CAREER_NODE_PROFILEThreat Intelligence Analyst
"A Threat Intelligence Analyst is a specialized cybersecurity professional dedicated to identifying and analyzing cyber adversaries. By collecting data from threat feeds, dark web markets, and open-source intelligence, they profile threat actors and map their tactics to frameworks like MITRE ATT&CK. This role bridges the gap between tactical security operations and strategic risk management, empowering organizations to anticipate attacks and deploy proactive defenses."
The Threat Intelligence Analyst is a critical strategic and tactical role responsible for identifying, analyzing, and tracking advanced persistent threats (APTs), cybercriminal syndicates, and hacktivist groups. This role leverages the intelligence cycle to collect telemetry from open-source intelligence (OSINT), dark web forums, and proprietary threat feeds. Daily operations involve mapping adversary tactics, techniques, and procedures (TTPs) against the MITRE ATT&CK framework, producing actionable intelligence reports, and disseminating findings to security operations centers (SOC), incident response teams, and executive leadership. By profiling threat actors and providing geopolitical risk context, the analyst bridges the gap between technical telemetry and strategic business risk, enabling proactive defense engineering, accelerating incident triage, and fortifying the organization's overall cybersecurity posture.
[01] What core skills are required for a Threat Intelligence Analyst?
To succeed as a Threat Intelligence Analyst, security operators must master these core competencies. The matrix below benchmarks each required technical skill against a 5.0 operational proficiency scale, classifying requirements from baseline to elite specialist:
Converged Security
Threat Intelligence (CTI)
Tactical Threat Intel (feeds)
Intelligence Cycle Management
OSINT Data Collection
Dark Web Monitoring
Geopolitical Risk Analysis
Maltego / Link Analysis
[02] Recommended Training Pathways
Accreditation bodies and courses that validate the underlying Skill DNA required for a Threat Intelligence Analyst:
EC-Council Certified Threat Intelligence Analyst (CTIA)
GIAC Cyber Threat Intelligence (GCTI)
GIAC Open Source Intelligence (GOSI)
SANS SEC487: Open-Source Intelligence (OSINT) Analysis
PCI – Professional Certified Investigator
GIAC Certified Intrusion Analyst (GCIA)
[03] What converged risk orchestration and command simulations verify Threat Intelligence Analyst capabilities?
Verify your real-world capability under fire. The following active emulations and sandbox scenarios are mapped directly to the technical requirements of a Threat Intelligence Analyst: