{"id":72702,"date":"2026-04-13T03:16:31","date_gmt":"2026-04-13T03:16:31","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/lead-threat-intelligence-analyst-role-blueprint-responsibilities-skills-kpis-and-career-path\/"},"modified":"2026-04-13T03:16:31","modified_gmt":"2026-04-13T03:16:31","slug":"lead-threat-intelligence-analyst-role-blueprint-responsibilities-skills-kpis-and-career-path","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/lead-threat-intelligence-analyst-role-blueprint-responsibilities-skills-kpis-and-career-path\/","title":{"rendered":"Lead Threat Intelligence Analyst: Role Blueprint, Responsibilities, Skills, KPIs, and Career Path"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">1) Role Summary<\/h2>\n\n\n\n<p>The <strong>Lead Threat Intelligence Analyst<\/strong> is a senior, hands-on security analyst who designs, runs, and continuously improves an organization\u2019s threat intelligence (TI) capability to reduce cyber risk. The role turns raw signals (telemetry, OSINT, vendor feeds, dark web monitoring, incident learnings) into <strong>actionable intelligence<\/strong> that informs detection engineering, incident response, vulnerability management, and security strategy.<\/p>\n\n\n\n<p>This role exists in software and IT organizations because modern threats move faster than traditional perimeter defenses; TI provides early warning, prioritization, and context that improves decision-making across product security, cloud security, and SOC operations. Business value is created through reduced incident frequency and impact, faster detection\/response, better prioritization of remediation, and stronger executive visibility into threat exposure and adversary activity.<\/p>\n\n\n\n<p><strong>Role horizon:<\/strong> Current (established practice in mature security organizations; expanding scope with automation\/AI).<br\/>\n<strong>Typical interactions:<\/strong> SOC, Incident Response, Detection Engineering, Vulnerability Management, Cloud Security, Product Security\/AppSec, IT Ops, Risk\/GRC, Legal, Privacy, and occasionally Customer Trust\/Sales Engineering.<\/p>\n\n\n\n<p><strong>Conservative reporting line (typical):<\/strong> Reports to <strong>Head of Security Operations<\/strong> \/ <strong>SOC Manager<\/strong> \/ <strong>Director of Security<\/strong> (varies by organization maturity). The role may lead a small TI pod or act as the functional lead for TI within SecOps.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2) Role Mission<\/h2>\n\n\n\n<p><strong>Core mission:<\/strong><br\/>\nProvide timely, accurate, and relevant threat intelligence that measurably improves prevention, detection, response, and risk prioritization across the company\u2019s technology estate and product portfolio.<\/p>\n\n\n\n<p><strong>Strategic importance:<\/strong><br\/>\nThreat intelligence is the connective tissue between adversary behavior and defensive action. A Lead Threat Intelligence Analyst ensures the organization is not simply collecting intel, but <strong>operationalizing<\/strong> it into detections, controls, and decisions that reduce business risk and protect customers.<\/p>\n\n\n\n<p><strong>Primary business outcomes expected:<\/strong>\n&#8211; Reduced mean time to detect (MTTD) and mean time to respond (MTTR) through better context and detection content.\n&#8211; Improved prioritization of patching and mitigation based on exploitation likelihood and active campaigns.\n&#8211; Increased resilience to targeted threats (brand impersonation, credential theft, supply-chain attacks, cloud abuse).\n&#8211; Stronger executive and stakeholder confidence via consistent threat reporting and measurable TI-to-action pipelines.\n&#8211; Mature, repeatable TI processes aligned to frameworks (e.g., MITRE ATT&amp;CK) and organizational risk appetite.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3) Core Responsibilities<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Strategic responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Define and maintain the threat intelligence operating model<\/strong> (collection, processing, analysis, dissemination, feedback loops), aligned to business priorities and the organization\u2019s threat profile.<\/li>\n<li><strong>Own the TI requirements (PIRs\/SIRs)<\/strong>: translate business and security priorities into prioritized intelligence requirements and collection plans.<\/li>\n<li><strong>Develop and maintain threat models of key adversaries<\/strong> relevant to the company (e.g., financially motivated actors, ransomware affiliates, supply-chain threats, cloud abuse groups).<\/li>\n<li><strong>Drive TI-informed security strategy inputs<\/strong>: recommend investments and control improvements based on trends and observed gaps.<\/li>\n<li><strong>Lead threat briefings for senior stakeholders<\/strong>: present risk-relevant insights, emerging campaigns, and recommended actions.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Operational responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"6\">\n<li><strong>Run the TI production cadence<\/strong> (daily\/weekly intel notes, campaign tracking, monthly trend reports), ensuring timeliness and relevance.<\/li>\n<li><strong>Triage and validate intelligence<\/strong> from vendor feeds, ISACs, OSINT, internal telemetry, and incident learnings; reduce noise and ensure confidence scoring.<\/li>\n<li><strong>Coordinate intelligence-driven response<\/strong> during active incidents: provide adversary context, likely next steps, infrastructure indicators, and targeted hunt guidance.<\/li>\n<li><strong>Operate and refine intelligence workflows<\/strong> in the TIP\/SIEM\/ITSM tools: intake, enrichment, deduplication, scoring, and dissemination to the right consumers.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Technical responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"10\">\n<li><strong>Operationalize indicators and TTPs<\/strong> into detections and mitigations: map to MITRE ATT&amp;CK, create hunting hypotheses, and drive detection engineering requirements.<\/li>\n<li><strong>Develop and maintain detection-adjacent artifacts<\/strong> (YARA rules, Sigma rules, Splunk\/KQL queries, Suricata\/Snort signatures where applicable), with QA and lifecycle management.<\/li>\n<li><strong>Perform threat hunting support<\/strong>: design hunts based on campaigns; assist in validating findings and translating them into durable detections.<\/li>\n<li><strong>Assess exploitation and vulnerability intelligence<\/strong>: prioritize vulnerabilities based on EPSS, KEV, exploit availability, and environment exposure; advise VM on patch timelines.<\/li>\n<li><strong>Support cloud threat intelligence<\/strong>: track cloud abuse patterns (IAM compromise, token theft, metadata service abuse), and advise on detection\/controls in cloud-native tools.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Cross-functional or stakeholder responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"15\">\n<li><strong>Partner with Product Security\/AppSec<\/strong> to translate threat trends into secure design guidance, abuse case updates, and SDLC security requirements.<\/li>\n<li><strong>Coordinate with IT and Endpoint teams<\/strong> to deploy mitigations and response actions (blocking, containment, hardening) informed by intelligence.<\/li>\n<li><strong>Support Customer Trust and Communications<\/strong> (context-specific) with accurate statements, threat summaries, and impact framing during major events.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Governance, compliance, or quality responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"18\">\n<li><strong>Maintain intelligence standards and quality controls<\/strong>: source reliability, analytic confidence levels, citation practices, handling restrictions (TLP), and audit-ready documentation.<\/li>\n<li><strong>Manage third-party intel relationships and information sharing<\/strong>: handle sharing agreements, ensure legal\/privacy constraints are met, and represent the company in communities (ISACs).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Leadership responsibilities (Lead level)<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"20\">\n<li><strong>Mentor analysts and influence execution<\/strong>: coach junior TI\/SOC analysts on analytic tradecraft, structured analysis, and operationalization; lead without necessarily having direct reports.<\/li>\n<li><strong>Set technical direction for TI tooling and automation<\/strong>: define requirements, guide integrations, and evaluate vendors in partnership with SecOps leadership.<\/li>\n<li><strong>Own TI program KPIs and continuous improvement<\/strong>: measure impact, identify bottlenecks, and drive process maturity.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4) Day-to-Day Activities<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Daily activities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Monitor threat landscape changes: exploitation news, ransomware leaks, phishing campaigns, cloud abuse trends, and high-signal community reporting.<\/li>\n<li>Triage new intelligence items (from TIP, email, ISAC portals, vendor alerts) and decide what becomes:<\/li>\n<li>a detection request,<\/li>\n<li>a hunt package,<\/li>\n<li>a vulnerability priority update,<\/li>\n<li>or an \u201cFYI\u201d advisory.<\/li>\n<li>Provide rapid-response support to SOC\/IR: enrichment on IPs\/domains\/hashes, infrastructure pivots, adversary clustering, and recommended containment actions.<\/li>\n<li>Maintain campaign trackers and update confidence levels as new evidence arrives.<\/li>\n<li>Communicate \u201cwhat changed today\u201d to operational teams (SOC, VM, Detection Engineering) in concise, action-oriented formats.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Weekly activities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Run a <strong>weekly intel sync<\/strong> with SOC\/Detection Engineering: review top campaigns, review what was operationalized, unblock content deployment.<\/li>\n<li>Produce a <strong>weekly threat note<\/strong> summarizing:<\/li>\n<li>relevant campaigns,<\/li>\n<li>notable TTPs,<\/li>\n<li>exposure assessment,<\/li>\n<li>recommended actions and owners.<\/li>\n<li>Conduct structured analysis sessions (e.g., ACH-lite, hypothesis testing) for ambiguous or high-impact threat questions.<\/li>\n<li>Review vulnerability exploitation intelligence and update patch prioritization recommendations.<\/li>\n<li>Validate the health of TI pipelines: feed ingestion, deduplication, scoring, and integration success rates.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monthly or quarterly activities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deliver a <strong>monthly threat landscape report<\/strong> tailored to leadership:<\/li>\n<li>trends and top risks,<\/li>\n<li>major incidents in the industry,<\/li>\n<li>control and investment recommendations,<\/li>\n<li>measurable TI impact metrics.<\/li>\n<li>Refresh threat models and adversary profiles for the organization\u2019s highest-value assets and products.<\/li>\n<li>Review and tune intelligence requirements (PIRs) with stakeholders; retire low-value questions.<\/li>\n<li>Perform retrospectives on major incidents and near-misses to capture new intelligence and detection gaps.<\/li>\n<li>Evaluate TI tool effectiveness and coverage: what sources produce actions vs noise; rationalize spend.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Recurring meetings or rituals<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Daily SOC standup (optional\/context-specific; common in smaller teams).<\/li>\n<li>Weekly intel-to-detection working session (common).<\/li>\n<li>Weekly vulnerability triage meeting (common).<\/li>\n<li>Incident response post-incident reviews (common).<\/li>\n<li>Monthly security leadership readout (common in mature orgs).<\/li>\n<li>Vendor check-ins (monthly\/quarterly).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Incident, escalation, or emergency work<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>During high-severity incidents, the Lead Threat Intelligence Analyst typically:<\/li>\n<li>joins incident bridge calls as the <strong>adversary context owner<\/strong>,<\/li>\n<li>produces \u201cknowns\/unknowns\u201d and likely adversary next steps,<\/li>\n<li>quickly validates indicators and recommended blocks to avoid self-inflicted outages,<\/li>\n<li>coordinates with Legal\/Privacy on information sharing constraints (where required),<\/li>\n<li>supports executive updates with accurate, defensible statements.<\/li>\n<li>May be on an escalation rotation (context-specific). Even without formal on-call, availability during major incidents is commonly expected.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5) Key Deliverables<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Threat Intelligence Program Artifacts<\/strong><\/li>\n<li>TI operating model (intake \u2192 analysis \u2192 dissemination \u2192 feedback)<\/li>\n<li>Priority Intelligence Requirements (PIRs) and review cadence<\/li>\n<li>Source catalog with reliability scoring and handling restrictions (TLP)<\/li>\n<li>\n<p>TI playbooks and runbooks (what happens when a high-confidence campaign appears)<\/p>\n<\/li>\n<li>\n<p><strong>Analytic Products<\/strong><\/p>\n<\/li>\n<li>Daily\/weekly intel notes (actionable, owner-assigned recommendations)<\/li>\n<li>Monthly\/quarterly threat landscape reports<\/li>\n<li>Adversary profiles and campaign dossiers (TTPs, infra, targeting, motivations)<\/li>\n<li>\n<p>Intelligence bulletins for urgent topics (e.g., active exploitation of a CVE)<\/p>\n<\/li>\n<li>\n<p><strong>Operationalized Security Outputs<\/strong><\/p>\n<\/li>\n<li>Detection engineering requirements and acceptance criteria<\/li>\n<li>Hunting packages (hypotheses, queries, telemetry requirements, success criteria)<\/li>\n<li>Indicator packages (curated, scored IOCs with expiry and context)<\/li>\n<li>YARA\/Sigma rules and SIEM queries (where applicable)<\/li>\n<li>\n<p>Mitigation recommendations (blocks, hardening steps, MFA changes, IAM controls)<\/p>\n<\/li>\n<li>\n<p><strong>Dashboards and Metrics<\/strong><\/p>\n<\/li>\n<li>TI-to-action pipeline dashboard (intel items \u2192 actions \u2192 deployed controls)<\/li>\n<li>KPI reporting for MTTD\/MTTR influence, alert quality improvements, and source value<\/li>\n<li>\n<p>Vulnerability exploitation watchlists and \u201cinternet exposure + exploitability\u201d views<\/p>\n<\/li>\n<li>\n<p><strong>Training and Enablement<\/strong><\/p>\n<\/li>\n<li>Analyst enablement sessions (structured analysis, ATT&amp;CK mapping, confidence scoring)<\/li>\n<li>SOC\/IR cheat sheets (top TTPs, ransomware playbook intelligence inputs)<\/li>\n<li>Executive briefing decks (board-ready where required)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6) Goals, Objectives, and Milestones<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">30-day goals (onboarding and baseline)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Understand the company\u2019s environment: products, cloud footprint, data sensitivity, and business priorities.