SOC Analyst → Threat Intelligence Analyst

A realistic transition from SOC Analyst to Threat Intelligence Analyst: transferable skills, the gaps to close, a step-by-step learning plan and alternative routes. Estimated skill overlap 39%. Difficulty: Hard.

Difficulty: Hard7 stepsDuration: 16 to 20 monthsOverlap: 39%

Transition from SOC Analyst to Threat Intelligence Analyst.

Transferable skills

  • SIEM

Skills to learn

  • OSINT
  • IOC management
  • Adversary tracking
  • Briefing & writing

Step-by-step learning plan

  1. 1. Build on your SOC Analyst experience

    2–4 weeks

    Leverage

    • SIEM

    Map transferable skills — SIEM — against what a Threat Intelligence Analyst needs.

  2. 2. Close the partial gaps toward Threat Intelligence Analyst

    3–6 weeks

    Improve

    • Threat intelligence
    • MITRE ATT&CK & TTPs
    • Scripting (Python)

    Raise Threat intelligence, MITRE ATT&CK & TTPs, Scripting (Python) to the level a Threat Intelligence Analyst relies on.

  3. 3. Learn the core of the Threat Intelligence Analyst role

    6–10 weeks

    Learn

    • OSINT
    • IOC management

    Technologies

    MISPOpenCTISTIX/TAXII

    Cover the biggest gaps first: OSINT, IOC management.

  4. 4. Master advanced Threat Intelligence Analyst skills

    6–10 weeks

    Learn

    • Briefing & writing
    • Adversary tracking

    Technologies

    ShodanWHOISGit

    Handle the advanced topics: Briefing & writing, Adversary tracking.

  5. 5. Get productive with the Threat Intelligence Analyst toolchain

    4–8 weeks

    Technologies

    MISPOpenCTISTIX/TAXIIShodanWHOISGitZeekKibana

    Be hands-on with MISP, OpenCTI, STIX/TAXII and the rest of the target stack.

  6. 6. Practise Threat Intelligence Analyst work in real conditions

    4–8 weeks

    Ship a portfolio project or take on Threat Intelligence Analyst tasks at work.

  7. 7. Get certified and position yourself as a Threat Intelligence Analyst

    4–8 weeks

    Technologies

    GIAC GCTIRecorded Future CertifiedCompTIA CySA+MITRE ATT&CK Defender

    Update your CV and LinkedIn around Threat Intelligence Analyst, then apply to target roles.

Alternative routes