Threat intelligence roles turn scattered information about adversaries, their methods, and their infrastructure into knowledge an organization can act on. Practitioners study who might target an organization, how they operate, and why, then communicate findings so defenders, responders, and decision makers can use them. The value of the work is reduced uncertainty: security investments and operational responses rest on evidence rather than guesswork.
Although these roles are related, they differ in scope, audience, and time horizon. Some focus on the technical detail of a single campaign or malware family; others synthesize broad trends to inform leadership over months or years. Many practitioners move between operational, technical, and strategic work over a career, and the boundaries between the roles shift from one organization to another.
What these roles share#
- A common purpose: converting raw data about adversaries into finished intelligence that supports a decision.
- Calibrated judgment: weighing source reliability, distinguishing fact from assessment, and stating confidence honestly.
- A place in the wider program: each role connects to security operations, incident response, and risk management.
Roles#
- Threat Intelligence Analyst: sits at the center of day-to-day practice, gathering and evaluating information, enriching alerts and investigations, and producing timely reporting for operational teams.
- CTI Manager: leads an intelligence function, setting collection priorities, defining requirements with stakeholders, and ensuring output reaches the right audiences in usable form.
- Threat Researcher: works at greater technical depth, analyzing malware, tooling, and actor behavior to document techniques and recognize threats again later.
- Dark Web Analyst: monitors underground forums, marketplaces, and leak sites to surface early signals of exposure, always within legal and ethical boundaries.
- Strategic Threat Analyst: steps back from individual incidents to relate geopolitical events, sector trends, and actor motivations to the risks an organization faces.