<\/li>\n<li>Map current security operations workflows (SOC, IR, VM) and identify where TI is consumed or missing.<\/li>\n<li>Review existing TI sources, TIP\/SIEM integrations, and current intel outputs; assess quality and relevance.<\/li>\n<li>Establish stakeholder map and agree initial PIRs with SecOps leadership.<\/li>\n<li>Deliver first quick-win intel product (e.g., a campaign brief with clear actions) that results in at least one operational change.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">60-day goals (operationalization and cadence)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Implement a repeatable intel dissemination cadence (weekly operational note + leadership summary).<\/li>\n<li>Establish intelligence scoring standards (source reliability, analytic confidence, relevance tags, ATT&amp;CK mapping).<\/li>\n<li>Create a TI-to-detection workflow with defined SLAs and acceptance criteria with Detection Engineering\/SOC.<\/li>\n<li>Stand up a vulnerability exploitation prioritization flow integrated with VM triage.<\/li>\n<li>Reduce noise from feeds via deduplication, filtering, and \u201cdo not action\u201d criteria.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">90-day goals (measurable impact)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Demonstrate measurable improvements:<\/li>\n<li>increased number of intel-driven detections deployed,<\/li>\n<li>reduced time from intel receipt to action,<\/li>\n<li>improved incident enrichment speed.<\/li>\n<li>Deliver at least one mature adversary or campaign dossier relevant to the organization and use it to drive hunts\/detections.<\/li>\n<li>Establish baseline KPIs and dashboards for TI program performance.<\/li>\n<li>Document and socialize TI runbooks for major scenarios (ransomware, credential compromise, cloud token theft, supplier compromise).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6-month milestones (program maturity)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mature TI operating model with clear:<\/li>\n<li>requirements management (PIRs),<\/li>\n<li>collection strategy,<\/li>\n<li>analytic standards,<\/li>\n<li>dissemination channels by audience,<\/li>\n<li>feedback loops and success measures.<\/li>\n<li>Achieve consistent operationalization:<\/li>\n<li>a sustained pipeline of intel \u2192 detections\/hunts\/mitigations,<\/li>\n<li>reduction in false positives through better context and scoring.<\/li>\n<li>Improve external collaboration posture (ISAC participation, vetted sharing processes, legal guardrails).<\/li>\n<li>Complete a tooling gap assessment and implement prioritized improvements (automation, integrations, dashboarding).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12-month objectives (strategic outcomes)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establish TI as a trusted decision-support function:<\/li>\n<li>leadership uses TI reports to prioritize investment,<\/li>\n<li>SOC\/IR uses TI to accelerate response,<\/li>\n<li>VM uses TI to prioritize remediation by exploitation likelihood.<\/li>\n<li>Demonstrably reduce exposure to top threats (measured via control improvements, fewer repeat incidents, improved detection coverage).<\/li>\n<li>Build and mentor a high-performing TI capability (could include hiring, training, or developing a community of practice).<\/li>\n<li>Develop an annual threat landscape outlook and integrate it into security planning and tabletop exercises.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Long-term impact goals (18\u201336 months)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Institutionalize intelligence-led defense:<\/li>\n<li>robust detection coverage aligned to top adversary TTPs,<\/li>\n<li>proactive identification of campaigns targeting the company\/industry,<\/li>\n<li>mature automation pipelines that minimize manual triage.<\/li>\n<li>Position the organization as a credible participant in trusted sharing communities, improving early warning and peer collaboration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Role success definition<\/h3>\n\n\n\n<p>Success is defined by <strong>actionable intelligence that changes outcomes<\/strong>, not by volume of reports or feeds ingested. A successful Lead Threat Intelligence Analyst consistently produces intelligence that results in detections, mitigations, improved prioritization, and faster\/cleaner incident handling.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What high performance looks like<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Stakeholders can clearly articulate how TI helped them this quarter (specific actions taken).<\/li>\n<li>The TI pipeline is measurable, predictable, and resilient (not dependent on heroics).<\/li>\n<li>Intelligence outputs are concise, credible, and aligned to business priorities.<\/li>\n<li>Detection engineering and IR teams proactively request TI support because it reliably accelerates results.<\/li>\n<li>The organization has fewer \u201csurprises\u201d due to better early warning and preparedness.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7) KPIs and Productivity Metrics<\/h2>\n\n\n\n<p>The measurement framework below emphasizes <strong>impact<\/strong> (outcomes) and <strong>operational excellence<\/strong> (reliability, efficiency), while avoiding vanity metrics such as \u201cnumber of IOCs processed\u201d without action.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Metric name<\/th>\n<th>What it measures<\/th>\n<th>Why it matters<\/th>\n<th>Example target\/benchmark (illustrative)<\/th>\n<th>Frequency<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Intel-to-Action Cycle Time<\/td>\n<td>Time from intel receipt to an action (detection\/hunt\/mitigation)<\/td>\n<td>Shows operationalization speed<\/td>\n<td>P1 intel: &lt;72 hours; P2: &lt;2 weeks<\/td>\n<td>Weekly<\/td>\n<\/tr>\n<tr>\n<td>% Intel Items Operationalized<\/td>\n<td>Portion of high\/medium relevance intel that results in an action<\/td>\n<td>Validates relevance and execution<\/td>\n<td>40\u201360% of curated items lead to actions (varies by org)<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Detection Coverage Lift (TI-driven)<\/td>\n<td>Number of new\/updated detections mapped to TI-derived TTPs<\/td>\n<td>Demonstrates security posture improvement<\/td>\n<td>+X detections\/month mapped to priority ATT&amp;CK techniques<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Hunt Yield Rate<\/td>\n<td>Hunts producing confirmed findings or control improvements<\/td>\n<td>Measures hunt effectiveness<\/td>\n<td>20\u201340% yield (context-specific)<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Incident Enrichment SLA<\/td>\n<td>Time to provide context during an incident (e.g., infra pivots, actor hypotheses)<\/td>\n<td>Reduces MTTR and improves decisions<\/td>\n<td>Initial enrichment &lt;60 minutes for P1 incidents<\/td>\n<td>Weekly\/Per incident<\/td>\n<\/tr>\n<tr>\n<td>False Positive Reduction from TI Context<\/td>\n<td>Reduction in alerts escalated due to better context\/scoring<\/td>\n<td>Improves SOC efficiency<\/td>\n<td>5\u201315% reduction over 2 quarters<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Vulnerability Exploitation Prioritization Accuracy<\/td>\n<td>How often \u201cactively exploited\u201d calls align with observed activity and credible sources<\/td>\n<td>Builds trust with VM and leadership<\/td>\n<td>&gt;90% of \u201cdrop everything\u201d calls validated