1) Role Summary

The Junior Threat Intelligence Analyst supports the organization’s security outcomes by collecting, triaging, enriching, and communicating threat intelligence that helps prevent, detect, and respond to attacks against company systems, products, customers, and employees. This role converts external and internal signals (e.g., OSINT, commercial feeds, security alerts, vulnerability disclosures, phishing reports) into actionable intelligence for Security Operations, Incident Response, Vulnerability Management, and Engineering.

This role exists in a software/IT company because modern threats move quickly, and defensive teams need a dedicated function to interpret the threat landscape, prioritize what matters, and translate it into detections, mitigations, and awareness. The Junior Threat Intelligence Analyst increases the efficiency and effectiveness of security operations by reducing noise, validating indicators, and providing context that improves decision-making and response speed.

• Business value created
• Faster, more accurate security decisions through contextualized threat insights
• Improved detection quality (higher-fidelity alerts, fewer false positives)
• Reduced exposure time to active exploitation by highlighting relevant threats and vulnerabilities
• Better incident response through adversary TTP awareness and intelligence-driven scoping

• Improved security posture via prioritized recommendations to engineering and operations

• Role horizon: Current (standard capability in many SOCs and security organizations today)

• Typical interaction surfaces

• Security Operations Center (SOC) / Detection & Response
• Incident Response (IR) / Digital Forensics & Incident Response (DFIR)
• Vulnerability Management / Product Security / Application Security
• IT Operations (identity, endpoints, network, cloud operations)
• Engineering (platform, SRE, DevOps) for mitigations and detection-as-code

• GRC (Governance, Risk & Compliance) for reporting and risk articulation (context-dependent)

• Typical reporting line (inferred, realistic)

• Reports to: Threat Intelligence Lead, SOC Manager, or Security Operations Manager
• Works closely with: Detection Engineers, IR Lead, Vulnerability Manager

2) Role Mission

• Core mission

• Provide timely, relevant, and actionable threat intelligence that enables the security organization to prevent, detect, and respond to threats targeting the company’s technology stack, products, workforce, and supply chain.

• Strategic importance

• Threat intelligence is the bridge between “what is happening in the world” and “what we must do internally.” Even at junior level, consistent high-quality triage and enrichment directly improves detection precision, prioritization of response efforts, and communication clarity during incidents.

• Primary business outcomes expected

• Reduced mean time to understand (MTTU) new threats and campaigns affecting the company
• Improved prioritization of vulnerabilities and exposures based on active exploitation and relevance
• Increased actionability of intelligence (more intel converted into detections, blocks, or mitigations)
• Clear, trusted communication of threat context to technical and non-technical stakeholders

3) Core Responsibilities

Below responsibilities reflect a junior individual contributor operating under guidance, with increasing autonomy over time.

Strategic responsibilities (supported execution; limited ownership)

1. Maintain awareness of the threat landscape relevant to company technologies (cloud providers, SaaS stack, endpoint OS, common frameworks) and business exposure (brand, employees, customer data).
2. Support intelligence requirements by helping document and refine Priority Intelligence Requirements (PIRs) and Information Requirements (IRs) with the Threat Intel Lead/SOC Manager.
3. Contribute to threat modeling inputs by mapping observed adversary behaviors to likely attack paths (e.g., identity compromise, cloud credential theft, supply chain risk) and sharing insights with security partners.
4. Assist in quarterly intelligence summaries (threat trends, top adversaries, notable campaigns) to inform security planning and backlog prioritization.

Operational responsibilities (core day-to-day)

5. Monitor and triage incoming intelligence from OSINT, vendor feeds, information-sharing communities, and internal sources (SOC alerts, phishing submissions, incident notes).
6. Validate and enrich indicators of compromise (IOCs) (IPs, domains, hashes, URLs, email artifacts) using multiple sources; assess confidence and relevance.
7. Deduplicate and score intelligence to reduce noise and prevent alert fatigue; maintain hygiene in the TIP and/or SIEM reference lists.
8. Publish daily/weekly threat briefs (internal) summarizing key items, why they matter, and suggested actions.
9. Track emerging threats and active exploitation (e.g., ransomware campaigns, credential phishing kits, exploited CVEs) and escalate high-impact items promptly.
10. Support incident response by providing adversary context, related IOCs, historical sightings, likely objectives, and recommended scoping/detection queries.
11. Operate within an intelligence lifecycle (requirements → collection → processing → analysis → dissemination → feedback), improving repeatability and documentation.

Technical responsibilities (hands-on analysis and integration)

12. Map threats to MITRE ATT&CK (techniques, tactics) and communicate TTP-based detection opportunities.
13. Create or refine detection recommendations (queries, correlation ideas, SIEM dashboards, endpoint/network telemetry suggestions) with SOC/detection engineers.
14. Maintain structured threat intel artifacts using standards where applicable (e.g., STIX/TAXII concepts, MISP events) under team conventions.
15. Perform basic malware/phishing triage (URL/email analysis, sandbox detonation results interpretation, header/metadata review) within defined playbooks.
16. Assist in automation of enrichment using scripts or SOAR steps (e.g., Python, basic API usage, enrichment pipelines), following secure coding and change controls.

Cross-functional / stakeholder responsibilities

17. Coordinate with Vulnerability Management to provide exploitation context and threat-driven prioritization (e.g., KEV, exploit availability, observed scanning).
18. Partner with IT/Identity/Cloud teams to recommend defensive actions (blocks, conditional access adjustments, hardening) with evidence and clear risk framing.
19. Contribute to security awareness by providing threat examples (phishing lures, social engineering patterns) and recommended user guidance (through the appropriate team).

Governance, compliance, and quality responsibilities

20. Apply information handling rules (TLP classification, data minimization, privacy constraints) for threat intel sources and internal data.
21. Document analytic assumptions and confidence levels and follow review processes before wider dissemination.
22. Maintain audit-friendly traceability of key intelligence judgments (sources, dates, rationale) appropriate to organization maturity.

