SCOPE OF WORK / DUTIES / ROLES

• Use the CTAB Cyber Threat Intelligence Platform and other sources to conduct research into prioritized cyber threat actors to discover new infrastructure and capabilities under the direction of the team lead;

• Conduct pattern analysis on threat actor infrastructure to detect new malicious infrastructure, and script and automate that detection to allow for threat intelligence at scale;

• Find and analyse potential new cyber threats to NATO based on existing or novel techniques and scripts, and correlate with all available sources to establish an adequate threat picture;

• Translate threat actor tactics, techniques and procedures into actionable intelligence for network defenders through creating detection signatures, contextualizing IoC’s, and writing standardized CTI products, and strategic cyber analysts for use in intelligence production to decision makers;

• Support other threat researchers in their activities, and advise and assist strategic cyber threat analysts in understanding complex technical topics.

Reporting:

• Report weekly in team standups on progress.

Deliverables:

• Actionable, accurate and relevant cyber threat intelligence products that contain behavioral intelligence for network defenders and other cyber threat analysts;

• Constant delivery of findings, mostly comprising indicators of compromise and MITRE techniques, on novel threat actor infrastructure and malware based on assigned threat actors;

• Scripts and methodologies that improve on current processes and tooling and enhance NATO’s ability to track adversaries in cyberspace.