Threat Intelligence Analyst Career Guide

Many people who want to work in threat intelligence picture reading about nation-state hackers all day, while the job that employers actually pay for is answering specific questions from defenders and decision makers with evidence they can act on. This guide explains what a cyber threat intelligence (CTI) analyst does at tactical, operational and strategic level, the analytical and technical skills that separate strong analysts from feed collectors, the realistic routes in, the certifications that test the craft, and where the role leads. It is written for SOC analysts, incident responders, researchers and career changers from intelligence, journalism or law enforcement who are weighing a move into CTI, and for managers building a first intelligence function. Programme design is covered separately in the Threat Intelligence Guide; this page looks at the person in the seat.

Key takeaways

Requirements come first. Good analysts start from priority intelligence requirements (PIRs) set with their customers, not from whatever the feeds deliver that morning.
Analysis is the scarce skill. Collecting indicators is easy to automate; judging source reliability, spotting cognitive bias and stating confidence clearly is what employers struggle to hire.
Write for the reader. The same campaign needs a two-line executive summary, an ATT&CK-mapped brief for detection engineers and a block list for the SOC, each with the right TLP marking.
Most analysts arrive from adjacent roles. SOC, incident response, malware analysis and government intelligence are the common feeders; very few CTI jobs are true entry-level posts.
Prove impact, not volume. The measure of a CTI analyst is decisions changed and detections created, not reports published or indicators ingested.

What the role does

The NICE Framework (NIST SP 800-181 Rev. 1) Threat Analysis work role captures the job in task statements such as "Develop priority information requirements", "Identify intelligence gaps and shortfalls", "Answer requests for information", "Identify cyber threat tactics and methodologies" and "Prepare threat and target briefings". It also lists "Scope analysis reports to various audiences that accounts for data sharing classification restrictions", which is a fair summary of half the daily work. Most teams run a version of the intelligence cycle: direction, collection, processing, analysis, dissemination and feedback.

Level	Main customer	Typical output	Time horizon
Tactical	SOC, detection engineering, vulnerability management	Indicators with context, ATT&CK technique mappings, detection ideas, exploited vulnerability alerts	Hours to weeks
Operational	Incident response, threat hunting, security leadership	Campaign and actor profiles, intrusion analysis, hunt hypotheses, assessments of who is targeting the sector	Weeks to months
Strategic	CISO, board, risk, fraud and business leaders	Threat landscape assessments, risk briefings tied to business plans (new market, acquisition, AI rollout)	Months to years

Where analysts sit: in-house CTI teams inside a SOC or security function; intelligence vendors and threat research teams; managed security providers; government agencies and national CERTs; and sector sharing bodies (ISACs). In smaller organisations CTI is often one person, or a part-time duty for a senior SOC analyst or threat hunter, so breadth matters more than specialisation.

A typical week: triage new reporting against PIRs, answer two or three requests for information from the SOC or leadership ("are we exposed to this exploited vulnerability?", "is this group targeting our sector?"), pivot on infrastructure from a recent phishing campaign (T1566), map findings to ATT&CK, hand detection ideas to engineers, and write a weekly summary. Analysts also join incident calls to supply context on the adversary.

Core skills and tools

Skill area	What good looks like	How to build it
Requirements and RFIs	Turn a vague worry into answerable PIRs and track which are being met	Interview two internal customers and write five PIRs with collection sources for each
Source evaluation	Grade source reliability and information credibility separately; know when a vendor report repeats another	Trace three widely shared claims back to their original source
Structured analysis	Use analysis of competing hypotheses, key assumptions checks and devil's advocacy; name cognitive biases (NICE knowledge K0658)	Re-assess a public attribution and write which evidence would change your view
Models	Apply the Cyber Kill Chain, Diamond Model and MITRE ATT&CK to structure intrusions and campaigns	Complete MITRE's free ATT&CK CTI training (five modules, about four hours). See the Cyber Kill Chain and Diamond Model Guide
Pivoting and infrastructure	Pivot from a domain or IP via passive DNS, WHOIS history, TLS certificates and hosting patterns, while keeping operational security	Investigate infrastructure from a published report using a separate research environment
Malware literacy	Read a sandbox report, understand loaders and command and control, extract indicators; write simple YARA rules	See the YARA Rules Guide
Data and scripting	Python and a SIEM query language to enrich, de-duplicate and pivot across data sets; read STIX 2.1 JSON	Pull a public feed, normalise it and score it against your own telemetry
Writing and briefing	Bottom line up front, explicit confidence levels, TLP markings, one page where possible	Write the same assessment for an executive and for the SOC

