Lead Cyber Threat Attribution & Adversary Tracking

WTW; Comunidad de Madrid; On-site; EUR 60,000 - 90,000; Full time

Benefits offered by this job

Medical insurance

Job summary

WTW group is seeking a Cyber Threat Intelligence professional to lead attribution and adversary pursuit efforts. Analyze infrastructure, malware, tooling and TTPs to attribute intrusions to threat actors and campaigns.

You will track adversaries, map behavior to MITRE ATT&CK and the Diamond Model, and produce clear intelligence for technical teams, leadership and external partners. Collaborate with incident response, threat hunting, detection engineering and SOC while maintaining sources and

Qualifications

• 5+ years in cyber threat intelligence, incident response, or related field.
• Experience attributing activity and tracking threat actors using infrastructure/malware analysis.
• Knowledge of MITRE ATT&CK, Diamond Model and Cyber Kill Chain.
• Experience with TI platforms and scripting; strong written/verbal communication.

Responsibilities

• Attribute intrusion activity to threat actors, campaigns and clusters using TTPs and victimology.
• Track adversaries over time and map behavior to MITRE ATT&CK and the Diamond Model.
• Pivot across infrastructure, domains, certificates, malware families and datasets to uncover links.
• Collaborate with IR, Threat Hunting, Detection Eng and SOC to enrich investigations.
• Produce clear, evidence-based intelligence reports and briefings for technical teams and leadership.
• Share indicators with partners, ISACs and law enforcement; manage sources and vendors.
• Champion inclusion and diversity in talent recruitment.

Skills

Attribution & adversary tracking

Infrastructure analysis

Malware analysis

Threat intel tools

Structured analytic techniques

Confidence-based assessments

Python scripting

Analytic thinking

Stakeholder communication

Education

Bachelor’s Degree or equivalent in cybersecurity, CS, intelligence studies or related field

Certifications (GCTI, GREM, GCFA)

Tools

Threat intelligence platforms

Passive DNS

Certificate transparency

Malware sandboxes

Open-source datasets

Job description

WTW group is seeking a Cyber Threat Intelligence professional to lead attribution and adversary pursuit efforts. Analyze infrastructure, malware, tooling and TTPs to attribute intrusions to threat actors and campaigns.

You will track adversaries, map behavior to MITRE ATT&CK and the Diamond Model, and produce clear intelligence for technical teams, leadership and external partners. Collaborate with incident response, threat hunting, detection engineering and SOC while maintaining sources and