Threat intelligence roles share a common purpose: to turn scattered information about adversaries, their methods, and their infrastructure into knowledge that an organization can act on. Practitioners in this area study who might target an organization, how they operate, and why, then communicate findings in a form that supports defenders, responders, and decision makers. The value of the work lies in reducing uncertainty, so that security investments and operational responses rest on evidence rather than guesswork.
Although these roles are related, they differ in scope, audience, and time horizon. Some focus on the technical detail of a single campaign or malware family, while others synthesize broad trends to inform leadership over months or years. The pages beneath this section describe each role in turn, including its typical responsibilities, the skills it draws on, and how it connects to security operations, incident response, and risk management.
The Threat Intelligence Analyst sits at the center of day-to-day practice, gathering and evaluating information, enriching alerts and investigations, and producing timely reporting for operational teams. The CTI Manager leads an intelligence function, setting collection priorities, defining requirements with stakeholders, and ensuring that output reaches the right audiences in a usable form. The Threat Researcher works at greater technical depth, analyzing malware, tooling, and actor behavior to document techniques and attribute activity.
Two further roles address more specialized needs. The Dark Web Analyst monitors underground forums, marketplaces, and leak sites to surface early signals of exposure, such as stolen credentials or planned activity, always within legal and ethical boundaries. The Strategic Threat Analyst steps back from individual incidents to assess the broader landscape, relating geopolitical events, sector trends, and actor motivations to the risks an organization faces.
Careers in threat intelligence rarely follow a single path, and the boundaries between these roles shift from one organization to another. Many practitioners move between operational, technical, and strategic work over time. Reading the individual pages alongside this overview helps a professional see where their interests fit and how the roles reinforce one another and the wider security program.