Cyber Threat Intelligence Researcher

Job Overview

Nextlink is seeking Cyber Threat Intelligence Researcher to support NATO’s Cyber Threat Analysis Branch (CTAB) within the Joint Intelligence and Security Division (JISD). The successful candidate will contribute to strengthening NATO’s cyber defence capabilities by researching, analysing and tracking sophisticated cyber threat actors, their infrastructure, tools, tactics, techniques and procedures (TTPs).

The role involves conducting technical cyber threat intelligence research, developing automated scripts and queries, identifying malicious infrastructure, analysing indicators of compromise (IoCs), and producing actionable intelligence products to support network defence, threat hunting and strategic intelligence assessments.

Working alongside cyber threat researchers and intelligence analysts, the individual will translate complex technical findings into clear, evidence-based intelligence that supports NATO’s operational and strategic decision-making.

Key Responsibilities

• Cyber Threat Intelligence Research: Research and analyse prioritized cyber threat actors, their infrastructure, tools, capabilities, attack patterns and evolving TTPs using commercial, open-source and internal intelligence sources.
  

• Threat Actor Tracking and Infrastructure Analysis: Identify, investigate and monitor malicious infrastructure, domains, IP addresses, tools and associated indicators to uncover emerging threats and adversary activity.
  

• Automation and Scripting: Develop and maintain Python scripts, automated queries and analytical workflows to track threat actor infrastructure, identify patterns and improve the scalability and efficiency of intelligence collection.
  

• Technical Threat Analysis: Conduct technical analysis of cyber threats, correlate intelligence from multiple sources, identify emerging attack techniques and develop an accurate understanding of the cyber threat landscape.
  

• Detection Engineering: Translate threat intelligence findings into actionable detection signatures, contextualized indicators of compromise and standardized technical intelligence products to support network and host-based defence.
  

• Threat Hunting Support: Provide technical intelligence and analytical support to network defenders and threat hunters to improve threat detection, investigation and defensive capabilities.
  

• Intelligence Production: Convert technical cyber threat intelligence into structured analytical reports, assessments and strategic intelligence inputs to support NATO leadership and relevant stakeholders.
  

• MITRE ATT&CK Framework: Apply established intelligence methodologies and frameworks, particularly MITRE ATT&CK, to classify adversary behaviours, map TTPs and communicate threat findings consistently.
  

• Collaboration and Knowledge Sharing: Work closely with CTAB researchers, strategic cyber analysts and other intelligence stakeholders, sharing findings, methodologies, scripts and technical expertise.
  

• Continuous Improvement: Develop and improve analytical methodologies, automation capabilities, scripts and intelligence workflows to enhance NATO's ability to monitor, track and understand cyber adversaries.
  

• Reporting and Stakeholder Engagement: Present research findings, provide regular project updates, participate in team meetings and communicate complex technical subjects to both technical and non-technical audiences.
  

3. Essential Skills and Experience

• A university degree in Computer Science, Engineering, Statistics, Operations Research or another relevant quantitative discipline with substantial computer science content, accompanied by at least two years of relevant experience; alternatively, a minimum of four years of relevant professional experience supported by industry-recognised certifications.
  

• Demonstrable experience researching and analysing cyber threat actors, their attack patterns, infrastructure, tools and TTPs.
  

• Strong understanding of cyber threat intelligence methodologies, including the intelligence lifecycle and analytical tradecraft.
  

• Practical experience applying the MITRE ATT&CK framework to cyber threat research and intelligence analysis.
  

• Experience with Python or other scripting languages for automation, data analysis and intelligence collection.
  

• Knowledge of network and system fundamentals, including network protocols, operating systems and cybersecurity technologies.
  

• Ability to identify, investigate and correlate indicators of compromise using multiple intelligence sources.
  

• Experience developing technical reports, detection methodologies, analytical scripts or other actionable intelligence products.
  

• Strong analytical, research and problem-solving capabilities.
  

• Excellent written and verbal communication skills, with the ability to translate complex technical findings into clear and understandable intelligence.
  

• Ability to collaborate effectively with multidisciplinary teams and incorporate constructive feedback.
  

• Valid NATO SECRET security clearance.
  

4. Desirable Skills and Experience

• Experience working within military, government, defence or intelligence organisations.
  

• Familiarity with commercial and open-source cyber threat intelligence platforms and tools.
  

• Knowledge of advanced persistent threats (APTs), cyber espionage groups and state-sponsored cyber operations.
  

• Experience developing automated threat intelligence collection, enrichment and correlation workflows.
  

• Knowledge of threat intelligence sharing standards and formats, such as STIX/TAXII.
  

• Experience developing network detection signatures and technical indicators for defensive security operations.
  

• Understanding of cloud environments, network infrastructure and enterprise security architectures.
  

• Experience supporting strategic intelligence production and communicating technical cyber threats to senior stakeholders.
  

• Relevant industry certifications in cybersecurity, threat intelligence, digital forensics or incident response.
  

• ​
  

Requirements

. Education and Qualifications

• Bachelor's degree from a nationally recognised or accredited university in Computer Science, Engineering, Statistics, Operations Research or a related quantitative discipline with substantial computer science content, plus at least two years of relevant experience.
  

• Alternatively, a minimum of four years of relevant professional experience in comparable cyber threat intelligence or cybersecurity roles, supported by relevant industry-recognised certifications.
  

• Relevant professional certifications in cybersecurity, threat intelligence, incident response or digital forensics are advantageous.
  

7. Language Requirements

• Excellent English communication skills, both written and spoken.