Leadership responsibilities (junior-appropriate: no formal people leadership)

23. Demonstrate ownership of assigned intel queues and deliverables; raise risks early; seek feedback; continuously improve analytic tradecraft.
24. Mentor/help onboard interns or new analysts informally as requested (process guidance, tooling basics), under senior oversight.

4) Day-to-Day Activities

Daily activities

• Review intelligence intake sources:
• Threat intel platform queue (if used), email distribution lists, ISAC/community portals
• Vendor advisories and exploitation alerts
• SOC “intel-needed” tickets and phishing submissions
• Triage and enrich IOCs:
• Reputation checks, passive DNS, WHOIS, certificate transparency lookups
• Hash/URL lookups, sandbox summaries, vendor cross-checks
• Identify false positives and benign infrastructure
• Maintain “actionable list” outputs:
• Candidate blocklists (domains/URLs) with confidence and expiry guidance
• SIEM reference lists / EDR watchlists
• Respond to SOC/IR questions:
• “Is this IP malicious?”, “Do we have sightings?”, “What campaign is this tied to?”
• Produce short internal communications:
• Slack/Teams updates for high-risk items, with a crisp recommended action

Weekly activities

• Publish a weekly threat brief:
• Top 5–10 items relevant to company stack and business operations
• What changed, why it matters, recommended actions, and who owns next steps
• Review detection feedback:
• Which indicators produced noise; adjust scoring/expiry
• Which detections caught true positives; capture lessons learned
• Participate in intel sync with SOC/IR/Vuln:
• Align on priority campaigns, current incidents, and backlog items
• Tune enrichment workflows:
• Improve internal playbooks (what to check first, minimum evidence thresholds)
• Update tagging conventions in TIP/MISP (actor, malware family, confidence)

Monthly or quarterly activities

• Monthly intelligence summary:
• Trends (phishing themes, initial access vectors, top malware families)
• “Top exploited vulnerabilities” relevant to the environment
• Changes in adversary behavior affecting detection/hardening priorities
• Quarterly PIR refresh support:
• Help assess whether intelligence outputs met stakeholder needs
• Propose updated collection sources or coverage gaps
• Support tabletop exercises (context-specific):
• Provide adversary and campaign scenarios to inform simulation realism

Recurring meetings or rituals

• Daily SOC standup (common)
• Weekly threat intel review (common)
• IR case reviews / post-incident reviews (context-specific)
• Vulnerability prioritization meeting (common in mature orgs)
• Change advisory board (CAB) touchpoint for block rules (context-specific)

Incident, escalation, or emergency work

• Rapid triage during active incidents:
• Identify related IOCs/TTPs, likely lateral movement paths, known tooling
• Provide scoping queries suggestions (cloud logs, identity logs, endpoint telemetry)
• Emergency advisories:
• For major events (e.g., widely exploited zero-days), help produce rapid internal advisory:
  • “Are we exposed?”, “What mitigations exist now?”, “What logging/detection should we enable?”
• After-hours support (varies by org):
• Usually on an as-needed basis for major incidents; formal on-call is more typical for SOC than junior intel roles, but some organizations include it in rotation.

5) Key Deliverables

Concrete artifacts expected from the Junior Threat Intelligence Analyst (often co-authored or reviewed by a senior analyst/lead early on):

1. Daily intel digest (short form): notable threats, relevant IOCs, recommended actions.
2. Weekly threat brief (structured): themes, prioritized items, “so what,” and action owners.
3. IOC packages: – Curated indicator sets (domain/IP/hash/URL/email) with confidence, source, and expiry – STIX bundle export or MISP event entries (where applicable)
4. Intelligence notes for incidents: – Campaign context, ATT&CK mapping, related infrastructure, scoping guidance
5. Threat advisories (internal): – For high-impact vulnerabilities or active exploitation with environment relevance
6. Enrichment runbooks/playbooks: – Step-by-step guidance for common investigations (phishing URL, suspicious domain, malware hash)
7. Detection recommendations (inputs to detection engineering): – Query ideas, correlation suggestions, log sources, false-positive caveats
8. Intel hygiene updates: – Deduped, tagged, and maintained TIP entries; indicator lifecycle updates; expiry management
9. Stakeholder FAQs / enablement content: – “How to request intel support,” “What we track,” “How to interpret confidence/TLP”
10. Metrics dashboards inputs: – Weekly/monthly stats on processed intel items, actionability rate, time-to-triage
11. Collection source evaluations: – Short assessments of new feeds/tools (coverage, signal/noise, cost/benefit) for lead review
12. Lessons learned notes: – Post-incident intel takeaways and detection/hardening recommendations

6) Goals, Objectives, and Milestones

30-day goals (onboarding and baseline contribution)

• Learn the environment:
• Company stack overview (cloud providers, identity, endpoint tooling, SIEM/SOAR, key apps)
• Security team operating model, ticketing workflows, escalation paths
• Understand intelligence processes:
• Intake sources, PIRs, confidence scoring, tagging standards, TLP handling
• Begin production support:
• Triage a defined subset of intel items with supervision
• Deliver at least 1–2 high-quality enriched IOC packages reviewed by a senior analyst
• Build credibility:
• Consistently document sources, rationale, and confidence for key judgments

60-day goals (independent execution on scoped areas)

• Independently manage an assigned intel queue (e.g., phishing-related intel, vulnerability exploitation alerts).
• Produce a weekly threat brief with minimal edits needed.
• Provide at least 3 actionable detection or mitigation recommendations that stakeholders implement or backlog.
• Demonstrate consistent quality in tagging, deduplication, and indicator lifecycle management.