by KEV\/exploit evidence<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Patch Acceleration for Exploited Vulns<\/td>\n<td>Time from exploited vuln intel to patch\/mitigation completion<\/td>\n<td>Reduces exposure to real threats<\/td>\n<td>Critical exploited: mitigation &lt;7 days (varies by environment)<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Source Value Score<\/td>\n<td>Ratio of actionable items to total items per source<\/td>\n<td>Optimizes spend and analyst time<\/td>\n<td>Top sources deliver 70\u201380% of actions<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Stakeholder Satisfaction (TI Consumers)<\/td>\n<td>Feedback from SOC\/IR\/VM\/Product Security<\/td>\n<td>Ensures relevance and usability<\/td>\n<td>\u22654.2\/5 average<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Report Timeliness<\/td>\n<td>Delivery against agreed cadence<\/td>\n<td>Builds trust and predictability<\/td>\n<td>95% on-time delivery<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Analytic Quality Score<\/td>\n<td>Peer review rating for evidence, confidence, clarity, and actionability<\/td>\n<td>Maintains rigor<\/td>\n<td>\u22654\/5 average across sampled outputs<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Knowledge Reuse<\/td>\n<td>Use of TI artifacts in tabletop exercises, detections, training<\/td>\n<td>Indicates institutionalization<\/td>\n<td>TI referenced in \u22652 exercises\/quarter<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Leadership Enablement (Lead-level)<\/td>\n<td>Mentoring, standards adoption, process improvements delivered<\/td>\n<td>Confirms lead scope beyond IC work<\/td>\n<td>1\u20132 measurable process improvements\/quarter<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p><strong>Notes on variability:<\/strong> Targets depend on company size, tool maturity, and volume of alerts\/incidents. Early-stage TI programs may focus first on cycle time, operationalization rate, and stakeholder satisfaction.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8) Technical Skills Required<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Must-have technical skills<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Threat intelligence lifecycle and tradecraft<\/strong> (Critical)<br\/>\n   &#8211; Use: Define PIRs, collection plans, analysis, dissemination, feedback loops.<br\/>\n   &#8211; Includes confidence scoring, source evaluation, and structured analytic techniques.<\/p>\n<\/li>\n<li>\n<p><strong>MITRE ATT&amp;CK mapping and adversary TTP analysis<\/strong> (Critical)<br\/>\n   &#8211; Use: Translate reports into techniques, drive detections\/hunts, communicate consistently across teams.<\/p>\n<\/li>\n<li>\n<p><strong>SIEM investigation and query skills<\/strong> (Critical)<br\/>\n   &#8211; Use: Validate IOCs\/TTPs, support hunts, enrich incidents.<br\/>\n   &#8211; Examples: Splunk SPL, Microsoft Sentinel KQL, Elastic query DSL.<\/p>\n<\/li>\n<li>\n<p><strong>IOC and infrastructure analysis<\/strong> (Critical)<br\/>\n   &#8211; Use: Pivot domains\/IPs\/certs\/WHOIS\/passive DNS, identify clusters, validate maliciousness.<\/p>\n<\/li>\n<li>\n<p><strong>Incident response collaboration<\/strong> (Important \u2192 Critical in many orgs)<br\/>\n   &#8211; Use: Provide threat context, support containment decisions, document intel learnings post-incident.<\/p>\n<\/li>\n<li>\n<p><strong>Vulnerability exploitation intelligence<\/strong> (Critical)<br\/>\n   &#8211; Use: Assess exploit maturity, active exploitation, KEV\/EPSS, advise VM on prioritization.<\/p>\n<\/li>\n<li>\n<p><strong>Scripting and automation fundamentals<\/strong> (Important)<br\/>\n   &#8211; Use: Automate enrichment, normalize feeds, create repeatable workflows.<br\/>\n   &#8211; Typical: Python, basic Bash\/PowerShell, API usage.<\/p>\n<\/li>\n<li>\n<p><strong>Cloud security fundamentals<\/strong> (Important)<br\/>\n   &#8211; Use: Interpret cloud logs, understand IAM abuse patterns, advise cloud detections\/controls.<br\/>\n   &#8211; Typical: AWS\/Azure\/GCP basics, CloudTrail\/Azure AD logs.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Good-to-have technical skills<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>TIP operation and integration<\/strong> (Important)<br\/>\n   &#8211; Use: Manage feeds, scoring, deduplication, and integration with SIEM\/SOAR.<\/p>\n<\/li>\n<li>\n<p><strong>SOAR playbook design<\/strong> (Important)<br\/>\n   &#8211; Use: Automate enrichment and dissemination, reduce manual triage.<\/p>\n<\/li>\n<li>\n<p><strong>Malware analysis fundamentals<\/strong> (Optional to Important, context-specific)<br\/>\n   &#8211; Use: Triage suspicious files, extract IOCs, understand behavior patterns (sandbox, static indicators).<\/p>\n<\/li>\n<li>\n<p><strong>Detection content development<\/strong> (Important)<br\/>\n   &#8211; Use: Produce Sigma, YARA, SIEM rules, EDR detections in partnership with Detection Engineering.<\/p>\n<\/li>\n<li>\n<p><strong>Threat modeling and abuse case development<\/strong> (Important)<br\/>\n   &#8211; Use: Inform product security and architecture decisions with real-world attacker behavior.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Advanced or expert-level technical skills<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Campaign and actor clustering at scale<\/strong> (Advanced; Important in mature orgs)<br\/>\n   &#8211; Use: Connect disparate intel artifacts to campaigns using infrastructure and TTP overlap; reduce duplicate work.<\/p>\n<\/li>\n<li>\n<p><strong>Advanced log\/telemetry fluency<\/strong> (Advanced)<br\/>\n   &#8211; Use: Identify gaps in telemetry, recommend instrumentation, interpret endpoint\/network\/cloud audit data.<\/p>\n<\/li>\n<li>\n<p><strong>Data analysis for TI (statistics, scoring models)<\/strong> (Advanced; Optional)<br\/>\n   &#8211; Use: Source scoring, signal-to-noise optimization, trend analysis, predictive prioritization.<\/p>\n<\/li>\n<li>\n<p><strong>Digital risk \/ brand protection analysis<\/strong> (Advanced; Context-specific)<br\/>\n   &#8211; Use: Detect impersonation, phishing kits, credential leaks, brand abuse targeting customers.<\/p>\n<\/li>\n<li>\n<p><strong>Advanced malware triage and reverse engineering<\/strong> (Advanced; Optional)<br\/>\n   &#8211; Use: Support high-impact investigations, extract TTPs from novel samples.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Emerging future skills for this role (next 2\u20135 years)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>AI-assisted intelligence production governance<\/strong> (Important)<br\/>\n   &#8211; Use: Ensure AI-generated summaries are verifiable, cited, and safe to share; manage hallucination risk.<\/p>\n<\/li>\n<li>\n<p><strong>Detection engineering for identity and SaaS abuse<\/strong> (Important)<br\/>\n   &#8211; Use: Translate TI into detections across IdP, SaaS audit logs, and API-based telemetry.<\/p>\n<\/li>\n<li>\n<p><strong>Supply-chain and dependency intelligence<\/strong> (Important; context-specific)<br\/>\n   &#8211; Use: Track threats targeting CI\/CD pipelines, artifact repositories, and open-source dependencies.<\/p>\n<\/li>\n<li>\n<p><strong>Automated graph-based enrichment and correlation<\/strong> (Optional \u2192 Important over time)<br\/>\n   &#8211; Use: Entity graphs for infra, identities, malware families to accelerate pivoting and reduce manual analysis.