Last reviewed August 16, 2026
What this role does
Threat intelligence analysts collect, evaluate, contextualize, and communicate information about threats so teams can prioritize decisions and defensive action.
They support SOC, incident response, vulnerability management, fraud, executives, and regional or sector teams. Deliverables include intelligence requirements, briefs, indicator assessments, threat profiles, and feedback-driven reports.
Is it accessible to beginners?
A good fit for analysts with research, writing, SOC, incident response, regional, fraud, or investigative experience. Strong source evaluation is as important as technical terminology.
Skills to build
- intelligence requirements, collection, source evaluation, and analytic confidence
- adversary behavior, ATT&CK, indicators, and defensive context
- strategic, operational, and tactical writing for distinct audiences
- information handling, attribution caution, and feedback loops
Tool categories and practical use
- threat-intelligence platforms to manage indicators and reports
- SIEM and EDR data to assess local relevance
- open-source intelligence tools used lawfully and within policy
- link analysis and reporting tools to communicate assessed findings
Certification roadmap
| Foundational | CompTIA Security+ |
|---|---|
| Role-aligned | GIAC Cyber Threat Intelligence (GCTI) or CompTIA CySA+ |
| Advanced | GIAC Certified Intrusion Analyst (GCIA) or ISC2 CISSP after relevant experience |
| Optional | MITRE ATT&CK Defender training |
Choose credentials only after reading current issuer requirements and matching them to your target work. A certification can support preparation; it does not replace hands-on evidence or guarantee employment.
Safe portfolio projects
Use only systems you own or are explicitly authorized to use, fictional scenarios, public reports, or sanitized data. Never test a real organization without written authorization.
- Create a threat profile from public reports with confidence statements and citations.
- Map public ATT&CK techniques to fictional defensive detections.
- Write an executive brief and a SOC-focused version of the same assessed risk.
- Build a collection plan for a fictional sector threat question.
- Assess a public indicator list for relevance and expiration using synthetic local context.
Adjacent entry roles
- SOC analyst
- cybersecurity analyst
- research analyst
- fraud analyst
Translate learning into truthful evidence
Weak
Researched cyber threats.
Stronger and truthful
Produced a sourced public threat profile with intelligence requirements, confidence levels, ATT&CK mapping, defensive recommendations, and separate executive and analyst communication formats.
Role-specific interview practice
For scenario answers, use a disciplined sequence: define scope, state the risk objective, identify evidence, explain the action, name escalation or collaboration, and describe validation.
- How do you turn a vague leadership concern into an intelligence requirement?
- How do you assess source reliability and analytic confidence?
- What makes an indicator relevant to an organization?
- How would you avoid overstating attribution?
- How do you hand intelligence to a SOC for action?
- What feedback tells you a report was useful?
- When should intelligence trigger escalation?
- How would you brief uncertainty to executives?
30 / 60 / 90-day preparation plan
First 30 days
Learn intelligence lifecycle, ATT&CK, source evaluation, and concise writing.
By 60 days
Publish sanitized public-source briefs with clear confidence, relevance, and defensive-action sections.
By 90 days
Practice role-specific briefings and show how you would validate that a consumer acted on intelligence rather than claiming predictive certainty.
Realistic progression
Threat intelligence can progress to senior intelligence analysis, threat hunting, incident response, strategic risk, or intelligence program leadership.