90-day goals (repeatable outputs and stakeholder integration)

• Become a reliable first point of triage for defined threat categories (e.g., suspicious domains, brand impersonation, commodity malware campaigns).
• Support at least one incident with meaningful contributions (scoping guidance, related IOCs, campaign context).
• Improve a playbook or enrichment workflow measurably (e.g., reduce time-to-triage, improve actionability).
• Demonstrate effective cross-team communication (clear summaries for SOC, Vuln Mgmt, and IT).

6-month milestones (increasing autonomy and technical depth)

• Own a small intelligence “program slice” under guidance:
• Example: maintain a focused collection set and reporting cadence for credential phishing threats
• Contribute to detection improvements:
• Co-author detection logic recommendations mapped to ATT&CK
• Participate in tuning to reduce false positives from intel-driven detections
• Produce a monthly intel summary that influences at least one security priority (patching focus, logging coverage, identity hardening).

12-month objectives (recognized contributor with growing specialization)

• Be recognized as a dependable analyst who:
• Produces consistent, actionable intelligence with minimal oversight
• Understands business context and prioritizes correctly
• Improves tooling usage and workflows (automation/enrichment)
• Support process maturity:
• Help formalize PIRs, feedback loops, and metrics
• Contribute to intel productization (repeatable “intel products” like advisories, dashboards, collections)

Long-term impact goals (career framework alignment)

• Transition from “processing/enrichment” to “analysis and influence”:
• Own deeper analytic products (campaign analysis, actor tracking, TTP-based detection strategy)
• Become a multiplier:
• Reduce operational noise and increase detection efficacy via intelligence-led prioritization
• Develop a specialization (optional paths):
• Cloud threat intel, vulnerability exploitation intel, fraud/brand abuse intel, malware-focused intel, or detection engineering overlap

Role success definition

The role is successful when threat intelligence is timely, relevant, trusted, and actionable—and when stakeholders demonstrably use it to improve security outcomes (detections, mitigations, incident response clarity).

What high performance looks like

• Produces concise, evidence-backed intel outputs that lead to concrete action.
• Demonstrates strong analytic hygiene: confidence scoring, source traceability, and expiration management.
• Communicates clearly to multiple audiences and follows through on stakeholder requests.
• Continuously improves enrichment speed and consistency without sacrificing quality.

7) KPIs and Productivity Metrics

The metrics below balance volume (output) with impact (outcome) while protecting quality. Targets vary by company maturity, threat volume, and tooling; example benchmarks are provided as directional starting points.

Metric name	What it measures	Why it matters	Example target / benchmark	Frequency
Intel items triaged	Count of incoming intel items reviewed and dispositioned (relevant/irrelevant/escalated)	Ensures coverage of intake and prevents backlog	30–80 items/week depending on feed volume	Weekly
IOC packages produced	Number of curated indicator sets created with context and confidence	Indicates tangible outputs consumable by SOC/tools	3–10/week (often smaller, higher quality)	Weekly
Actionability rate	% of intel items leading to a concrete action (ticket, block, detection update, advisory)	Prevents “intel theater” and measures usefulness	15–35% (varies; higher is better but depends on volume)	Monthly
Time to triage (TTT)	Median time from intel arrival to first disposition	Measures responsiveness; reduces exposure window	P1 items < 4 hours; normal < 2 business days	Weekly
Time to disseminate high-severity intel	Time to notify stakeholders for urgent/high-impact items	Directly affects risk during active exploitation	< 1 hour from validation for urgent items	Monthly
False positive rate (intel-driven)	% of intel-driven blocks/alerts later determined benign	Protects business operations and credibility	< 5–10% with clear expiry and review	Monthly
Indicator freshness / expiry compliance	% of active indicators with valid expiry/review date	Reduces stale blocks and noise	> 90% indicators have expiry	Monthly
Enrichment completeness score	Share of required fields populated (source, first seen, confidence, tags, ATT&CK, references)	Improves downstream automation and analysis	> 85% completeness for “published” intel	Weekly
MITRE ATT&CK mapping coverage	% of significant threats/campaigns mapped to ATT&CK techniques	Enables TTP-based detection and reporting	> 80% for major items	Monthly
Detection contribution count	# of detection ideas/requests accepted into backlog or implemented	Measures influence on detection outcomes	2–6/month (junior scope)	Monthly
Incident support satisfaction	Feedback score from IR/SOC on usefulness of intel during incidents	Validates real-world effectiveness	≥ 4/5 average (survey or retro notes)	Quarterly
Stakeholder request SLA	% of stakeholder intel requests responded to within SLA	Reinforces service reliability and trust	90% within agreed SLA	Monthly
Source signal-to-noise ratio	% of items from a source that are relevant/actionable	Guides feed tuning and cost justification	Improve by 10–20% over 2 quarters	Quarterly
Repeat threat reduction	Evidence of reduced recurrence of a tracked threat (e.g., fewer successful phish) after intel-driven actions	Links intel to business outcome (harder attribution)	Demonstrated improvement in 1–2 priority areas/year	Quarterly
Collaboration throughput	# of cross-team actions completed (tickets closed, blocks deployed, patches prioritized) tied to intel	Ensures intel drives execution	10–30 actions/month depending on org	Monthly
Quality review pass rate	% of intel deliverables requiring minimal rework after review	Measures analytic rigor and readiness	> 80% “minor edits only”	Monthly

Notes on measurement – Mature organizations tie intelligence metrics to incident outcomes (MTTD/MTTR, containment speed) and exposure reduction (patch latency for exploited CVEs). Junior roles typically influence these indirectly; attribution should be handled carefully to avoid misleading conclusions. – Benchmarks should be tuned after 4–8 weeks of baseline measurement.

8) Technical Skills Required

Skills are listed with a short description, typical usage, and importance level for a junior threat intelligence analyst.