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9) Soft Skills and Behavioral Capabilities<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Analytic rigor and intellectual honesty<\/strong><br\/>\n   &#8211; Why it matters: TI decisions can trigger disruptive actions (blocking IPs, emergency patching).<br\/>\n   &#8211; On the job: Clearly separates fact from inference; communicates confidence levels and alternatives.<br\/>\n   &#8211; Strong performance: Uses evidence-based reasoning, cites sources, and updates conclusions when new data emerges.<\/p>\n<\/li>\n<li>\n<p><strong>Executive communication and synthesis<\/strong><br\/>\n   &#8211; Why it matters: Leaders need clarity, not raw data.<br\/>\n   &#8211; On the job: Converts technical threat details into business risk and concrete actions.<br\/>\n   &#8211; Strong performance: Produces briefings that lead to decisions (prioritization, investment, risk acceptance).<\/p>\n<\/li>\n<li>\n<p><strong>Operational empathy and service orientation<\/strong><br\/>\n   &#8211; Why it matters: TI only works when consumers can use it.<br\/>\n   &#8211; On the job: Designs outputs around SOC\/IR\/VM workflows and constraints.<br\/>\n   &#8211; Strong performance: Stakeholders report that TI is \u201cimmediately actionable\u201d and reduces their workload.<\/p>\n<\/li>\n<li>\n<p><strong>Influence without authority (Lead-level)<\/strong><br\/>\n   &#8211; Why it matters: Often leads outcomes across teams without owning them.<br\/>\n   &#8211; On the job: Aligns Detection Engineering, SOC, and VM on priorities and SLAs.<br\/>\n   &#8211; Strong performance: Drives adoption of standards and workflows through credibility and clarity.<\/p>\n<\/li>\n<li>\n<p><strong>Prioritization under ambiguity<\/strong><br\/>\n   &#8211; Why it matters: Threat landscape is noisy; time is limited.<br\/>\n   &#8211; On the job: Chooses what to act on now vs monitor; avoids distraction by low-impact intel.<br\/>\n   &#8211; Strong performance: Consistently focuses effort on threats most relevant to the company\u2019s assets and business.<\/p>\n<\/li>\n<li>\n<p><strong>Collaboration and conflict navigation<\/strong><br\/>\n   &#8211; Why it matters: Blocking\/patching decisions can disrupt engineering and operations.<br\/>\n   &#8211; On the job: Negotiates tradeoffs, aligns on risk-based timelines, resolves disputes with evidence.<br\/>\n   &#8211; Strong performance: Partners feel respected; escalations are rare and well-justified.<\/p>\n<\/li>\n<li>\n<p><strong>Teaching and mentoring mindset<\/strong><br\/>\n   &#8211; Why it matters: TI capability scales through shared tradecraft and standards.<br\/>\n   &#8211; On the job: Coaches analysts on ATT&amp;CK mapping, structured analysis, and writing.<br\/>\n   &#8211; Strong performance: Observable growth in junior analysts; consistent quality across TI outputs.<\/p>\n<\/li>\n<li>\n<p><strong>Calm performance in incidents<\/strong><br\/>\n   &#8211; Why it matters: During active incidents, misinformation spreads quickly.<br\/>\n   &#8211; On the job: Provides steady, evidence-based guidance; avoids speculation.<br\/>\n   &#8211; Strong performance: Incident teams trust their calls; reduces churn and accelerates containment.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10) Tools, Platforms, and Software<\/h2>\n\n\n\n<p>Tooling varies widely by company maturity. The list below reflects common enterprise software\/IT environments; each item is labeled <strong>Common<\/strong>, <strong>Optional<\/strong>, or <strong>Context-specific<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Tool \/ platform<\/th>\n<th>Primary use<\/th>\n<th>Commonality<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Threat Intelligence Platforms (TIP)<\/td>\n<td>Anomali, Recorded Future, Mandiant Advantage, ThreatConnect<\/td>\n<td>Feed aggregation, scoring, enrichment, dissemination<\/td>\n<td>Context-specific (often Common in mature orgs)<\/td>\n<\/tr>\n<tr>\n<td>Threat sharing standards<\/td>\n<td>STIX\/TAXII<\/td>\n<td>Structured intel exchange<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>SIEM<\/td>\n<td>Splunk, Microsoft Sentinel, Elastic Security<\/td>\n<td>Querying, correlation, investigations, dashboards<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>SOAR<\/td>\n<td>Palo Alto Cortex XSOAR, Splunk SOAR, Microsoft Sentinel playbooks<\/td>\n<td>Automate enrichment, ticketing, response workflows<\/td>\n<td>Optional to Common<\/td>\n<\/tr>\n<tr>\n<td>EDR\/XDR<\/td>\n<td>CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne<\/td>\n<td>Endpoint detections, investigations, containment<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Network Security<\/td>\n<td>Palo Alto NGFW, Cisco, Suricata\/Snort<\/td>\n<td>Network telemetry and blocking<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Cloud platforms<\/td>\n<td>AWS, Azure, GCP<\/td>\n<td>Cloud-native telemetry and controls<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Cloud security<\/td>\n<td>Wiz, Prisma Cloud, Defender for Cloud<\/td>\n<td>Exposure management, cloud threat detection context<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Identity<\/td>\n<td>Okta, Entra ID (Azure AD)<\/td>\n<td>Identity audit logs, access risk, abuse detection inputs<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Vulnerability management<\/td>\n<td>Tenable, Qualys, Rapid7 InsightVM<\/td>\n<td>Vulnerability context and prioritization<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Ticketing \/ ITSM<\/td>\n<td>ServiceNow, Jira Service Management<\/td>\n<td>Work tracking, SLAs, coordination<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Collaboration<\/td>\n<td>Slack, Microsoft Teams<\/td>\n<td>Rapid dissemination and incident comms<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Documentation<\/td>\n<td>Confluence, SharePoint, Notion<\/td>\n<td>Knowledge base, reports, runbooks<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Source control<\/td>\n<td>GitHub, GitLab<\/td>\n<td>Manage detection content, scripts, rule versioning<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Data analysis<\/td>\n<td>Python, Jupyter, Pandas<\/td>\n<td>Enrichment automation, analysis, reporting<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>OSINT \/ enrichment<\/td>\n<td>VirusTotal, urlscan.io, GreyNoise, Shodan, Censys<\/td>\n<td>Indicator validation, infra analysis, exposure checks<\/td>\n<td>Common (tool choice varies)<\/td>\n<\/tr>\n<tr>\n<td>Passive DNS \/ DNS tools<\/td>\n<td>Farsight\/SecurityTrails (or equivalents)<\/td>\n<td>Pivoting and infra clustering<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Malware sandboxes<\/td>\n<td>Any.Run, Joe Sandbox, Cuckoo<\/td>\n<td>Behavioral analysis and IOC extraction<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Email security<\/td>\n<td>Proofpoint, Microsoft Defender for Office 365<\/td>\n<td>Phishing campaign analysis<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Observability<\/td>\n<td>Datadog, Grafana, Prometheus<\/td>\n<td>Supplemental telemetry, service health during mitigations<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>BI \/ dashboards<\/td>\n<td>Power BI, Tableau<\/td>\n<td>Leadership reporting<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Secrets \/ key management<\/td>\n<td>Vault, AWS KMS, Azure Key Vault<\/td>\n<td>Context for cloud threat patterns<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Secure web gateway \/ DNS security<\/td>\n<td>Zscaler, Umbrella<\/td>\n<td>Blocking and telemetry<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11) Typical Tech Stack \/ Environment<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Infrastructure environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Hybrid cloud is common: cloud-first with remaining on-prem services (AD, legacy apps, build systems).