Postdoctoral Fellows in Cyber Threat Intelligence Sharing for Cyber Defence

The Department of Information Security and Communication Technology has vacancies for Postdoctoral Fellows in Cyber Threat Intelligence Sharing for Improved Situational Awareness on Cyber Defence (2 positions).

The postdoctoral fellowship position is a temporary position where the main goal is to qualify for work in senior academic positions.

The postdoctoral fellows will work on research and development within the context of the EDF-funded Project “Adapting cyber situational awareness for evolving computing environments (NEWSROOM)”. The core objective of CSA in cyber defence is to provide all stakeholders and personnel of all levels and forces in the chain of command (e.g., in headquarters, in security operation centres (SOCs) on battlefields, or governmental organizations) accurate information about the current threat landscape and threat level to support establishing an appropriate cyber defence strategy and allow timely adaptation according to changes in the current operational picture and the evolving threat landscape. CSA in cyber defence must collect all available data from the internal military network infrastructure, and devices used by military units in operation and on battlefield, which includes structured and unstructured data in the form of logs, sensor data, network traffic, internal intelligence (e.g., context information), and external information from both clear and dark net, such as cyber threat intelligence (CTI), vulnerability and malware reports, security bulletins, etc. To address all these challenges, NEWSROOM studies and designs technologies and processes related to all aspects of CSA in cyber defence, including data and CTI collection, attacker behaviour and capability classification, human computer interfaces (HCIs) and visualisations, and information sharing.

The positions create an opportunity for more collaboration with other research disciplines such as security management, safety engineering, and policymaking in addition to the focus areas mentioned above.

The positions’ working place is NTNU campus in Gjøvik. You will report to the Head of the Department.

Your immediate leader is the Head of the Department of Information Security and Communication Technology.

Duties of the position

The postdoctoral research fellows will:

• Contribute to research and development by investigating, assessing and developing methods for:
  •  collecting data and CTI to establish a profound base for better depicting and interpreting the current threat landscape. To enable monitoring of internal infrastructures, devices, and services.
  •  collecting raw data (e.g., logs, monitoring, sensors, network traffic) from hosts on all levels, including clients used by deployed troops, assets such as IOMT, cloud servers and enterprise IT used in headquarters and governmental institutions.
  •  collecting external data, e.g., from public networks, and higher-level information, such as CTI (indicators of compromise (IoCs), vulnerabilities, tactics, techniques, and procedures (TTPs), patches, mitigation actions, etc.).
  •  depicting the current threat landscape and advising necessary changes in the cyber defence strategy to prepare for emerging future threats.
  •  CTI aggregation, supporting military personnel in correlating and consuming vast amounts of information.
• Develop and pursue own research agenda in cyber physical systems risk management.
• Contribute to the development of research and education in Critical Infrastructure Security and Resilience by leading and supporting new research and innovation.
• Work on initiating, organizing, writing proposals for, coordinating, and carrying out national and international R&I projects of high quality, to be funded by national and international sources e.g. the NFR (The Research Council of Norway), and the European Commission.
• Coordinate and manage the Critical Infrastructure Security and Resilience (CISaR) group teams working on R&I projects in critical infrastructure protection, cyber physical system risk management, and other areas of interest of the group.
• Participate as an active member in CISaR activities and in activities of the Department of Information Security and Communication Technology (IIK), including supervision and co-supervision of MSc and PhD students.

Required selection criteria

• You must have completed a Norwegian doctoral degree or corresponding foreign doctoral degree recognized as equivalent to a Norwegian PhD in information security, computer science, or equivalent, with focus on the cybersecurity of critical infrastructure and/or cyber-physical systems. If you can document that the PhD thesis has been submitted, your application can be assessed even if you have not yet defended your dissertation. Documentation of the obtained doctoral degree must be presented before you can take up the position.
• Track record with publications on relevant research areas in credible journals and conferences.
• Being able to attend and present at national and international forums.
• Good written and oral English language skills.