Must-have technical skills

• Threat intelligence fundamentals (intelligence lifecycle)
• Description: Requirements, collection, processing, analysis, dissemination, feedback
• Use: Structure daily work and produce repeatable intel “products”
• Importance: Critical
• IOC analysis and enrichment
• Description: Validate IPs/domains/hashes/URLs/emails across multiple sources
• Use: Create curated indicator packages; reduce false positives
• Importance: Critical
• OSINT tradecraft
• Description: Use public sources effectively; evaluate credibility and bias
• Use: Research campaigns, infrastructure, tooling; corroborate claims
• Importance: Critical
• Basic networking and web concepts
• Description: DNS, HTTP/S, TLS certs, IP reputation, CDN behavior
• Use: Interpret suspicious domains/URLs and infrastructure patterns
• Importance: Critical
• Security fundamentals (common attack paths)
• Description: Phishing, credential theft, malware basics, initial access vectors
• Use: Prioritize threats and communicate likely impact
• Importance: Critical
• MITRE ATT&CK familiarity
• Description: Map behaviors to tactics/techniques; understand TTPs vs IOCs
• Use: Drive detection discussions and structured reporting
• Importance: Important
• Log/search basics (SIEM literacy)
• Description: Understand what logs exist and how to search at a basic level
• Use: Support scoping questions; collaborate with SOC/detection
• Importance: Important
• Technical writing for security audiences
• Description: Clear summaries with evidence, confidence, and actions
• Use: Briefs, advisories, incident support notes
• Importance: Critical

Good-to-have technical skills

• Threat Intel Platform (TIP) usage
• Description: Manage indicators, relationships, scoring, and workflows
• Use: Maintain intel repository and dissemination outputs
• Importance: Important
• Email and phishing analysis
• Description: Header review, link analysis, attachment triage, sender authentication concepts
• Use: Support phishing response and awareness inputs
• Importance: Important
• Endpoint and EDR literacy
• Description: Basic understanding of endpoint telemetry, process trees, common artifacts
• Use: Interpret IOCs and TTPs; communicate with SOC/IR
• Importance: Important
• Vulnerability exploitation awareness
• Description: KEV, exploit maturity, exposure context, patch vs mitigate decisions
• Use: Assist Vuln Mgmt prioritization and advisories
• Importance: Important
• Basic scripting (Python or PowerShell)
• Description: API calls, data parsing, enrichment automation
• Use: Speed enrichment, deduplication, formatting, exports
• Importance: Optional (but strongly advantageous)

Advanced or expert-level technical skills (not required at junior level; differentiators)

• STIX/TAXII implementation depth
• Description: Build and integrate structured intel feeds programmatically
• Use: Automation, sharing, and platform integration
• Importance: Optional
• YARA/Sigma rule authoring
• Description: Pattern-based detection logic for files/logs
• Use: Provide detection artifacts to SOC/IR
• Importance: Optional
• Malware analysis fundamentals
• Description: Static/dynamic triage, unpacking basics, behavior interpretation
• Use: Improve campaign attribution and detection recommendations
• Importance: Optional
• Cloud security telemetry knowledge
• Description: Cloud logs and detection patterns (identity, storage, workload events)
• Use: Targeted intel for cloud-centric attacks
• Importance: Optional

Emerging future skills for this role (next 2–5 years; still “Current” role)

• AI-assisted intelligence triage and summarization
• Description: Using AI tools safely for clustering, summarization, translation, and pattern extraction
• Use: Reduce time-to-triage; accelerate reporting
• Importance: Important (growing)
• Detection-as-code collaboration
• Description: Working with version-controlled detection content and CI validation
• Use: More direct pipeline from intel → detections
• Importance: Optional (depends on org maturity)
• Adversary emulation and purple-team awareness
• Description: Translate intel into testable hypotheses and simulation inputs
• Use: Validate coverage and improve readiness
• Importance: Optional

9) Soft Skills and Behavioral Capabilities

Only capabilities that materially affect success in this role are included.

1. Analytical rigor and skepticism – Why it matters: Threat intel is noisy; incorrect judgments can cause business disruption or missed threats. – How it shows up: Cross-checking sources, documenting assumptions, distinguishing fact from inference. – Strong performance: Provides confidence levels, cites evidence, and avoids over-claiming.

2. Prioritization and time management – Why it matters: Intel queues can be endless; value depends on focusing on what is relevant and urgent. – How it shows up: Uses PIRs, severity criteria, and stakeholder needs to rank work. – Strong performance: Fast escalation of high-risk items; consistent throughput without backlog growth.

3. Concise technical communication – Why it matters: Stakeholders need “so what” and “now what,” not raw data. – How it shows up: Short, structured briefs; clear recommended actions; audience-appropriate writing. – Strong performance: Messages routinely lead to decisions (block, detect, patch, investigate).

4. Collaboration and service orientation – Why it matters: Intel is only valuable when integrated into SOC/IR/Vuln workflows. – How it shows up: Responsive support, good handoffs, tracking actions to completion. – Strong performance: Stakeholders proactively ask for input and trust recommendations.

5. Attention to detail – Why it matters: Small errors (wrong domain, mis-typed hash, stale indicators) can create operational harm. – How it shows up: Careful indicator handling, formatting, expiry management, and source traceability. – Strong performance: High “review pass rate,” minimal corrections required.

6. Learning agility – Why it matters: Threat landscape, tools, and tactics evolve constantly. – How it shows up: Regular skill building; incorporates feedback; improves playbooks. – Strong performance: Demonstrates measurable improvement in triage speed and quality over time.

7. Professional judgment and discretion – Why it matters: Intel often involves sensitive sources, internal incident details, or privacy considerations. – How it shows up: Correct TLP handling, careful sharing, understands need-to-know. – Strong performance: Zero avoidable information handling incidents; trusted access maintained.

8. Resilience under pressure – Why it matters: Urgent advisories and incidents require calm, accurate work. – How it shows up: Maintains quality during high volume; communicates clearly in escalation moments. – Strong performance: Produces reliable outputs during incidents without creating confusion.

10) Tools, Platforms, and Software

Tools vary by organization maturity. Items are labeled Common, Optional, or Context-specific.

