#NC26CSG0051 - CTI Researcher
Deadline: November 11, 2026
Requester: NATO
Location: Brussels, Belgium
Job type: Contractor
Start date: January, 2027
Security clearance: NATO SECRET
SCOPE OF WORK / DUTIES / ROLES
- Create scripts and queries to accurately and automatically track threat actor infrastructure and tools using commercial and open-source information and tools;
- Write technical threat intelligence products, including detection signatures, meant for network defenders to aid network defence, threat hunting and adversary emulation efforts;
- Aid in translating technical cyber threat intelligence into operational and strategic intelligence products to inform decision-makers at NATO.
REQUIRED SKILLS, KNOWLEDGE AND EXPERIENCE
- All general and domain specific qualification requirements stated in the AAS+ Framework Agreement shall be applicable (e.g., required English proficiency);
- A university degree from a nationally recognised/certified university in a quantitative discipline (Computer Science, Engineering, Statistics, Operations Research, etc.) with substantial computer science content and 2 years of specific experience – OR - at least 4 years’ experience similar to the tasks described in this SoW and relevant industry recognized certificates;
- Knowledge and experience in analysis of various threat actor groups, attack patterns and tactics, techniques, and procedures (TTPs) to produce actionable threat intelligence to enable network and host defences in organizations with demonstrable impact;
- Experience with and knowledge of the intelligence lifecycle, analytical tradecraft and frameworks such as MITRE ATT&CK;
- Good communication skills, both orally and written. Able to translate complex technical topics into information conveyable to non-domain experts. Can easily cooperate with other threat researchers by taking and giving feedback;
- Knowledge of network and system fundamentals and experience in any of the following cybersecurity fields: network monitoring, threat hunting, incident response, red teaming, host/network forensics, or reverse engineering;
- Experience with programming in scripting languages such as Python.
APPLY TO THIS POSITION