Description

Would you like to help drive the growth of a global company that works with 91% of the Fortune Global 500? Do you have a passion for uncovering who is behind cyber threats and holding them to account? Do you have hands-on experience in threat actor attribution and adversary tracking? If so, we have an exciting opportunity to join our Cyber Threat Intelligence team where you could lead attribution and adversary pursuit efforts for WTW.

The Role

• Attribute intrusion activity to threat actors, campaigns and clusters by analysing infrastructure, malware, tooling, tradecraft (TTPs) and victimology, applying structured analytic techniques and clear confidence assessments
• Track and profile adversaries over time, including state-sponsored, financially motivated and hacktivist groups, maintaining actor dossiers and mapping behavior to MITRE ATT&CK and the Diamond Model
• Pursue adversaries proactively by pivoting across infrastructure, domains, certificates, malware families and open-source and commercial datasets to uncover new activity and links between clusters
• Partner with Incident Response, Threat Hunting, Detection Engineering and the SOC to enrich investigations with attribution context and convert findings into hunt hypotheses and detections
• Produce clear, evidence-based intelligence reports and briefings for technical teams, leadership and business stakeholders, tailored to their needs
• Collect, vet and share indicators and intelligence with trusted partners, ISACs and law enforcement, and manage external intelligence sources and vendors
• Champion inclusion and diversity to ensure that the very best talent, irrespective of age/sex/ethnicity etc., are recruited
  

Qualifications

The Requirements

• A minimum of 5 years of experience in cyber threat intelligence, incident response or a related security discipline, with demonstrable focus on attribution and adversary tracking; experience in a professional services firm or large enterprise a major plus
• Proven success attributing activity and tracking threat actors using infrastructure analysis, malware analysis and open-source and commercial intelligence tools
• Expertise in intelligence tradecraft, including structured analytic techniques, analysis of competing hypotheses and confidence-based assessments
  Strong knowledge of adversary TTPs and frameworks such as MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain
• Experience with threat intelligence platforms, passive DNS, certificate transparency, malware sandboxes and similar tooling; scripting skills (e.g. Python) a plus
• Exceptional written and verbal communication skills; ability to build strong relationships quickly and translate complex findings for non-technical audiences
• Proven success working in a fast-paced, high-pressure environment and self sufficient
• Strong organizational abilities and flexibility to work in a performance-driven environment managing multiple deliverables
• Strong analytic skills with the ability to balance depth of investigation with the needs of the business
• Bachelor’s Degree or equivalent in cybersecurity, computer science, intelligence studies or related field preferred; relevant certifications (e.g. GCTI, GREM, GCFA) a plus

Equal Opportunity Employer