Category	Tool / platform	Primary use	Commonality
Threat Intelligence Platform (TIP)	MISP	IOC/event management, sharing, tagging, relationships	Common
Threat Intelligence Platform (TIP)	ThreatConnect / Anomali / Recorded Future (platform components)	Managing intel workflows, scoring, enrichment, reporting	Optional
Standards / Sharing	STIX/TAXII clients (various)	Structured intel ingestion/sharing	Optional
SIEM	Splunk / Microsoft Sentinel / Elastic Security	Searching logs for sightings; dashboards; correlation support	Common
SOAR	Cortex XSOAR / Splunk SOAR / Sentinel playbooks	Automate enrichment, ticketing, indicator handling	Optional
EDR/XDR	Microsoft Defender for Endpoint / CrowdStrike / SentinelOne	Validate endpoint sightings; hunting support	Common
Network security	Secure Web Gateway / DNS security (vendor varies)	Blocking domains/URLs; telemetry for suspicious lookups	Context-specific
Email security	Proofpoint / Microsoft Defender for Office 365	Phishing telemetry, campaign tracking, remediation	Common
Vulnerability intelligence	CISA KEV catalog	Track known exploited vulnerabilities	Common
Vulnerability mgmt	Tenable / Qualys / Rapid7	Exposure validation; prioritization inputs	Optional
OSINT enrichment	VirusTotal	Hash/URL/domain intelligence and pivoting	Common
OSINT enrichment	urlscan.io	URL behavior and page artifacts	Common
OSINT enrichment	AbuseIPDB / GreyNoise	IP reputation and scanner/noise context	Optional
OSINT enrichment	Passive DNS tools (vendor varies)	Domain/IP pivoting; infrastructure mapping	Optional
Sandbox	ANY.RUN / Joe Sandbox / Hybrid Analysis	Detonation and behavior summaries	Optional
Knowledge base	Confluence / SharePoint	Store briefs, runbooks, processes	Common
Ticketing / ITSM	Jira / ServiceNow	Track intel tasks, stakeholder requests, actions	Common
Collaboration	Slack / Microsoft Teams	Rapid dissemination and coordination	Common
Analytics	Excel / Google Sheets	Lightweight analysis, tracking, reporting	Common
Scripting	Python	Enrichment automation, parsing feeds, API integrations	Optional
Source control	GitHub / GitLab	Versioning scripts, detection content, documentation	Optional
Browser tooling	Devtools + extensions	Inspect headers, redirects, webpage artifacts	Common
Password/Secrets mgmt	Enterprise password manager (varies)	Secure handling of credentials for tools	Context-specific

11) Typical Tech Stack / Environment

This role operates across security tooling and enterprise IT systems rather than building product code (though scripting and detection-as-code may appear in mature organizations).

• Infrastructure environment
• Cloud-first or hybrid: commonly AWS/Azure/GCP plus SaaS applications
• Corporate network with remote workforce considerations (VPN/Zero Trust varies)

• Endpoint fleet: Windows/macOS (and some Linux), managed via MDM/EDR

• Application environment

• Mix of internal apps and SaaS (IdP, collaboration tools, CRM, ticketing)

• CI/CD and container platforms may exist, but junior intel role interacts mainly via security telemetry and advisories

• Data environment

• Security telemetry across SIEM (logs), EDR (endpoint events), email security, cloud audit logs

• TIP or intel repository storing indicators, reports, relationships, confidence, and history

• Security environment

• SOC model: internal SOC or hybrid with MSSP
• Defined incident response process with ticketing and escalation
• Vulnerability management program consuming exploitation intelligence

• Information-sharing memberships may exist (ISACs) depending on industry

• Delivery model

• Continuous operations with weekly/monthly reporting cycles

• Intel outputs delivered as briefs, advisories, indicator pushes, and tickets

• Agile/SDLC context

• Indirect interaction: intel influences engineering backlog (patching, logging, detections)

• Some orgs adopt “security as code” for detections; junior may contribute via suggestions and minor updates

• Scale/complexity context

• Moderate-to-high volume of intel noise; success depends on prioritization and automation

• Multi-tenant product companies must consider customer impact and brand abuse monitoring (context-specific)

• Team topology

• Typically part of Security Operations (SOC) or a small Threat Intelligence function
• Close relationship to Detection Engineering and IR; dotted-line influence to Vulnerability Mgmt and IT

12) Stakeholders and Collaboration Map

Internal stakeholders

• SOC Analysts / Security Monitoring
• Collaboration: Provide validated IOCs, campaign context, and tuning feedback
• Outputs consumed: watchlists, alerts tuning guidance, daily brief items
• Detection Engineers
• Collaboration: Translate TTPs into detection logic; provide test cases and false-positive caveats
• Incident Response / DFIR
• Collaboration: During incidents, support scoping and attribution hypotheses; provide related infrastructure pivots
• Vulnerability Management
• Collaboration: Provide exploitation context; recommend prioritization and mitigations when patching is delayed
• IT Operations (Network, Endpoint, Identity)
• Collaboration: Implement blocks, conditional access changes, hardening; validate operational impact
• Security Awareness / People Security
• Collaboration: Provide examples of current phishing/social engineering trends and recommended communications
• GRC / Risk (context-specific)
• Collaboration: Provide threat landscape summaries to inform risk narratives and controls focus

External stakeholders (context-dependent)

• MSSP/SOC-as-a-Service provider
• Collaboration: Share intel packages and request sightings; align on detection tuning
• Industry sharing groups (ISAC/ISAO)
• Collaboration: Consume and, where allowed, share sanitized intel with TLP handling
• Vendors
• Collaboration: Clarify feed items, request additional context, coordinate on false positives

Peer roles

• Junior SOC Analyst, Detection Engineering Associate, Vulnerability Analyst, Security Analyst (GRC), IT Security Engineer

Upstream dependencies

• Feed providers (commercial and OSINT)
• Internal telemetry quality (logging coverage, retention, and accessibility)
• Ticketing and workflow discipline from SOC/IR teams

Downstream consumers

• SOC detections and playbooks
• IR investigation plans and scoping queries
• Vulnerability prioritization queues
• IT blocks/hardening actions
• Awareness campaigns and user guidance

Decision-making authority (typical)

• Junior analyst recommends actions; does not unilaterally enforce major blocks without process.
• Escalations go to Threat Intel Lead/SOC Manager for high-risk business-impact decisions.

