Cyber Threat Intelligence Analyst

Accountabilities

• Threat-information triage: Review multiple pieces of simulated threat information and determine which intelligence is relevant to organizational priorities and warrants further investigation.
• Source evaluation: Assess the reliability, credibility, relevance, and quality of intelligence sources and explain how these factors affect analytical confidence.
• Threat-actor analysis: Examine available intelligence on simulated threat actors to assess motivation, capabilities, targeting patterns, behaviors, and relevance to an organization.
• TTP analysis: Analyze simulated tactics, techniques, and procedures associated with malicious activity and determine their implications for defensive priorities.
• Indicator analysis: Evaluate indicators of compromise within their broader context, considering their evidential significance rather than treating individual indicators as conclusive.
• Intelligence requirements: Identify critical intelligence gaps and define the additional information needed to support better organizational decision-making.
• Threat prioritization: Compare multiple simulated threats and determine their relative importance based on organizational relevance, likelihood, potential impact, and available evidence.
• Structured analysis: Evaluate competing explanations or hypotheses and communicate why the available evidence supports one assessment more strongly than another.
• Threat assessment: Synthesize information from multiple sources into clear assessments explaining what is happening, why it matters, and what defensive actions should be considered.
• Confidence assessment: Clearly communicate the level of confidence associated with intelligence judgments, including assumptions, evidence limitations, and areas of uncertainty.
• Executive communication: Translate technical threat information into concise, decision-relevant intelligence suitable for senior stakeholders.
• Defensive recommendations: Develop proportionate defensive priorities based on intelligence findings and within the scope of legitimate defensive security.
• Assessment updates: Reassess previous judgments when new information becomes available and demonstrate how additional evidence changes—or confirms—the original assessment.
• Professional artefacts: Produce practical intelligence outputs such as threat assessments, threat-actor profiles, executive briefs, intelligence requirements documents, TTP assessments, indicator assessments, confidence statements, and intelligence updates.

Requirements:

• Target background: Suitable for aspiring Cyber Threat Intelligence Analysts, cybersecurity students and graduates, SOC professionals seeking CTI exposure, career changers, intelligence or security professionals transitioning into cyber, self-taught practitioners, and professionals holding relevant cybersecurity certifications.
• Threat intelligence: Understanding of core cyber threat intelligence concepts, including threat assessment, intelligence requirements, source evaluation, threat prioritization, and adversary analysis.
• Analytical reasoning: Strong critical-thinking and structured-analysis skills, with the ability to evaluate incomplete information and reach evidence-based judgments.
• Threat assessment: Ability to analyze threat actors, TTPs, indicators, organizational exposure, and potential impact within a broader intelligence context.
• Source analysis: Ability to assess the credibility, reliability, relevance, and limitations of available information.
• Intelligence communication: Ability to communicate complex findings clearly and adapt analysis for both technical and senior business audiences.
• Decision support: Ability to convert intelligence findings into practical, decision-useful insights and proportionate defensive recommendations.
• Evidence-based thinking: Ability to identify assumptions, intelligence gaps, competing hypotheses, and confidence levels rather than overstating certainty.
• Adaptability: Comfortable working with incomplete or evolving information and updating assessments when new evidence becomes available.
• Ethical approach: Commitment to using cybersecurity knowledge and analytical capabilities for legitimate defensive, educational, and professional-development purposes.
• Professional development: Willingness to build practical evidence of CTI capabilities through structured simulations and professional analytical artefacts.

Benefits:

• Remote opportunity: Participate remotely in a flexible, simulation-based professional experience.
• Practical experience: Develop hands-on exposure to realistic Cyber Threat Intelligence scenarios without requiring access to live production environments.
• Portfolio development: Create professional artefacts that demonstrate analytical reasoning, threat assessment, intelligence communication, and decision-support capabilities.
• Career exploration: Gain practical exposure to CTI workflows for those entering cybersecurity or transitioning from related security disciplines.
• Transferable skills: Strengthen critical thinking, structured analysis, source evaluation, risk prioritization, and executive communication.
• Multiple scenarios: Experience different combinations of CTI activities depending on the simulations activated.
• Ethical environment: Complete all activities within controlled environments intended for legitimate defensive, educational, and professional-development purposes.
• Professional evidence: Demonstrate the ability to transform raw and incomplete information into clear, actionable, decision-useful intelligence.