Would you like to help drive the growth of a general company that works with 91% of the Fortune Global 500? Do you have a passion for uncovering who is behind cyber threats and holding them to account? Do you have hands-on experience in threat actor attribution and adversary tracking? If so, we have an exciting opportunity to join our Cyber Threat Intelligence team where you could lead attribution and adversary pursuit efforts for WTW.

The Role

- Attribute intrusion activity to threat actors, campaigns and clusters by analysing infrastructure, malware, tooling, tradecraft (TTPs) and victimology, applying structured analytic techniques and clear confidence assessments
- Track and profile adversaries over time, including state-sponsored, financially motivated and hacktivist groups, maintaining actor dossiers and mapping behavior to MITRE ATT&CK; and the Diamond Model
- Pursue adversaries proactively by pivoting across infrastructure, domains,



certificates, malware families and open-source and commercial datasets to uncover new activity and links between clusters
- Partner with Incident Response, Threat Hunting, Detection Engineering and the SOC to enrich investigations with attribution context and convert findings into hunt hypotheses and detections
- Produce clear, evidence-based intelligence reports and briefings for technical teams, leadership and business stakeholders, tailored to their needs
- Collect, vet and share indicators and intelligence with trusted partners, ISACs and law enforcement, and manage external intelligence sources and vendors
- Champion inclusion and diversity to ensure that the very best talent, irrespective of age/sex/ethnicity etc., are recruited

📌 Cyber Threat Intelligence Analyst (Madrid)
🏢 WTW External
📍 Madrid