Escalation points

• Suspected active compromise or credible targeting → SOC Manager / IR Lead
• Proposed high-impact blocks (broad domains, IP ranges) → Network/Email Security owner + SOC Manager
• Sensitive intel handling (TLP:RED, legal constraints, privacy concerns) → Threat Intel Lead / Legal (if applicable)

13) Decision Rights and Scope of Authority

Decisions this role can make independently (typical junior scope)

• Classify and disposition routine intel items (relevant/irrelevant/needs follow-up) using defined criteria.
• Apply standardized confidence scoring and tagging conventions.
• Publish routine updates (daily digest) within pre-approved template and content boundaries.
• Create tickets for follow-up actions and assign to appropriate queues per process.
• Recommend indicator expiry periods within team guidelines.

Decisions requiring team approval (peer/senior analyst review)

• Publishing a formal advisory to broad audiences (beyond Security) without prior review.
• Adding indicators to shared “block” lists that could affect business operations (e.g., common CDNs, shared hosting).
• Making attribution claims (naming a threat actor) beyond what evidence supports.
• Changing tagging schema, scoring models, or intel workflow states.

Decisions requiring manager/director/executive approval

• Procurement or onboarding of new commercial feeds/tools.
• Public disclosure or customer-facing communications tied to threats or incidents.
• Policy changes regarding intel handling, retention, or sharing.
• Major security control changes based on intel (e.g., broad geo-blocking, widespread access restrictions) that affect business operations.

Budget / vendor / hiring authority

• No direct budget authority at junior level.
• May contribute to vendor evaluations and feed performance notes.
• No hiring authority; may participate in interview loops as a shadow interviewer after maturity.

Compliance authority

• Accountable to follow policies (TLP, privacy, acceptable use) and to flag concerns; not the policy owner.

14) Required Experience and Qualifications

Typical years of experience

• 0–2 years in security operations, threat intel, SOC, IT security, or a related analyst role
  (Some organizations hire directly from internships/graduate programs with strong demonstrable skills.)

Education expectations

• Common: Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or related field
• Also acceptable: Equivalent practical experience, military/defense training, recognized apprenticeships, or strong portfolio of security work

Certifications (Common / Optional / Context-specific)

• Common (helpful, not mandatory):
• CompTIA Security+
• Microsoft SC-900 / SC-200 (if Microsoft security stack)
• Optional (role enhancers):
• GIAC GCTI (Threat Intelligence) (often later-career due to cost)
• GIAC GCIH (Incident Handling) (if role leans into IR support)
• Blue Team Level certifications (varies)
• Context-specific:
• Cloud fundamentals (AWS/Azure) if the environment is cloud-heavy
• SANS or vendor-specific EDR/SIEM certs if the team heavily relies on those platforms

Prior role backgrounds commonly seen

• SOC Analyst (Tier 1)
• Security Analyst (generalist)
• IT Support / Network Operations with security focus
• Vulnerability Analyst (junior)
• Security internship focused on monitoring, phishing triage, or basic DFIR support

Domain knowledge expectations

• Understanding of:
• Common attacker motivations (financial, espionage, disruption)
• Phishing and credential theft patterns
• Ransomware ecosystem basics (initial access, extortion patterns)
• Vulnerability exploitation lifecycle and “KEV vs theoretical” distinction
• Core security telemetry sources (email, endpoint, identity, cloud audit logs)

Leadership experience expectations

• None required; leadership is demonstrated via reliability, ownership, and clarity of communication.

15) Career Path and Progression

Common feeder roles into this role

• SOC Analyst (Tier 1 / Junior)
• Phishing Response Analyst
• Vulnerability Analyst (junior) with interest in exploitation intel
• IT Operations Analyst with strong security interest and OSINT capability

Next likely roles after this role (1–3 years, depending on performance and org size)

• Threat Intelligence Analyst (mid-level)
• Detection Engineer (Associate) (if strong query/detection aptitude)
• Incident Response Analyst (Associate) (if strong investigation skills)
• Vulnerability Intelligence Analyst (specializing in exploited vulns and exposure prioritization)
• Security Research Analyst (more external-facing research, if applicable)

Adjacent career paths (lateral moves)

• Security Operations Analyst (Tier 2)
• Security Automation Analyst / SOAR Engineer (junior)
• Product Security Analyst (if company has application/product focus)
• Fraud / Brand Protection Analyst (if company faces impersonation/scams at scale)

Skills needed for promotion (Junior → Mid-level Threat Intelligence Analyst)

• Demonstrated ability to:
• Produce analytic products (not just enrichment) with clear judgments and rationale
• Track campaigns over time and identify patterns
• Translate TTPs into detection strategy and measure effectiveness
• Run small initiatives (e.g., improve source coverage, establish a new intel product)
• Increased technical depth:
• SIEM hunting queries, structured intel formats, basic automation
• Understanding of cloud/identity threats if relevant to environment
• Strong stakeholder influence:
• Work routinely results in implemented detections/controls or prioritized remediation

How this role evolves over time

• Early (0–3 months): triage + enrichment + learning tools and processes
• Mid (3–12 months): trusted publisher of briefs/advisories; incident support contributor; begins specialization
• Later (12–24 months): ownership of PIR slice; stronger analytic outputs; measurable influence on detection and vulnerability prioritization

16) Risks, Challenges, and Failure Modes

Common role challenges

• High noise environment: Many feeds produce repetitive, low-value indicators.
• Ambiguous relevance: External threats may be real but not relevant to company’s environment.
• Attribution pressure: Stakeholders may want definitive actor labels when evidence is limited.
• Tool fragmentation: TIP/SIEM/EDR/email/cloud data may be siloed, slowing validation.
• Operational risk of blocking: Incorrect blocks can disrupt business or customer access.

