PhD student position in Data-driven Cybersecurity

• a B.Sc. in Computer Science, Telecommunications Engineering or related field, with a solid academic record. Postgraduate studies (holding a M.Sc. or being currently enrolled in one) will be a plus.
• Background in statistical learning, data analysis, or cybersecurity.
• Programming skills
• Proficiency in English
• [Optional] Experience with NLP or text analysis
• [Optional] Interest in interdisciplinary and mixed-methods research
• [Optional] Working knowledge of languages other than English

• Full-time paid position for up to 4 years, with competitive salary and benefits.
• Hands-on training in data-driven analysis for cybersecurity.
• The opportunity to work in a thrilling and international environment
• A vibrant, collaborative, multi-cultural and English-speaking research environment.
• A chance to live and work in Madrid, Spain, a cosmopolitan city offering high quality of life, excellent public services, and rich cultural opportunities.
• The expectation to publish in top-tier conferences and journals such as USENIX Security, IMC, WWW, or CSCW.
• Excellent prospects for a career in academia, research labs, or the privacy-tech industry [11].

IMDEA Networks Institute invites applications for research positions in the area of cybersecurity. The selected candidate will become a member of the Cybersecurity group led by Dr. Guillermo Suarez-Tangil.

The candidate will conduct cutting-edge research on how cybercrime is organized, coordinated, and sustained online, and on how it can be detected and disrupted. Cybercrime is a fundamentally collective enterprise: offenders rely on shared channels - underground forums, marketplaces, and increasingly private or encrypted platforms - to exchange tools, knowledge, and services. The objective of this position is to build an observatory of these ecosystems and to develop data-driven methods that make their activity legible: characterising how illicit practices emerge, stabilise, and spread across platforms, communities, and languages, and turning those observations into early indicators of new threats [1-4].

A central challenge is that this environment is adversarial and non-stationary. Actors deliberately adapt how they communicate in order to evade scrutiny, and what they exchange shifts in meaning over time and across cultural and linguistic contexts. Methods trained on static, English-centric data degrade quickly once deployed. The research will therefore combine qualitative fieldwork with computational modelling to develop approaches that operate under uncertainty, adapt as the landscape changes, and generalise beyond the settings they were trained on - rather than relying on predefined dictionaries or fixed lists of known threats.