The CTI Manager, or Cyber Threat Intelligence Manager, leads the function responsible for understanding the adversaries, campaigns, and techniques that threaten an organization. The position sits where analysis meets management: rather than producing most intelligence firsthand, the manager sets the program's direction, defines what the team collects and why, and ensures the resulting insight reaches people who can act on it. Threat intelligence only creates value when it is prioritized, trusted, and connected to decisions, and that connection rarely happens without someone accountable for the whole pipeline from requirement to delivery.
Responsibilities#
- Define priority intelligence requirements with stakeholders such as the security operations center, incident response, vulnerability management, and senior leadership.
- Organize the team's collection and analysis against those requirements.
- Review finished products for accuracy and clarity before they go out.
- Manage relationships with intelligence vendors and information-sharing communities, and oversee the platforms and feeds the team depends on.
- Brief a range of audiences, from a tactical update for defenders to a strategic assessment for executives or the board, tailoring the message to what the threat means for each.
- Budget, hire, mentor analysts, and measure whether the program actually reduces risk.
Skills and background#
- Intelligence foundation: command of the intelligence lifecycle, adversary frameworks such as MITRE ATT&CK, and how tactical, operational, and strategic intelligence differ in purpose and audience.
- Leadership: managing competing priorities and representing the function to the wider business.
- Communication: writing clearly and speaking credibly to both engineers and executives.
- Business context: working knowledge of security operations, incident response, and the organization's own risk posture, to keep the program grounded in what the business needs.
Getting into the role#
Most people reach this role after several years as a threat intelligence analyst or in a closely related discipline such as incident response or security operations, where they build the analytic instincts and domain knowledge the job depends on. Progression usually comes through taking ownership of a collection area, leading projects, and mentoring more junior analysts before formally managing a team.
Career progression#
Common paths from here include director-level leadership over a broader intelligence or detection organization, a move into overall security program management, or a specialized track as a principal analyst or advisor for organizations that prefer deep expertise over people management.
Related roles#
- Threat Intelligence Analyst: produces the tactical assessments the manager prioritizes and quality checks.
- Strategic Threat Analyst: supplies the long-range assessments the manager integrates for leadership.
- Threat Researcher: provides the deep technical investigation into malware and adversary tooling.
- Dark Web Analyst: contributes specialized collection from closed and criminal sources.