PhD student position in Data-driven Cybersecurity

Cybersecurity Group

Deadline for receipt of applications: August 14, 2026 23:59 AoE (15 August 2026, 13:59h)

IMDEA Networks Institute invites applications for research positions in the area of cybersecurity. The selected candidate will become a member of the Cybersecurity group led by Dr. Guillermo Suarez-Tangil.

The candidate will conduct cutting-edge research on how cybercrime is organized, coordinated, and sustained online, and on how it can be detected and disrupted. Cybercrime is a fundamentally collective enterprise: offenders rely on shared channels — underground forums, marketplaces, and increasingly private or encrypted platforms — to exchange tools, knowledge, and services. The objective of this position is to build an observatory of these ecosystems and to develop data-driven methods that make their activity legible: characterising how illicit practices emerge, stabilise, and spread across platforms, communities, and languages, and turning those observations into early indicators of new threats [1-4].

A central challenge is that this environment is adversarial and non-stationary. Actors deliberately adapt how they communicate in order to evade scrutiny, and what they exchange shifts in meaning over time and across cultural and linguistic contexts. Methods trained on static, English-centric data degrade quickly once deployed. The research will therefore combine qualitative fieldwork with computational modelling to develop approaches that operate under uncertainty, adapt as the landscape changes, and generalise beyond the settings they were trained on — rather than relying on predefined dictionaries or fixed lists of known threats.

The position offers:

• Full-time paid position for up to 4 years, with competitive salary and benefits.
• Hands-on training in data-driven analysis for cybersecurity. 
• The opportunity to work in a thrilling and international environment
• A vibrant, collaborative, multi-cultural and English-speaking research environment.
• A chance to live and work in Madrid, Spain, a cosmopolitan city offering high quality of life, excellent public services, and rich cultural opportunities.
• The expectation to publish in top-tier conferences and journals such as USENIX Security, IMC, WWW, or CSCW.
• Excellent prospects for a career in academia, research labs, or the privacy-tech industry [11].

The position requires:

• a B.Sc. in Computer Science, Telecommunications Engineering or related field, with a solid academic record. Postgraduate studies (holding a M.Sc. or being currently enrolled in one) will be a plus.
• Background in statistical learning, data analysis, or cybersecurity. 
• Programming skills
• Proficiency in English
• [Optional] Experience with NLP or text analysis
• [Optional] Interest in interdisciplinary and mixed-methods research
• [Optional] Working knowledge of languages other than English

IMPORTANT: Please, explicitly select Dr. Suarez-Tangil in your application to better follow up on your application.

Candidates shall submit by the call deadline a CV, a motivation letter, and the contact details of two references through the IMDEA Networks Institute hiring portal, at https://careers.networks.imdea.org/. 

Bibliographic References of Relevant Group Research Outputs (See Google Scholar for links to the articles): 

[1] Mariella Mischinger, Sergio Pastrana, Guillermo Suarez-Tangil. Crime VIP: A Closed-Access Underground Hacking Forum. Proceedings of the 20th International AAAI Conference on Web and Social Media (ICWSM), 2026. Best Dataset Paper.

(link: https://ojs.aaai.org/index.php/ICWSM/article/view/42787)

[2] Mariella Mischinger, Jack Hughes, Fedor Vitiugin, Sergio Pastrana, Alice Hutchings, Guillermo Suarez-Tangil. Lost in Translation: Analyzing Non-English Cybercrime Forums. APWG Symposium on Electronic Crime Research (eCrime). November 4–7, 2025. San Diego, US.

(link: https://suarez-tangil.networks.imdea.org/papers/2025ecrime-translation.pdf)

[3] Mariella Mischinger, Sergio Pastrana, Guillermo Suarez-Tangil. IoC Stalker: Early Detection of Indicators of Compromise. Annual Computer Security Applications Conference (ACSAC). December 9–13, 2024.

(link: https://suarez-tangil.networks.imdea.org/papers/2024acsac-iocs.pdf)

[4] Alfonso Barredo-Valenzuela, Sergio Pastrana, Guillermo Suarez-Tangil. Snorkeling in Dark Waters: A Longitudinal Surface Exploration of Unique Tor Hidden Services. IEEE Transactions on Information Forensics and Security, 2025.National Police Foundation Runner-Up Prize 2026.

(link: https://suarez-tangil.networks.imdea.org/papers/2025tifs-tor.pdf)

 

This contract is part of the project PID2022-143304OB-I00 (PARASITE) funded by MCIN/AEI /10.13039/501100011033/ and by the ERDF, A way of making Europe

Equal Employment Opportunity:

IMDEA Networks Institute aims to increase the proportion of women and therefore qualified female applicants are explicitly encouraged to apply. Until a balanced ratio of men and women has been achieved at the institute, preference will be given to women if applicants have similar qualifications. IMDEA Networks Institute actively promotes diversity and equal opportunities. Applicants are not to be discriminated against in personnel selection procedures on the grounds of gender, ethnicity, religion or ideology, age, sexual orientation (anti-discrimination). People with disabilities who have the relevant qualifications are expressly invited to apply

Inquiries on the position can be directed to the thesis supervisor via email, Dr. Guillermo SUAREZ-TANGIL (guillermo.suarez-tangil “at” imdea.org)