Bottlenecks

• Limited access to telemetry or insufficient logging coverage
• Over-reliance on single intel sources without corroboration
• Manual enrichment workflows with no automation or templates
• Slow stakeholder action on recommended mitigations (intel not operationalized)

Anti-patterns

• “Indicator dumping”: forwarding raw feeds without analysis, confidence, or recommended action
• Chasing novelty: focusing on interesting threats instead of relevant ones
• Overstating confidence: presenting hypotheses as facts
• No expiry discipline: keeping stale indicators active, creating noise and risk
• Disconnected reporting: producing reports nobody reads or uses

Common reasons for underperformance

• Weak fundamentals in networking/web/email artifacts
• Poor documentation habits (no sources, missing rationale, inconsistent tags)
• Inability to prioritize and escalate appropriately
• Unclear communication, causing stakeholders to ignore outputs
• Low collaboration: failing to follow through on action tracking

Business risks if this role is ineffective

• Increased risk of compromise due to slow recognition of relevant campaigns
• Inefficient SOC operations due to noisy or low-quality indicator ingestion
• Misallocated remediation effort (patching the wrong things, missing exploited exposures)
• Reduced trust in security communications and slower decision-making during incidents

17) Role Variants

This role is consistent across software/IT organizations, but scope and emphasis vary.

By company size

• Startup / small company
• Likely no dedicated TIP; intel work embedded in SOC/IR/generalist security
• More ad hoc, broader responsibilities (phishing, vuln intel, some IR support)
• Emphasis on rapid practical actions over formal reporting
• Mid-size company
• Defined SOC workflows; some TIP/SOAR usage
• Junior analyst can own a queue and recurring brief outputs
• Large enterprise
• More formal PIRs, governance, and intel product catalog
• Specialized teams (brand protection, fraud, product security intel)
• Junior role is narrower but more process-driven; stronger compliance expectations

By industry

• General software/SaaS (default)
• Focus on credential phishing, cloud account compromise, SaaS abuse, third-party risk signals
• Financial services / fintech (regulated, higher threat)
• More fraud, phishing, mule activity, brand impersonation, and tighter sharing constraints
• Higher audit rigor and stronger linkage to risk reporting
• Healthcare / critical infrastructure
• Higher focus on ransomware and exploited perimeter vulnerabilities; stronger incident coordination
• B2B enterprise software
• More supply chain concerns (dependencies), customer security communications, vulnerability exploitation intel

By geography

• Core tasks remain the same; differences include:
• Data handling rules, privacy constraints, and cross-border sharing
• Threat landscape variations (regional phishing languages, targeting patterns)
• Some regions rely more heavily on specific community sources

Product-led vs service-led company

• Product-led
• Greater focus on product ecosystem abuse, supply chain intelligence, customer impact advisories
• Service-led / IT services
• More client-specific threat briefs, MSSP-style reporting, and broader sector coverage

Startup vs enterprise operating model

• Startup
• Speed and breadth; less formal PIRs; junior may do more hands-on scripting
• Enterprise
• Process, governance, and separation of duties; junior focuses on standardized workflows and quality controls

Regulated vs non-regulated environment

• Regulated
• Stronger documentation, retention, and controlled dissemination (TLP and legal review)
• More formal metrics and auditability requirements
• Non-regulated
• More flexibility; risk is “informal sprawl” and inconsistent handling—still requires discipline

18) AI / Automation Impact on the Role

Tasks that can be automated (or heavily AI-assisted)

• Indicator enrichment and correlation
• Automated lookups across reputation services, passive DNS, sandbox summaries, certificate data
• Deduplication and clustering
• Grouping related IOCs into campaigns; identifying repeated infrastructure patterns
• Drafting first-pass summaries
• AI-generated draft briefs/advisories that analysts edit for accuracy and relevance
• Translation and normalization
• Translating foreign-language reports; converting formats into structured entries (with validation)
• Routing and ticket creation
• SOAR-driven ticketing based on confidence and impact criteria

Tasks that remain human-critical

• Relevance judgment
• Determining whether something matters to this company’s stack, exposure, and threat model
• Confidence assessment and evidence discipline
• Distinguishing verified facts from speculation; handling conflicting sources
• Stakeholder influence
• Persuading teams to take action, framing tradeoffs, and communicating urgency appropriately
• Risk management of blocking decisions
• Understanding operational impact, exceptions, and the cost of false positives
• Sensitive information handling
• Applying TLP, privacy considerations, and legal constraints

How AI changes the role over the next 2–5 years

• Junior analysts will be expected to:
• Operate as “intel editors and validators,” using AI to accelerate throughput while maintaining rigor
• Understand AI limitations (hallucinations, source attribution issues) and implement verification steps
• Contribute to automation design (what can be auto-enriched vs what requires review)
• Threat intel functions will likely:
• Shift from IOC-heavy workflows toward TTP and behavior-focused intelligence, because attackers rotate infrastructure faster than defenses can block
• Increase emphasis on measuring impact (intel-to-detection conversion, prevention outcomes)

New expectations due to AI, automation, or platform shifts

• Ability to define:
• Minimum evidence thresholds for auto-actions (auto-block vs manual review)
• Safe prompting and secure use of AI tools (no sensitive data leakage)
• Familiarity with:
• Basic data quality concepts for intel repositories (consistency, provenance, lifecycle)

19) Hiring Evaluation Criteria

What to assess in interviews

1. Threat intel fundamentals – Understanding of intel lifecycle, confidence, and actionability
2. IOC and OSINT tradecraft – Ability to validate indicators using multiple sources and explain reasoning
3. Security fundamentals – Networking, web, email/phishing concepts; common attack paths
4. Communication – Can the candidate write and speak clearly, with “so what / now what”
5. Judgment and prioritization – Recognizes urgency, relevance, and business impact
6. Collaboration – Works effectively with SOC/IR/Vuln partners; handles feedback well
7. Ethics and discretion – Handles sensitive information appropriately; respects boundaries

Practical exercises or case studies (recommended)

Exercise A: IOC enrichment + decisioning (45–60 minutes) – Provide: a small set of indicators (2 domains, 1 IP, 1 hash, 1 URL), a short scenario (suspected phishing campaign), and 2–3 OSINT snippets (some conflicting). – Ask candidate to: – Enrich each indicator (what they would check and why) – Assign confidence and relevance – Recommend actions (block/monitor/ignore) with expiry guidance – Draft a short Slack/Teams update to SOC + a short ticket description

Exercise B: Mini intel brief (take-home or live, 60–90 minutes) – Provide: a vendor blog about a campaign or exploited vulnerability. – Ask candidate to produce: – One-page internal advisory with: summary, relevance questions, affected systems hypotheses, recommended actions, and ATT&CK mapping

Exercise C: Incident support prompt (30 minutes) – Provide: IR asks “Do we have evidence this is related to X ransomware affiliate?” – Ask candidate: – What evidence would you seek? – What would you say now vs after validation? – What scoping/detection questions would you propose?

Strong candidate signals

• Demonstrates structured thinking and repeats back requirements before diving in
• Triangulates sources; does not rely on one reputation score
• Communicates confidence explicitly and avoids overclaiming
• Produces pragmatic actions and considers operational impact
• Shows curiosity and learning orientation (playbooks, automation ideas)
• Understands difference between IOCs and TTPs and why both matter

Weak candidate signals

• Treats any indicator in a feed as “malicious” without corroboration
• Cannot explain basic DNS/HTTP/email concepts
• Over-focuses on attribution labels rather than actionable steps
• Writes long, unclear summaries without recommendations
• Ignores expiry/lifecycle and false-positive risk

Red flags

• Shares or proposes sharing sensitive data inappropriately (e.g., uploading internal artifacts to public tools without policy awareness)
• Demonstrates unsafe behavior around tools, credentials, or privacy
• Strong claims with no evidence; unwillingness to acknowledge uncertainty
• Hostile or dismissive communication style (breaks trust with stakeholders)

Scorecard dimensions (interview loop-ready)

Dimension	Description	Weight (example)	Evaluation method
Intel fundamentals	Lifecycle, PIR concept, confidence and dissemination	15%	Interview + scenario questions
IOC enrichment skill	Practical ability to validate/enrich indicators	20%	Exercise A
Security fundamentals	DNS/web/email basics; attacker methods	15%	Technical interview
Analytical rigor	Evidence discipline, skepticism, avoiding overclaim	15%	Exercise review + interview
Communication	Clear writing and verbal summarization	15%	Brief writing + discussion
Judgment/prioritization	Relevance and urgency decisions; business impact awareness	10%	Case study prompts
Collaboration	Receptiveness to feedback; stakeholder orientation	10%	Behavioral interview

20) Final Role Scorecard Summary

Category	Summary
Role title	Junior Threat Intelligence Analyst
Role purpose	Collect, triage, enrich, and communicate threat intelligence to improve prevention, detection, and response across the security organization.
Top 10 responsibilities	1) Triage incoming intel sources 2) Enrich and validate IOCs 3) Deduplicate/score intel and manage lifecycle 4) Publish daily/weekly briefs 5) Escalate high-impact threats quickly 6) Support IR with context and scoping inputs 7) Map threats to MITRE ATT&CK 8) Provide detection and mitigation recommendations 9) Coordinate with Vuln Mgmt on exploited CVEs 10) Follow governance (TLP, privacy, documentation)
Top 10 technical skills	1) Intel lifecycle fundamentals 2) OSINT tradecraft 3) IOC enrichment 4) Networking/DNS/HTTP basics 5) Phishing/email analysis basics 6) MITRE ATT&CK mapping 7) SIEM literacy (searching, sightings) 8) TIP/MISP usage (where applicable) 9) Vulnerability exploitation awareness (KEV) 10) Basic scripting/API usage (advantage)
Top 10 soft skills	1) Analytical rigor 2) Prioritization 3) Concise communication 4) Collaboration/service orientation 5) Attention to detail 6) Learning agility 7) Professional judgment/discretion 8) Resilience under pressure 9) Ownership and follow-through 10) Stakeholder empathy (technical/non-technical)
Top tools/platforms	SIEM (Splunk/Sentinel/Elastic), TIP (MISP/ThreatConnect/Anomali), EDR (Defender/CrowdStrike/SentinelOne), VirusTotal, urlscan.io, email security tooling, Jira/ServiceNow, Slack/Teams, Confluence/SharePoint, KEV catalog
Top KPIs	Time to triage, actionability rate, false positive rate (intel-driven), indicator expiry compliance, enrichment completeness, detection contributions accepted, stakeholder request SLA, incident support satisfaction, ATT&CK mapping coverage, source signal-to-noise ratio
Main deliverables	Daily digest, weekly threat brief, curated IOC packages (with confidence/expiry), internal advisories, incident intel notes, enrichment playbooks, detection recommendations, hygiene updates in TIP, metrics inputs
Main goals	30/60/90: become reliable triage + publisher of briefs; provide actionable outputs; support at least one incident. 6–12 months: own a focused intel slice; measurably improve workflow quality/speed; influence detection/vuln prioritization.
Career progression options	Threat Intelligence Analyst (mid-level), Detection Engineer (associate), Incident Response Analyst (associate), Vulnerability Intelligence Analyst, Security Research Analyst, SOAR/Security Automation Analyst (junior)