Lead Cyber Threat Attribution & Adversary Tracking

WTW group; Madrid; On-site; EUR 70,000 - 100,000; Full time

Job summary

WTW group in Madrid seeks a Cyber Threat Intelligence professional to lead attribution and adversary pursuit efforts. You will analyze infrastructure, malware and TTPs, build actor dossiers, and map behavior to MITRE ATT&CK and the Diamond Model.

You will collaborate with Incident Response, Threat Hunting and SOC to enrich investigations, produce evidence-based intelligence and brief leadership. Requires 5+ years in threat intel or related security field.

Qualifications

• A minimum of 5 years of experience in cyber threat intelligence, incident response or related security discipline.
• Focus on attribution and adversary tracking; professional services or large enterprise experience is a plus.
• Knowledge of MITRE ATT&CK, Diamond Model and Cyber Kill Chain is essential.

Responsibilities

• Attribute intrusion activity to threat actors by analysing infrastructure, malware, tooling and TTPs.
• Track adversaries over time and maintain actor dossiers.
• Pivot across infrastructure, domains and datasets to uncover new activity and links between clusters.
• Collaborate with Incident Response, Threat Hunting, Detection Engineering and SOC to enrich investigations and create hunt hypotheses.
• Produce clear, evidence-based intelligence reports and briefings for technical teams and leadership.
• Share indicators and intelligence with trusted partners and vendors.

Skills

Threat intelligence

Adversary tracking

Structured analytic techniques

MITRE ATT&CK

Diamond Model

Threat actor profiling

Incident Response

Education

Bachelor's degree in cybersecurity/related field

Certifications (GCTI, GCFA, GREM)

Tools

Threat intelligence platforms

Passive DNS

Certificate transparency

Malware sandboxes

Python

Job description

WTW group in Madrid seeks a Cyber Threat Intelligence professional to lead attribution and adversary pursuit efforts. You will analyze infrastructure, malware and TTPs, build actor dossiers, and map behavior to MITRE ATT&CK and the Diamond Model.

You will collaborate with Incident Response, Threat Hunting and SOC to enrich investigations, produce evidence-based intelligence and brief leadership. Requires 5+ years in threat intel or related security field.