Cyber Threat Intelligence Researcher

EMW

. Support the Cyber Threat Analysis Branch in researching threat actors’ tactics, techniques, and procedures .

Posted 10/31/2026contractBrussels • BelgiumJuniorMid-LevelWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cyber threat analysis, including the ability to research and analyze threat actors' tactics, techniques, and procedures. Proficient in scripting for automation and translating technical intelligence into actionable insights for decision-makers.

Highest-signal resume keywords

NATO SECRET Security ClearanceExperience Analyzing Threat Actor GroupsProgramming Experience in PythonKnowledge of MITRE ATT&CK FrameworkExperience in Network Monitoring and Threat Hunting

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cyber Threat AnalysisScripting LanguagesPattern AnalysisTechnical Threat Intelligence WritingIncident ResponseRed TeamingHost/Network ForensicsReverse EngineeringAutomation TechniquesThreat Detection Signatures

Soft Skills

Good Oral Communication SkillsGood Written Communication SkillsAbility to Cooperate with Team MembersFeedback Exchange

Tools & Technologies

CTAB Cyber Threat Intelligence PlatformCommercial and Open-Source Sources

Industry Keywords

Intelligence LifecycleAnalytical TradecraftCyber Threat IntelligenceIndicators of CompromiseNATO Expectations

Tech Stack

Tools & technologies

Python

About the role

Key responsibilities & impact

Support the Cyber Threat Analysis Branch in researching threat actors’ tactics, techniques, and procedures
Create scripts and queries to automatically track threat actor infrastructure and tools using commercial and open-source sources
Conduct research into prioritized cyber threat actors using the CTAB Cyber Threat Intelligence Platform and other sources
Analyze threat actor infrastructure and detect new malicious infrastructure through pattern analysis and automation
Identify and analyze potential new cyber threats to NATO using existing or novel techniques and scripts
Correlate available sources to establish an adequate threat picture
Write technical threat intelligence products, detection signatures, contextualized indicators of compromise, and standardized CTI products
Translate technical cyber threat intelligence into operational and strategic intelligence products for NATO decision-makers
Support threat researchers and advise strategic cyber threat analysts on complex technical topics
Participate in team and branch calls and provide project status updates
Deliver findings, indicators of compromise, MITRE techniques, scripts, and methodologies that improve NATO’s adversary-tracking processes and tooling
Produce deliverables under NATO Project Manager supervision and submit them for quality review, testing, or inspection
Continuously validate deliverables with the NATO Project Manager and CTAB peers
Hold periodic sessions with the NATO Project Manager to align deliverables with NATO expectations
Implement quality control for submitted products

Requirements

What you’ll need

NATO SECRET security clearance
University degree from a nationally recognised/certified university in a quantitative discipline with substantial computer science content, plus 2 years of specific experience; OR at least 4 years’ experience similar to the tasks described and relevant industry-recognized certificates
Knowledge and experience analyzing threat actor groups, attack patterns, and tactics, techniques, and procedures to produce actionable threat intelligence with demonstrable impact
Experience with the intelligence lifecycle, analytical tradecraft, and frameworks such as MITRE ATT&CK
Good oral and written communication skills and ability to translate complex technical topics for non-domain experts
Ability to cooperate with other threat researchers and exchange feedback
Knowledge of network and system fundamentals
Experience in network monitoring, threat hunting, incident response, red teaming, host/network forensics, or reverse engineering
Programming experience in scripting languages such as Python
Compliance with national requirements for working permits, visas, taxes, and social security while working on site in Belgium
Required English proficiency

Benefits

Comp & perks

NATO-provided secure working environment at NATO HQ for an expected minimum of 2 days per week
Access to the CTAB cyber threat intelligence platform
Remote work from home 3 days per week
Associated travel costs reimbursed when required for project-related meetings at other locations
Vacation and voluntary leave scheduled by agreement
Recognized NATO site holidays