<\/li>\n<li>Mix of IaaS\/PaaS:<\/li>\n<li>AWS (CloudTrail, GuardDuty), Azure (Entra ID, Defender), or GCP equivalents.<\/li>\n<li>Enterprise endpoint fleet:<\/li>\n<li>developer workstations (macOS\/Windows\/Linux),<\/li>\n<li>server estates (Linux-heavy for production).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Application environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SaaS-delivered product(s) and internal services:<\/li>\n<li>microservices and APIs,<\/li>\n<li>containerized workloads (Kubernetes),<\/li>\n<li>CI\/CD pipelines (GitHub Actions\/GitLab CI\/Jenkins).<\/li>\n<li>Identity-centric access model:<\/li>\n<li>SSO, MFA, conditional access,<\/li>\n<li>privileged access management (optional).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Data environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Logs from:<\/li>\n<li>SIEM ingest (endpoint, identity, cloud audit, network),<\/li>\n<li>data lake (optional) for long-term analytics.<\/li>\n<li>TI enrichment data:<\/li>\n<li>feed data, OSINT, internal incident artifacts, vulnerability data.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SOC function with alert triage and escalation.<\/li>\n<li>Incident Response playbooks and severity model.<\/li>\n<li>Vulnerability management program (patch SLAs, scanning).<\/li>\n<li>Detection engineering function (dedicated or shared with SOC).<\/li>\n<li>Threat modeling and AppSec programs (varying maturity).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Delivery model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Agile\/iterative security operations improvements.<\/li>\n<li>Regular operational cadences (weekly\/biweekly).<\/li>\n<li>Some work is interrupt-driven (incidents, urgent exploitation).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scale or complexity context<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Medium-to-large software company or IT organization:<\/li>\n<li>multiple cloud accounts\/subscriptions,<\/li>\n<li>thousands of endpoints and identities,<\/li>\n<li>high log volume and frequent change.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team topology<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lead Threat Intelligence Analyst typically sits within:<\/li>\n<li>SecOps (SOC\/IR), or<\/li>\n<li>a broader Detection &amp; Response team.<\/li>\n<li>Close working relationship with:<\/li>\n<li>Detection Engineering,<\/li>\n<li>Cloud Security,<\/li>\n<li>Vulnerability Management.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12) Stakeholders and Collaboration Map<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Internal stakeholders<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SOC Analysts \/ SOC Lead<\/strong>: consumers of intel for triage, correlation, and escalation; provide feedback on usefulness.<\/li>\n<li><strong>Incident Response (IR) Lead \/ DFIR<\/strong>: uses TI for attribution hypotheses, scoping, eradication guidance, and post-incident learnings.<\/li>\n<li><strong>Detection Engineering<\/strong>: converts TTPs into durable detections; co-owns rule quality and lifecycle.<\/li>\n<li><strong>Vulnerability Management<\/strong>: consumes exploitation intel for patch prioritization and exception handling.<\/li>\n<li><strong>Cloud Security \/ Platform Security<\/strong>: applies TI to cloud control improvements and cloud-native detections.<\/li>\n<li><strong>Product Security \/ AppSec<\/strong>: uses TI to update abuse cases, threat models, secure defaults, and backlog items.<\/li>\n<li><strong>GRC \/ Risk<\/strong>: aligns TI outputs to risk registers, audits, and control narratives (especially in regulated environments).<\/li>\n<li><strong>IT Operations \/ Endpoint Engineering<\/strong>: executes mitigations (blocks, configuration changes), helps validate operational impact.<\/li>\n<li><strong>Legal \/ Privacy<\/strong> (context-specific): supports external sharing constraints, incident communications, data handling.<\/li>\n<li><strong>Executive leadership (CISO\/VP Security)<\/strong>: consumes high-level intelligence and risk-driven recommendations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">External stakeholders (as applicable)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ISAC\/ISAO communities<\/strong>: bi-directional sharing, early warning.<\/li>\n<li><strong>Vendors \/ managed security partners<\/strong>: intelligence sourcing, incident support, tooling.<\/li>\n<li><strong>Law enforcement liaison<\/strong> (rare; context-specific): for severe incidents or fraud.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Peer roles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lead SOC Analyst, Lead Detection Engineer, Security Engineer (IR tooling), Vulnerability Lead, Cloud Security Engineer, AppSec Lead.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Upstream dependencies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Quality telemetry and logging coverage.<\/li>\n<li>Feed access and licensing.<\/li>\n<li>Incident artifacts and timely sharing from IR\/SOC.<\/li>\n<li>Vulnerability scan data and asset inventory accuracy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Downstream consumers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detections deployed to SIEM\/EDR.<\/li>\n<li>VM prioritization and patch campaigns.<\/li>\n<li>IR decisions and containment measures.<\/li>\n<li>Product security requirements and design changes.<\/li>\n<li>Leadership reporting and risk decisions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Nature of collaboration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TI is a <strong>service + enablement<\/strong> function: it produces analytic products and also co-builds operational outcomes with other teams.<\/li>\n<li>Most collaboration is iterative: intel \u2192 action request \u2192 implementation \u2192 feedback \u2192 refinement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Typical decision-making authority<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Decides what intelligence is relevant, how to score it, and how to package it.<\/li>\n<li>Recommends actions and priorities; execution authority often sits with SOC\/IR\/VM\/Engineering leadership.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Escalation points<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Conflicting priorities (e.g., emergency patch vs release constraints) escalated to SecOps leadership\/CISO delegate.<\/li>\n<li>Vendor\/tool spending escalated to Director\/VP depending on budget thresholds.<\/li>\n<li>Legal\/privacy concerns escalated to General Counsel\/Privacy Officer as appropriate.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13) Decision Rights and Scope of Authority<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Can decide independently<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Intelligence relevance scoring, confidence levels, and handling labels (e.g., TLP).<\/li>\n<li>What becomes a bulletin vs an FYI vs a watch item.<\/li>\n<li>Initial analytic judgments (with clear confidence statements) and recommended next steps.<\/li>\n<li>TI workflows, templates, and quality standards (within agreed operating model).<\/li>\n<li>Technical approach for enrichment automation scripts and analytic methods.