Cyber Threat Intelligence Analyst

Accountabilities:

• Triage and evaluate threat information: Review multiple sources of simulated threat intelligence, determine relevance, assess reliability and credibility, and identify information requiring further investigation.
• Analyze threats and adversary behavior: Assess simulated threat actors, including their motivations, capabilities, targeting patterns, tactics, techniques, and procedures (TTPs), and determine their potential relevance to an organization.
• Assess indicators in context: Evaluate indicators of compromise alongside supporting evidence rather than treating individual indicators as definitive proof of malicious activity.
• Identify intelligence gaps: Determine what critical information is missing and define the additional intelligence required to improve security decision-making.
• Develop intelligence requirements: Create or refine priority intelligence questions based on organizational assets, threat exposure, business priorities, and stakeholder needs.
• Prioritize threats: Compare competing threats according to relevance, likelihood, potential impact, available evidence, and organizational priorities.
• Apply structured analytical reasoning: Evaluate competing hypotheses, weigh evidence, document assumptions, and communicate why one assessment may be better supported than another.
• Produce actionable intelligence: Synthesize multiple information sources into assessments explaining what is happening, why it matters, and what defensive priorities should be considered.
• Communicate analytical confidence: Clearly articulate confidence levels, evidence quality, assumptions, and factors that limit certainty.
• Brief decision-makers: Translate technical threat intelligence into concise, business-relevant insights and recommendations for senior or non-technical stakeholders.
• Update assessments: Reassess previous conclusions when new intelligence becomes available and clearly explain how additional evidence changes—or does not change—the original assessment.
• Create professional intelligence outputs: Develop threat assessments, threat actor profiles, executive intelligence briefs, intelligence requirements documents, TTP assessments, indicator assessments, confidence statements, threat prioritization reports, and intelligence updates.

Requirements:

• Cybersecurity and threat intelligence interest: Suitable for aspiring CTI analysts, cybersecurity students or graduates, SOC professionals seeking CTI exposure, career changers, intelligence or security professionals transitioning into cyber, self-taught practitioners, and professionals with relevant cybersecurity certifications.
• Analytical reasoning: Ability to examine incomplete or conflicting information, identify patterns, weigh evidence, develop hypotheses, and reach reasoned conclusions.
• Threat intelligence fundamentals: Understanding of threat intelligence concepts, threat actors, indicators of compromise, TTPs, threat assessments, intelligence requirements, and risk prioritization.
• Source evaluation: Ability to assess the reliability, credibility, relevance, and limitations of information sources and explain how these factors affect analytical confidence.
• Critical thinking: Strong attention to context and the ability to distinguish meaningful evidence from isolated or inconclusive information.
• Decision support: Ability to turn technical or complex security information into practical, decision-useful intelligence and proportionate defensive recommendations.
• Communication skills: Strong written and verbal communication, with the ability to present technical findings clearly to both technical and non-technical audiences.
• Professional documentation: Ability to produce structured intelligence products such as assessments, executive briefs, intelligence requirements, threat profiles, and analytical updates.
• Adaptability: Comfortable revisiting assumptions and updating conclusions when new information becomes available.
• Ethical judgment: Commitment to using cybersecurity knowledge exclusively for legitimate defensive, educational, and professional-development purposes.
• Remote working: Ability to work independently, manage analytical tasks effectively, and communicate findings in a remote environment.

Benefits:

• Fully remote work environment.
• Simulation-based experience designed to develop practical cyber threat intelligence capabilities.
• Exposure to realistic CTI scenarios involving incomplete information and evolving intelligence.
• Opportunity to build tangible professional artefacts demonstrating analytical and intelligence skills.
• Development of decision-making, structured reasoning, source evaluation, and threat assessment capabilities.
• Experience producing industry-relevant intelligence deliverables such as executive briefs and threat assessments.
• Suitable for students, graduates, career changers, SOC professionals, self-taught practitioners, and experienced security professionals expanding into CTI.
• Work focused exclusively on legitimate defensive, educational, and professional-development scenarios.
• Opportunity to strengthen a portfolio with evidence of applied cyber threat intelligence work.