Standards to know: STIX 2.1 is the JSON language for CTI, with 18 domain objects (including Attack Pattern, Campaign, Indicator, Malware, Threat Actor and Vulnerability) and two relationship objects, Relationship and Sighting; TAXII is its transport. The Traffic Light Protocol is at version 2.0 (current since August 2022) with the labels TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR, and misusing them is a fast way to lose a sharing community's trust.

Tools: a threat intelligence platform (commercial, or open source such as MISP or OpenCTI) to store and relate intelligence; ATT&CK Navigator for coverage and comparison; sandboxes, passive DNS and certificate search for pivoting; a SIEM to test whether indicators and behaviours appear in your estate. Platform selection is covered in the Threat Intelligence Platform Buyer's Guide. The FIRST CTI SIG curriculum is a free, vendor-neutral syllabus covering methodology, PIRs, source evaluation and information reliability, analysis techniques, threat modelling, standards and communicating uncertainty.

Routes into the role

From the SOC: the most common route. Volunteer to own the threat feed, write the weekly threat summary, and turn incidents into short actor profiles. See the SOC Analyst Career Guide.
From incident response or threat hunting: responders already reconstruct intrusions; adding collection management and strategic writing completes the picture. See the Threat Hunting Guide.
From government, military or law enforcement intelligence: strong analytic tradecraft and briefing skills; the gap is usually technical depth in networks, cloud and malware.
From journalism, research or political risk: valuable for strategic and geopolitical CTI, provided you build enough technical fluency to talk to engineers.
From fraud and financial crime: increasingly relevant where cyber and fraud teams share actors and infrastructure. See the Fraud and Cyber Convergence Guide.
Graduate routes: some vendors and large banks run graduate threat research schemes, but most postings ask for prior security experience; the US BLS notes information security analysts typically need a bachelor's degree and some related work experience.

Portfolio: publish two or three analytic pieces built only from public sources: an ATT&CK-mapped breakdown of a public report, a source-traced assessment of a claim, and an infrastructure pivot write-up. State your confidence and your intelligence gaps. Keep research legal and ethical: do not interact with criminal forums, buy leaked data or touch infrastructure you do not own. See the Dark Web Monitoring Guide for how organisations handle that collection under policy.

Certifications that help

Facts below were checked on the awarding bodies' pages on 24 October 2026. Confirm price and current exam version before booking; the table is descriptive, not a ranking.

Body	Certification	What it tests	Format and prerequisites
GIAC	Cyber Threat Intelligence (GCTI)	Intelligence fundamentals; analysis including bias and fallacies; campaigns and attribution; kill chain, Diamond Model and Courses of Action Matrix; malware as a collection source; pivoting and domain analysis; sharing and reporting to executives	82 questions, 3 hours, 71% to pass, includes CyberLive practical items, proctored online or at a test centre
CREST	Registered Threat Intelligence Analyst (CRTIA)	Competence as a threat intelligence team member delivering services that are safe, legal and ethical	Multiple-choice paper and long-form written questions; two-thirds pass mark on the multiple-choice paper; at least two years' experience expected; Pearson VUE
CompTIA, Microsoft, others	Security operations certifications	Security operations foundations that CTI builds on	Useful before moving into CTI. See the Blue Team Certifications Guide

For a wider map of options see the Cybersecurity Certifications Guide. Free material (MITRE ATT&CK CTI training, the FIRST CTI SIG curriculum) covers much of the core method and costs nothing; spend certification budget once you know which level of CTI you want to work at.

Progression

Stage	Focus	Signals you are ready to move
Junior or associate analyst	Feed triage, indicator enrichment, RFI support, tactical reporting	Your tactical reports lead to detections or blocks without rework
CTI analyst	Owns PIRs for a customer group, actor tracking, campaign analysis, regular briefings	Leaders ask for your assessment by name before decisions
Senior or principal analyst	Collection strategy, attribution judgements, strategic assessments, mentoring, external sharing relationships	You set the team's requirements and review others' analytic rigour
CTI lead or manager	Programme design, budget, vendor and ISAC relationships, measuring impact	See the Threat Intelligence Maturity Model

Sideways moves: threat hunting and detection engineering (turning intelligence into analytics), malware research, red team and adversary emulation (using CTI to plan realistic exercises, see the Purple Teaming Guide), security risk and governance (strategic assessments feed risk registers), and AI threat research using MITRE ATLAS.

Pay context: official statistics do not separate CTI analysts. The US Bureau of Labor Statistics groups them with information security analysts, reporting a median wage of $129,180 in May 2025, about 192,900 jobs in 2025 and projected growth of 21% from 2025 to 2035. Treat this only as context for a broad occupation.

Where identity fits

A large share of current intrusions start with valid accounts (T1078): stolen session tokens, phished credentials, leaked API keys and abused OAuth grants rather than exploits. CTI analysts who can track credential markets, infostealer trends and actors that target identity providers and machine credentials give the identity team something concrete to act on, such as which service accounts or token types to rotate first. See the ITDR Guide.

Measuring your impact

PIR coverage: share of priority intelligence requirements with an answer refreshed in the agreed period.
Actioned intelligence: number of detections, blocks, patches or hunts started because of your reporting.
RFI turnaround: time from request to answer, with customer feedback on usefulness.
Indicator quality: share of indicators you shared that produced true positive hits rather than noise.
Decision influence: strategic assessments cited in risk, investment or business decisions.

Framework mapping

Framework	Where CTI work sits
NICE Framework (NIST SP 800-181 Rev. 1)	Threat Analysis work role: PIRs, RFIs, intelligence gaps, threat briefings
NIST CSF 2.0	ID.RA-02 (cyber threat intelligence is received from information sharing forums and sources) and ID.RA-03 (internal and external threats are identified and recorded)
NIST SP 800-53 Rev. 5	PM-16 Threat Awareness Program; RA-3 Risk Assessment
ISO/IEC 27001:2022 Annex A	5.7 Threat intelligence
MITRE ATT&CK	Shared language for adversary behaviour, for example T1566 Phishing and T1078 Valid Accounts

Common failure patterns

Feed hoarding: ingesting every free and paid feed without requirements, which floods the SOC with stale indicators and teaches it to ignore CTI.
Attribution obsession: spending weeks on who did it when the customer needed to know what to patch and detect today.
Unstated confidence: assessments with no confidence level or evidence trail, which readers either over-trust or dismiss.
Wrong audience: sending technical indicator dumps to executives and geopolitical essays to the SOC.
Sharing mistakes: forwarding TLP:AMBER+STRICT material outside the organisation, or naming victims in community channels.
Unsafe research: pivoting on adversary infrastructure from a corporate laptop and tipping off the actor or breaching policy.

Practitioner checklist

Write five PIRs with real customers and map a collection source to each.
Complete the MITRE ATT&CK CTI training and work through the FIRST CTI SIG curriculum.
Learn STIX 2.1 basics and TLP 2.0 labels, and apply them to every product you share.
Practise one structured analytic technique on a public attribution claim.
Build a separate, policy-approved research environment for pivoting.
Publish two or three public-source analytic pieces with explicit confidence and gaps.
Hand at least one detection idea per month to detection engineers and track whether it ships.
Choose a certification only after deciding between tactical, operational and strategic work.
Report impact metrics (actioned intelligence, PIR coverage) rather than report counts.

Standards and references

Related NHI Mgmt Group resources: Threat Intelligence Guide · Cybersecurity Careers Guide · SOC Analyst Career Guide · Threat Hunting Guide

Threat Intelligence Analyst Career Guide: Skills, Roles and Progression