Threat Intelligence Analyst: responsibilities, education, skills and career path

Collects, analyses and shares intelligence on adversaries, TTPs and emerging threats.

Entry

Senior

Coding

Medium

Key skills

Threat intelligenceMITRE ATT&CK & TTPsOSINTIOC management

Common progression

Explore career path Compare careers

Career overview

The Threat Intelligence Analyst turns raw indicators and adversary reporting into actionable intelligence: TTPs, campaign tracking, IOC feeds and briefings that sharpen detection and response. They feed the SOC, the hunters and the leadership. The role leads to threat hunting, senior SOC analysis or security engineering.

Main responsibilities

Produce and consume threat intelligence
Qualify threats and contain confirmed incidents
Analyse security alerts from the SIEM
Keep technical documentation up to date
Align stakeholders and report progress
Monitor platform health, alerts and dashboards
Write and improve operational runbooks
Mentor junior team members and review their work
Write and maintain knowledge base articles
Lead incident resolution and post-mortem analysis
Analyse malware and reverse-engineer samples
Escalate complex cases to the relevant technical team

Technical skills

Threat intelligence90%

MITRE ATT&CK & TTPs85%

OSINT80%

IOC management80%

Adversary tracking75%

SIEM70%

Scripting (Python)60%

Briefing & writing80%

Technologies

MITRE ATT&CKMISPOpenCTIVirusTotalSplunkMicrosoft SentinelPythonSTIX/TAXIIShodanWHOISEDRLinuxGitSuricataZeekKibana

Education level

Education requirements vary depending on the company, country and experience. Professional experience, certifications and technical skills can sometimes compensate for formal education.

High School / Bac

Less common

Bac+2 (2-year degree)

Less common

Bac+3 (Bachelor)

Common entry point

Bac+5 (Master / Engineering)

Common entry point