Threat Intelligence Analyst
Threat intelligence analysts collect, process, analyze, and share information about cyber threats, producing threat assessments and reports that support security and risk decisions. They track adversaries, their tactics, techniques, and procedures (TTPs), and their campaigns over time, and pass indicators and context to the security operations center (SOC), incident responders, executives, and outside partners.
Related job titles
- Cyber threat intelligence analyst
- CTI analyst
- Cyber threat analyst
- Cyber intelligence analyst
What They Do
12 tasks- Collect cyber threat intelligence products, such as CTI feeds and reports, and integrate them into SOC systems.
- Identify cyber threat tactics and methodologies and characterize intrusion activity against a victim or target.
- Track the history of adversary campaigns, activity, trends, and indicators of compromise (IOCs) over time.
- Aggregate and correlate indicators of compromise, such as suspicious IP addresses, domains, and email addresses, from external reporting and malware reverse engineering.
- Write or improve SOC detections and analytics, or pass the technical details to a team member who builds them.
- Produce cyber threat intelligence reports that summarize threat activity for the organization or its business sector.
- Prepare threat briefings and situational updates, including monthly or quarterly briefings for executives.
- Relay reports of incoming attacks from threat sharing partners to incident response analysts in real time.
- Lead the sharing of threat intelligence with partner SOCs and external sharing groups.
- Identify intelligence requirements and gaps, and answer requests for information.
- Monitor open source websites for hostile content directed at the organization or its partners.
- Give incident responders context on who is behind an incident so they can fully scope its reach.
Knowledge and Skills
- Threat intelligence principles and practices
- Adversary frameworks such as MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model of Intrusion Analysis
- The intelligence lifecycle and structured analytic techniques such as analysis of competing hypotheses
- Tactical, operational, and strategic intelligence
- Cognitive biases and how to mitigate them in analysis
- Malware and malware analysis principles
- Cyber attack stages and intrusion activity phases
- Threat information sharing and handling designations such as the Traffic Light Protocol (TLP)
- Computer networking protocols and network security
How to Become a Threat Intelligence Analyst
CompTIA describes threat intelligence analyst as a position that is not entry level and that requires experience in cybersecurity and computer networking. It notes that previous experience as a network administrator or network engineer helps analysts understand threats.
According to CompTIA, most companies hiring threat intelligence analysts look for a bachelor's degree in computer science, cybersecurity, programming, or a related field, although several years of experience may take the place of a degree.
In a new threat intelligence program, the FIRST CTI SIG notes, the CTI analyst function is typically a secondary duty rather than an official position within incident response. Early CTI analysts focus on tactical intelligence such as IP addresses, domains, and hashes. MITRE notes that in smaller SOCs, threat intelligence and hunting is often an additional duty for other analysts such as incident investigators.
CompTIA lists cyber threat intelligence analyst, vulnerability analyst, cybersecurity analyst, and security operations center (SOC) analyst as job titles related to threat intelligence analyst.
Certifications
7 certificationsThese are certifications that the sources on this page name for the role, as described in the FAQ.
| Certification | Issuer |
|---|---|
| Network+ CompTIA Network+ · CompTIA | CompTIA |
| Security+ CompTIA Security+ · CompTIA | CompTIA |
| CySA+ CompTIA Cybersecurity Analyst · CompTIA | CompTIA |
| PenTest+ CompTIA PenTest+ · CompTIA | CompTIA |
| CISSP Certified Information Systems Security Professional · ISC2 | ISC2 |
| OSCP OffSec Certified Professional · OffSec | OffSec |
| CEH Certified Ethical Hacker · EC-Council | EC-Council |
Frequently Asked Questions
What does a threat intelligence analyst do?→
A threat intelligence analyst collects and analyzes information about cyber threats and turns it into reports, briefings, and indicators. The work includes tracking adversary campaigns and TTPs, correlating indicators of compromise, improving SOC detections, and sharing intelligence with incident responders, executives, and partner organizations.
Is threat intelligence analyst an entry-level job?→
CompTIA states that it is not an entry-level position and that it requires experience in cybersecurity and computer networking.
What skills does a threat intelligence analyst need?→
CompTIA names analytical skills, computer networking experience, and the ability to communicate findings to a non-technical audience and make recommendations that inform business decisions. The NICE Framework Threat Analysis work role lists skills such as identifying intelligence gaps, mitigating cognitive biases, analyzing large data sets, and preparing reports.
What certifications does a threat intelligence analyst need?→
CompTIA lists Network+, Security+, CySA+, PenTest+, CISSP, GIAC certifications, OSCP, and CEH as certifications that can validate the skills for the role. The FIRST CTI SIG training list includes the CREST Registered Threat Intelligence Analyst qualification and the EC-Council Certified Threat Intelligence Analyst course.
How is threat intelligence different from incident response?→
MITRE describes incident responders as focusing on what is happening and how to remove the adversary, while threat intelligence provides context on who the threats are. That context helps responders fully scope an incident's reach.
What tools does a threat intelligence analyst use?→
MITRE notes that CTI analysts often start with incident response management systems, file shares, spreadsheets, and log management tools, and that more mature teams adopt threat intelligence platforms (TIPs) that ingest, organize, connect, and correlate high volumes of adversary-related data.
Sources
- MITRE: 11 Strategies of a World-Class Cybersecurity Operations Center
- NICCS: NICE Framework Threat Analysis work role
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
- FIRST CTI SIG Curriculum: Introduction
- FIRST CTI SIG Curriculum: Training
- FIRST CTI SIG: CTI Maturity Model, Stage 1
- FIRST CTI SIG: CTI Maturity Model, Stage 3
- CompTIA: Your Next Move: Threat Intelligence Analyst
- SANS: Cyber Threat Intelligence Specialist job role
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.