence professional to lead attribution and adversary tracking efforts. You will analyze infrastructure, malware, tooling and TTPs to attribute intrusions to threat actors and maintain actor dossiers aligned with MITRE ATT&CK and the Diamond Model.

You will collaborate with Incident Response, Threat Hunting, Detection Engineering and the SOC, producing clear intelligence reports and briefings for technical teams and business stakeholders.

Qualificações

• Minimum 5 years in cyber threat intelligence or related security field.
• Proven attribution and adversary tracking experience.
• Strong knowledge of MITRE ATT&CK, Diamond Model and Cyber Kill Chain.
• Excellent written and verbal communication; ability to translate findings for technical and business audiences.

Responsabilidades

• Attribute intrusion activity to threat actors using infrastructure, malware, tooling and TTPs.
• Track adversaries over time and map behavior to MITRE ATT&CK and the Diamond Model.
• Collaborate with Incident Response, Threat Hunting, Detection Engineering and SOC to enrich investigations.

Conhecimentos

Threat attribution

Adversary profiling

Structured analytic techniques

MITRE ATT&CK knowledge

Python scripting

Formação

Bachelor’s degree in cybersecurity or related field

Certs such as GCTI, GREM, GCFA a plus

Ferramentas

Threat intel platforms

Passive DNS

Certificate transparency

Malware sandboxes

Descrição da vaga

Would you like to help drive the growth of a global company that works with 91% of the Fortune Global 500? Do you have a passion for uncovering who is behind cyber threats and holding them to account? Do you have hands-on experience in threat actor attribution and adversary tracking? If so, we have an exciting opportunity to join our Cyber Threat Intelligence team where you could lead attribution and adversary pursuit efforts for WTW.

The Role

• Attribute intrusion activity to threat actors, campaigns and clusters by analysing infrastructure, malware, tooling, tradecraft (TTPs) and victimology, applying structured analytic techniques and clear confidence assessments
• Track and profile adversaries over time, including state-sponsored, financially motivated and hacktivist groups, maintaining actor dossiers and mapping behavior to MITRE ATT&CK and the Diamond Model
• Pursue adversaries proactively by pivoting across infrastructure, domains, certificates, malware families and open-source and commercial datasets to uncover new activity and links between clusters
• Partner with Incident Response, Threat Hunting, Detection Engineering and the SOC to enrich investigations with attribution context and convert findings into hunt hypotheses and detections
• Produce clear, evidence-based intelligence reports and briefings for technical teams, leadership and business stakeholders, tailored to their needs
• Collect, vet and share indicators and intelligence with trusted partners, ISACs and law enforcement, and manage external intelligence sources and vendors
• Champion inclusion and diversity to ensure that the very best talent, irrespective of age/sex/ethnicity etc., are recruited

Qualifications

• A minimum of 5 years of experience in cyber threat intelligence, incident response or a related security discipline, with demonstrable focus on attribution and adversary tracking; experience in a professional services firm or large enterprise a major plus
• Proven success attributing activity and tracking threat actors using infrastructure analysis, malware analysis and open-source and commercial intelligence tools
• Expertise in intelligence tradecraft, including structured analytic techniques, analysis of competing hypotheses and confidence-based assessments Strong knowledge of adversary TTPs and frameworks such as MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain
• Experience with threat intelligence platforms, passive DNS, certificate transparency, malware sandboxes and similar tooling; scripting skills (e.g. Python) a plus
• Exceptional written and verbal communication skills; ability to build strong relationships quickly and translate complex findings for non-technical audiences
• Proven success working in a fast-paced, high-pressure environment and self sufficient
• Strong organizational abilities and flexibility to work in a performance-driven environment managing multiple deliverables
• Strong analytic skills with the ability to balance depth of investigation with the needs of the business
• Bachelor's Degree or equivalent in cybersecurity, computer science, intelligence studies or related field preferred; relevant certifications (e.g. GCTI, GREM, GCFA) a plus

Equal Opportunity Employer