The appointment is to be made in accordance with Regulations on terms of employment for positions such as postdoctoral fellow, Ph.D Candidate, research assistant and specialist candidate.

Preferred selection criteria

• Knowledge and technical skills in
  •  use case and scenario specification
  •  elicitation of system requirements (functional, non-functional, operational etc)
  •  CTI modelling and sharing
  •  CTI security principles
  •  access control and data management for CTI
  •  trust management and modeling in CTI sharing
  •  data fusion and correlation
• Experience with developing and operating laboratory facilities for security testing.
• Experience with supervision of MSc students’ thesis work.
• Experience with participating in EU and/or nationally funded R&I projects related to cyber security for critical infrastructure and cyber-physical systems.
• Experience with having developed research project proposals for external funding bodies such as the European Commission, Research Council of Norway, etc.

Personal characteristics

• Being able to travel frequently.
• Flexibility and willingness to work on a broad range of topics covered by the activities of the CISaR group.
• Initiative-taking and self-starter who works well with minimal supervision and shows excellent judgement about when to look to managers and teammates for guidance, and when and how to communicate with diverse stakeholders.
• Team player with a proven track record of building cross-functional relationships and ability to work in an international research team.
• Effective communication and negotiation skills, both written and verbal persuasiveness and strong influential skills.
• Eager to learn with a high desire to perform and disseminate high-quality research.

Emphasis will be placed on personal and interpersonal qualities.

We offer 

• exciting and stimulating tasks in a strong international academic environment
• an open and inclusive work environment with dedicated colleagues
• favourable terms in the Norwegian Public Service Pension Fund 
• employee benefits 

Salary and conditions

As a Postdoctoral Fellow (code 1352) you are normally paid from gross NOK  575 400 (scale 59) per annum, depending on qualifications and seniority. From the salary, 2% is deducted as a contribution to the Norwegian Public Service Pension Fund.

The period of employment is 3 years. 

The engagement is to be made in accordance with the regulations in force concerning State Employees and Civil Servants, and the acts relating to Control of the Export of Strategic Goods, Services and Technology. Candidates who by assessment of the application and attachment are seen to conflict with the criteria in the latter law will be prohibited from recruitment to NTNU.

After the appointment you must assume that there may be changes in the area of work.

The position is subject to external funding.

It is a prerequisite you can be present at and accessible to the institution on a daily basis.

About the application 

The application and supporting documentation to be used as the basis for the assessment must be in English.

Publications and other scientific work must be attached to the application. Please note that applications are only evaluated based on the information available on the application deadline. You should ensure that your application shows clearly how your skills and experience meet the criteria which are set out above.

If, for any reason, you have taken a career break or have had an atypical career and wish to disclose this in your application, the selection committee will take this into account, recognizing that the quantity of your research may be reduced as a result.

The application must include: 

• CV and certificates
• transcripts and diplomas for bachelor’s-, master’s- and PhD degrees. If you have not yet completed your Ph.D, you must provide confirmation on your estimated date for the doctoral dissertation, or that your PhD thesis has been submitted
• A copy of the doctoral thesis. If you are close to submitting, or have recently submitted your thesis, you can attach a draft of the thesis. Documentation of a completed doctoral degree must be presented before taking up the position.
• Academic works – published or unpublished – that you would like to be considered in the assessment (up to 5 items)
• Research plan focused explicitly on the suitability of the candidate for the position, and the proposed approach for addressing the described work
• Name and contact information of three referees

If all, or parts, of your education has been taken abroad, we also ask you to attach documentation of the scope and quality of your entire education. Description of the documentation required can be found here. If you already have a statement from NOKUT, please attach this as well.

Joint works will be considered. If it is difficult to identify your contribution to joint works, you must attach a brief description of your participation.

In the evaluation of which candidate is best qualified, emphasis will be placed on education, experience and personal and interpersonal qualities. Motivation, ambitions, and potential will also count in the assessment of the candidates.

NTNU is committed to following evaluation criteria for research quality according to The San Francisco Declaration on Research Assessment – DORA.