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Requires team approval (Security\/SecOps consensus)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Changes that impact SOC workflows materially (alert routing, triage logic, sustained new tasks).<\/li>\n<li>Detection content changes that may affect alert volumes or operational load (typically reviewed by Detection Engineering\/SOC).<\/li>\n<li>New recurring deliverables that commit other teams (e.g., weekly hunt cadence requiring SOC support).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Requires manager\/director\/executive approval<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Budget spend on TI tools, new feed contracts, or major platform changes.<\/li>\n<li>Policy-level changes (information sharing policy, data retention affecting TI pipelines).<\/li>\n<li>Organization-wide response posture changes based on TI (e.g., blocking broad IP ranges, aggressive geo-blocking, emergency user friction changes).<\/li>\n<li>Headcount requests or changes to operating model that cross org boundaries.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Budget \/ vendor authority (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Influences vendor selection and requirements; may lead evaluations and recommend decisions.<\/li>\n<li>Final purchase approval typically resides with Director\/VP and Procurement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture \/ delivery authority<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Can define TI integration patterns (TIP \u2194 SIEM \u2194 SOAR \u2194 ITSM), but production changes often require Security Engineering\/SecOps platform owners to approve and implement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hiring authority<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Usually contributes to hiring panels, develops interview content, and mentors new hires; final hiring decisions typically made by the hiring manager.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance authority<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensures TI handling aligns to policy (TLP, privacy constraints). Formal compliance sign-off typically belongs to GRC\/Legal.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14) Required Experience and Qualifications<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Typical years of experience<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>8\u201312 years<\/strong> in security, with <strong>3\u20136 years<\/strong> directly in threat intelligence, detection\/response, or adjacent domains (SOC, IR, detection engineering).<\/li>\n<li>Lead-level expectations include consistent delivery ownership, cross-team influence, and program\/process maturity contributions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Education expectations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Bachelor\u2019s degree in Computer Science, Information Security, or related field is common.  <\/li>\n<li>Equivalent experience is often acceptable, especially with strong technical evidence and operational accomplishments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certifications (Common \/ Optional)<\/h3>\n\n\n\n<p><strong>Common (helpful, not always required):<\/strong>\n&#8211; GIAC GCTI (Cyber Threat Intelligence)\n&#8211; GIAC GCIA \/ GCIH (network analysis \/ incident handling)\n&#8211; CompTIA Security+ (baseline; more common earlier career)\n&#8211; MITRE ATT&amp;CK training (non-cert but relevant)<\/p>\n\n\n\n<p><strong>Optional \/ Context-specific:<\/strong>\n&#8211; CISSP (useful for broader security leadership and governance)\n&#8211; AWS\/Azure security certs (useful in cloud-heavy orgs)\n&#8211; GIAC GPEN \/ GXPN (pentest; helps understanding attacker tradecraft)\n&#8211; SANS FOR578 (cyber threat intel) or similar advanced TI coursework<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prior role backgrounds commonly seen<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Senior SOC Analyst \/ SOC Lead<\/li>\n<li>Incident Responder \/ DFIR Analyst<\/li>\n<li>Detection Engineer \/ Security Engineer (SIEM\/EDR)<\/li>\n<li>Vulnerability Analyst with exploitation intelligence focus<\/li>\n<li>Threat Intel Analyst (senior), moving into lead scope<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Domain knowledge expectations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Strong understanding of:<\/li>\n<li>attacker lifecycle and common intrusion chains,<\/li>\n<li>phishing and credential theft patterns,<\/li>\n<li>ransomware ecosystem and initial access vectors,<\/li>\n<li>cloud identity threats and misconfiguration abuse,<\/li>\n<li>software supply-chain risks (in software companies).<\/li>\n<li>Familiarity with regulatory constraints is helpful (e.g., SOC2, ISO 27001, GDPR) but not always central unless the environment is regulated.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Leadership experience expectations (Lead level)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Demonstrated ability to:<\/li>\n<li>lead cross-functional initiatives,<\/li>\n<li>mentor analysts,<\/li>\n<li>establish standards and repeatable processes,<\/li>\n<li>communicate with executives and influence priorities.<\/li>\n<li>Direct people management experience is <strong>optional<\/strong> unless the organization explicitly defines \u201cLead\u201d as a formal manager.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15) Career Path and Progression<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Common feeder roles into this role<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Senior Threat Intelligence Analyst<\/li>\n<li>Senior SOC Analyst \/ SOC Shift Lead<\/li>\n<li>Detection Engineer (senior)<\/li>\n<li>Incident Response analyst (senior)<\/li>\n<li>Vulnerability Analyst with strong exploitation intel capability<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Next likely roles after this role<\/h3>\n\n\n\n<p><strong>Individual Contributor progression:<\/strong>\n&#8211; <strong>Principal Threat Intelligence Analyst<\/strong>\n&#8211; <strong>Staff Security Analyst (Detection &amp; Response \/ Threat Intel)<\/strong>\n&#8211; <strong>Threat Intelligence Architect<\/strong> (context-specific; more design\/operating model heavy)<\/p>\n\n\n\n<p><strong>Management progression:<\/strong>\n&#8211; <strong>Threat Intelligence Manager<\/strong> (builds team, budgets, formal strategy)\n&#8211; <strong>SOC Manager \/ Detection &amp; Response Manager<\/strong> (broader operational scope)\n&#8211; <strong>Director of Security Operations<\/strong> (longer-term path)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Adjacent career paths<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detection Engineering (specialize in rule development and telemetry)<\/li>\n<li>Incident Response \/ DFIR leadership<\/li>\n<li>Cloud Security Engineering (identity-first detection focus)<\/li>\n<li>Product Security \/ Abuse &amp; Fraud (for consumer products)<\/li>\n<li>Security Risk Strategy (if leaning toward executive reporting and governance)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Skills needed for promotion (to Principal or Manager)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Proven TI program impact over multiple quarters (measurable outcomes).<\/li>\n<li>Broader strategic thinking (multi-year threat outlook, investment recommendations).<\/li>\n<li>Stronger operating model design (tooling roadmap, staffing model, service catalog).<\/li>\n<li>Greater ability to influence and align across engineering\/product leadership.