Referso Jobs

Cyber Threat Intelligence Analyst

WTW · Posted Nov 6, 2026

Lead attribution and adversary pursuit efforts for WTW, analyzing threat actor activity and producing intelligence reports.

Attribute intrusion activity to threat actors, campaigns and clusters by analysing infrastructure, malware, tooling, tradecraft (TTPs) and victimology, applying structured analytic techniques and clear confidence assessments
Track and profile adversaries over time, including state-sponsored, financially motivated and hacktivist groups, maintaining actor dossiers and mapping behavior to MITRE ATT&CK and the Diamond Model
Pursue adversaries proactively by pivoting across infrastructure, domains, certificates, malware families and open-source and commercial datasets to uncover new activity and links between clusters
Partner with Incident Response, Threat Hunting, Detection Engineering and the SOC to enrich investigations with attribution context and convert findings into hunt hypotheses and detections
Produce clear, evidence-based intelligence reports and briefings for technical teams, leadership and business stakeholders, tailored to their needs

Bachelor’s Degree or equivalent in cybersecurity, computer science, intelligence studies or related field
Nice to have: professional services firm or large enterprise experience
Nice to have: certifications GCTI, GREM, GCFA