Threat Intelligence Analyst → Threat Hunter

Transferable skills

• Threat hunting
• MITRE ATT&CK & TTPs

Skills to learn

• Endpoint & log analysis
• Malware analysis
• Detection engineering
• Network forensics
• Hypothesis design

Step-by-step learning plan

1. 1. Build on your Threat Intelligence Analyst experience

   2–4 weeks

   Leverage

   • Threat hunting
   • MITRE ATT&CK & TTPs

   Map transferable skills — Threat hunting, MITRE ATT&CK & TTPs — against what a Threat Hunter needs.

2. 2. Close the partial gaps toward Threat Hunter

   3–6 weeks

   Improve

   • Scripting (Python)

   Raise Scripting (Python) to the level a Threat Hunter relies on.

3. 3. Learn the core of the Threat Hunter role

   6–10 weeks

   Learn

   • Endpoint & log analysis
   • Detection engineering
   • Hypothesis design

   Technologies

   CrowdStrikeSentinelOneVelociraptor

   Cover the biggest gaps first: Endpoint & log analysis, Detection engineering, Hypothesis design.

4. 4. Master advanced Threat Hunter skills

   6–10 weeks

   Learn

   • Network forensics
   • Malware analysis

   Technologies

   KQLWiresharkWindows

   Handle the advanced topics: Network forensics, Malware analysis.

5. 5. Get productive with the Threat Hunter toolchain

   4–8 weeks

   Technologies

   CrowdStrikeSentinelOneVelociraptorKQLWiresharkWindowsVolatility

   Be hands-on with CrowdStrike, SentinelOne, Velociraptor and the rest of the target stack.

6. 6. Practise Threat Hunter work in real conditions

   4–8 weeks

   Ship a portfolio project or take on Threat Hunter tasks at work.

7. 7. Get certified and position yourself as a Threat Hunter

   4–8 weeks

   Technologies

   GIAC GCFAGIAC GCTIBlue Team Level 2MITRE ATT&CK Defender

   Update your CV and LinkedIn around Threat Hunter, then apply to target roles.

Alternative routes

• Senior SOC Analyst → Threat Hunter