Security teams face far more potential threats than they can address at once. A threat intelligence analyst decides which ones are relevant, studying the actors, campaigns, and techniques that threaten an organization and converting that raw material into guidance defenders can act on. The role sits between the flood of available data and the people who must make decisions with it, so it is analytical and communicative at its core, aimed at anticipating attacks rather than only reacting to them.
Responsibilities#
- Start from the intelligence requirements that leaders and defenders need answered, then collect relevant data from internal telemetry, commercial feeds, open sources, information-sharing communities, and incident findings.
- Process and correlate that material: track indicators of compromise and map observed activity to frameworks such as MITRE ATT&CK.
- Build a picture of which adversaries are active and what they appear to want.
- Produce tactical outputs such as indicator sets and detection guidance for operational teams.
- Write operational assessments that explain a campaign and its likely next moves, with clear sourcing and calibrated confidence.
- Brief engineers and executives in language each can use without distortion.
Skills and background#
- Technical grounding: how networks, malware, and intrusions work, so technical evidence can be interpreted, plus an understanding of how attackers think and organize.
- Analytic habits: weighing evidence, avoiding bias, distinguishing fact from assessment, and stating uncertainty honestly.
- Tooling: familiarity with intelligence frameworks and scripting for data handling.
- Communication: consistent, well-organized reporting that translates complex findings for different audiences.
Getting into the role#
People commonly enter from security operations, incident response, or network and systems roles, having already seen how attacks unfold. Others arrive from traditional intelligence or research backgrounds and learn the technical side on the job. Early work emphasizes collection and tactical reporting; with experience an analyst takes on broader assessments, source development, and direct engagement with decision-makers.
Career progression#
Growth leads toward leadership of an intelligence program or toward deeper specialization. The role hands detection content to security operations, supports incident responders during active investigations, and provides the raw understanding that more focused practitioners build upon, whether they reverse engineer tooling, investigate underground markets, or frame long-range strategic risk.
Related roles#
- CTI Manager: directs and quality checks the analyst's work rather than producing it firsthand.
- Threat Researcher: goes deeper into the technical substance of malware and tooling that an analyst contextualizes.
- Dark Web Analyst: focuses on one specialized collection domain the analyst draws on more broadly.
- Strategic Threat Analyst: works at a longer horizon and higher altitude than the analyst's near-term tracking.