Threat Intelligence Analyst: Role, Skills and a Portfolio Exercise

A threat intelligence analyst turns sourced information about cyber threats into context that helps someone make a security decision. The work can include research, technical analysis, writing and collaboration with defenders. The mix depends on the employer, and a job title alone won't tell you which part dominates.

NIST defines threat intelligence as threat information that has been analyzed, interpreted or enriched to provide context for decisions. That is a useful way to separate an analyst's work from a feed of indicators or a collection of links. The finished product should help a named audience understand what matters, what is known, and what action is reasonable.

What does a threat intelligence analyst do?

The work starts with a question. A security leader may want to know whether a campaign described in a public advisory is relevant to the organization. A detection team may need to understand which attacker behaviors to look for. An incident response team may need context for an event already underway.

The analyst identifies useful sources, checks where their claims came from, adds technical or organizational context, considers competing explanations, and communicates a finding. A finished product might be a short threat brief, a campaign assessment, a set of detection ideas, or a recommendation for a particular team. The value is in the reasoning and relevance, not the number of indicators collected.

The European Union Agency for Cybersecurity describes a Cyber Threat Intelligence Specialist as someone who collects, processes and analyzes information to produce actionable reports for stakeholders. Its profile includes translating business needs into intelligence requirements, assessing threat activity, and advising on mitigation. This is a European skills framework, not a promise that every employer uses the same title or division of work.

CTI alongside nearby roles

Cybersecurity teams organize this work differently. CISA's NICE Framework says a work role is not the same thing as a job title. Its Threat Analysis role covers collecting, processing, analyzing and sharing threat assessments, while Defensive Cybersecurity and Incident Response describe related but different functions.

Treat these as distinctions in emphasis, not walls between teams. Some CTI analysts work within a SOC, and a job may combine threat research with incident response or detection engineering. Read the duties and examples in the vacancy. Look for what the role investigates, which audience receives its work, and what the analyst is expected to produce.

Skills you can show through the work

You need enough technical understanding to interpret the evidence in front of you. That might mean knowing what a network indicator can and cannot show, understanding a vulnerability advisory, or explaining how a behavior could appear in endpoint or identity telemetry. Some roles are more technical than others. Malware analysis, scripting and query languages may matter for a technical position, but they aren't a universal checklist for every CTI job.

You also need to handle uncertainty carefully. Two reports that repeat the same original claim are not necessarily independent confirmation. A plausible explanation is still a hypothesis until its evidence is checked. Record what supports your assessment, what could weaken it, and what information you still need.

Writing is part of the analysis. A defender may need a concise behavior summary and a detection idea. A manager may need the potential business consequence and a choice to make. The Mandiant competency framework groups CTI skills into problem solving, professional effectiveness, technical literacy and cyber threat proficiency. It also describes technical and strategic analysts with different areas of depth. Use that as a way to think about your development, not as a universal job specification.

MITRE ATT&CK can give a shared vocabulary for describing observed tactics and techniques. MITRE presents it as a knowledge base of adversary behavior and cautions that not every technique applies to every organization. A mapping can help a team discuss behavior; it doesn't by itself prove who performed it, whether your employer is targeted, or how much coverage the organization has.

A safe portfolio exercise: write a short threat brief

You can practice the shape of the work without access to an employer's systems. Use a public advisory or report that permits the kind of reuse you plan, and build a fictional scenario. Don't copy restricted information, expose personal data, publish private indicators, or imply that your fictional organization has been targeted.

For this exercise, imagine a small online retailer wants to know whether a public advisory about credential theft should change its account-protection priorities. The company, its environment and the advisory scenario below are fictional. This is a writing exercise, not a report about a real campaign.

1. Write the question. For example: “What public evidence would help us decide whether to review our authentication controls this month?” Keep the question narrow enough to answer.
2. Make a source table. Record each source, its author, publication date, what it directly supports, and whether it relies on another source. Separate an observed fact from your interpretation.
3. Explain relevance. Name the assumptions you made about the fictional retailer. If you don't know whether it uses the affected service or has the relevant control, say so. Don't turn an unknown into a finding.
4. Consider alternatives. Could the public reporting describe a different environment? Is there another explanation for the behavior? What evidence would change your view?
5. Give a bounded recommendation. Suggest a proportionate next check, such as asking the identity team to confirm whether a named control is in use. State what the available evidence does not justify.
6. Name the audience and handling. Write a short version for the team that would act on it. Include source links and any sharing limits. If you use TLP labels, follow FIRST's definitions; a label is not permission to ignore copyright, law, or the source's other restrictions.

A one-page brief can follow this structure:

• Question: What decision is this assessment meant to support?
• Assessment: What do you judge, and how confident are you in that judgment?
• Evidence: Which sources support it, and how strong or independent are they?
• Relevance: Which parts connect to the stated fictional environment?
• Recommended next step: What should a named team check or consider?
• Gaps and alternatives: What could make the assessment wrong, and what information is missing?
• Sources and handling: Where did the information come from, when was it published, and may your audience share it?

The confidence label is your reasoned description of confidence in your assessment. It is separate from how serious the potential impact would be. Don't use a polished template to make weak evidence sound certain.

NIST's guide to cyber threat information sharing emphasizes defining sharing goals, sources and distribution rules. For a public portfolio, the practical lesson is straightforward: use lawful public material, preserve attribution, respect the source's conditions, and state your own interpretation separately. A sample report shows how you reasoned. It doesn't demonstrate access to private intelligence or guarantee an interview.

How to explore the career

Start with the work, then choose what to learn. If you're coming from a SOC, incident response or IT role, identify one task where you can show careful investigation and clear handoff. If your background is research, journalism, policy or data analysis, connect that strength to enough technical grounding to interpret cyber evidence responsibly. These are possible starting points, not promised hiring routes.

When you read job postings, highlight the verbs and outputs. “Monitor alerts,” “write assessments,” “map activity,” “brief stakeholders,” “build detections” and “support incidents” point to different balances of work. Also check location, eligibility, clearance and experience requirements on the actual vacancy. Those details are employer- and jurisdiction-specific.

You can browse cybersecurity jobs on CSJL and compare each posting with your evidence. If SOC operations are your current route, our guide to SOC analyst tiers explains a nearby discipline. For an applied example you can adapt, see cybersecurity projects for your resume, then use the cybersecurity interview preparation guide to practice explaining your decisions.

Common questions about threat intelligence analyst careers

Do you need a degree or certification?

There isn't one universal requirement. Check the role's location, employer and stated eligibility. The NICE Framework describes work and skills; it doesn't make one degree or certificate a condition for every job. A focused, well-explained work sample may help you show your thinking, but it doesn't replace a required qualification or experience.

Is a threat intelligence analyst the same as a threat hunter?

Not necessarily. Threat intelligence commonly evaluates information about threats to inform decisions; threat hunting searches an organization's systems for adversary behavior that existing defenses may have missed. MITRE's TTP-based hunting paper describes one method for searching local systems for observed adversary behavior. CTI can help shape a hunt hypothesis, and employers may combine responsibilities.

Do you need to code?

Some roles use scripting or data analysis to enrich information or automate repeatable tasks. Others place more weight on technical reading, research and communication. Use current vacancies to identify the level required, and don't claim a language as a skill until you can use it for the stated task.

What should you put in a CTI portfolio?

A concise assessment with traceable public sources, a clear question, reasoning, uncertainty, a useful recommendation and honest handling notes is a good practice artifact. Keep the scenario clearly fictional, don't reproduce restricted material, and label the work as an exercise rather than professional case experience.

A threat intelligence analyst's strongest work product helps a particular person make a better-informed decision. Practice showing how you reached that point: the question you asked, the sources you trusted, the limits you found and the action your evidence supports.

Sources and further reading

• NICE Framework for Cybersecurity, NICCS/CISA
• European Cybersecurity Skills Framework, ENISA
• MITRE ATT&CK: Get Started
• MITRE: TTP-Based Hunting
• NIST SP 800-150: Guide to Cyber Threat Information Sharing
• FIRST Traffic Light Protocol
• Mandiant CTI Analyst Core Competencies Framework, Google Cloud