<\/li>\n<li>For management: hiring, performance management, budget ownership, stakeholder portfolio management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How this role evolves over time<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Early: establish credibility with quick wins and operationalization.<\/li>\n<li>Mid: build durable processes, SLAs, and high-signal dissemination.<\/li>\n<li>Mature: become the organization\u2019s intelligence authority shaping security strategy and resilience planning (tabletops, architecture guidance, vendor selection).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16) Risks, Challenges, and Failure Modes<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Common role challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Signal-to-noise overload<\/strong> from feeds and OSINT leading to burnout and low-impact outputs.<\/li>\n<li><strong>Lack of clear PIRs<\/strong> causing reactive, unfocused work.<\/li>\n<li><strong>Operationalization gap<\/strong>: intelligence reports produced but not converted into detections, hunts, or mitigations.<\/li>\n<li><strong>Telemetry gaps<\/strong>: inability to validate or hunt due to missing logs, poor normalization, or access constraints.<\/li>\n<li><strong>Stakeholder mismatch<\/strong>: delivering overly technical reports to executives or overly high-level reports to SOC.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Bottlenecks<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detection engineering backlog and limited bandwidth to implement TI-driven detections.<\/li>\n<li>Slow change management for blocks\/config changes (IT or network teams).<\/li>\n<li>Procurement delays for tooling improvements.<\/li>\n<li>Incomplete asset inventory affecting vulnerability prioritization accuracy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Anti-patterns<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Measuring success by volume: \u201cnumber of IOCs processed\u201d without actionability.<\/li>\n<li>Over-indexing on attribution when it doesn\u2019t change decisions.<\/li>\n<li>Sharing unverified intel broadly, causing unnecessary panic or operational disruption.<\/li>\n<li>Producing long reports with unclear \u201cdo this now\u201d actions and owners.<\/li>\n<li>Treating TI as a silo instead of a service integrated into SecOps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common reasons for underperformance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Weak analytic writing and inability to synthesize.<\/li>\n<li>Poor understanding of the company\u2019s environment and what \u201crelevant\u201d means.<\/li>\n<li>Lack of technical fluency in SIEM\/EDR queries, preventing validation.<\/li>\n<li>Inability to influence cross-functionally; recommendations consistently ignored.<\/li>\n<li>Overconfidence and lack of clear confidence levels or evidence.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Business risks if this role is ineffective<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Increased likelihood of successful attacks due to missed early warnings and poor prioritization.<\/li>\n<li>Slower and more expensive incident response due to lack of context and prepared detections.<\/li>\n<li>Inefficient spend on feeds and tools with minimal security outcomes.<\/li>\n<li>Leadership blind spots: security strategy not aligned to actual threat landscape.<\/li>\n<li>Higher customer impact and reputational damage from preventable security incidents.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17) Role Variants<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">By company size<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Small (&lt;500 employees):<\/strong> <\/li>\n<li>Role is broader and more hands-on; may combine TI + hunting + detection engineering support.  <\/li>\n<li>\n<p>Fewer tools; more OSINT and manual workflows; direct access to decision makers.<\/p>\n<\/li>\n<li>\n<p><strong>Mid-size (500\u20135,000):<\/strong> <\/p>\n<\/li>\n<li>Balanced TI program with TIP\/SIEM integration.  <\/li>\n<li>\n<p>Strong emphasis on operationalization and cross-team SLAs.<\/p>\n<\/li>\n<li>\n<p><strong>Enterprise (5,000+):<\/strong> <\/p>\n<\/li>\n<li>Specialization increases: separate collection team, malware team, brand protection, regional TI.  <\/li>\n<li>Lead TI analyst may focus on program leadership, requirements, and stakeholder-facing products.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">By industry<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>B2B SaaS:<\/strong> <\/li>\n<li>\n<p>Heavy focus on identity threats, cloud control plane abuse, supply-chain and CI\/CD risks, customer trust communications.<\/p>\n<\/li>\n<li>\n<p><strong>IT services \/ MSP \/ MSSP:<\/strong> <\/p>\n<\/li>\n<li>\n<p>TI tailored to client environments; emphasis on broad threat coverage, repeatable intel packages, and rapid dissemination across many tenants.<\/p>\n<\/li>\n<li>\n<p><strong>Consumer tech:<\/strong> <\/p>\n<\/li>\n<li>More emphasis on fraud, account takeover, impersonation, and brand protection.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">By geography<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regional differences show up in:<\/li>\n<li>threat actor targeting patterns,<\/li>\n<li>regulatory constraints on data sharing,<\/li>\n<li>language requirements for OSINT,<\/li>\n<li>time-zone coverage expectations.<\/li>\n<li>Global companies often require TLP discipline and clear sharing policies across regions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Product-led vs service-led company<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Product-led:<\/strong> TI integrates with product security, abuse cases, and secure-by-design changes.  <\/li>\n<li><strong>Service-led:<\/strong> TI integrates with client advisory, SOC operations, and standardized playbooks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup vs enterprise<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Startup:<\/strong> fast decisions, fewer controls; TI must be pragmatic, focusing on top risks and immediate actions.  <\/li>\n<li><strong>Enterprise:<\/strong> complex stakeholder environment; TI must be process-driven, auditable, and aligned with governance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regulated vs non-regulated<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Regulated (finance\/health\/critical infra):<\/strong> stricter evidence and reporting requirements; TI outputs may support audits and formal risk management; sharing constraints are stricter.  <\/li>\n<li><strong>Non-regulated:<\/strong> more flexibility; faster iteration; still needs strong handling discipline.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18) AI \/ Automation Impact on the Role<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Tasks that can be automated (high leverage)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Indicator enrichment and pivoting<\/strong>: automated WHOIS\/passive DNS lookups, reputation checks, sandbox detonation workflows.<\/li>\n<li><strong>Deduplication and scoring<\/strong>: clustering similar intel items, reducing feed noise, prioritizing by relevance tags and asset exposure.<\/li>\n<li><strong>Report drafting assistance<\/strong>: first-pass summaries of long reports (with human verification and citations).<\/li>\n<li><strong>Dissemination routing<\/strong>: automatically notify the right channels\/owners based on tags (cloud, identity, endpoint, product).<\/li>\n<li><strong>IOC lifecycle management<\/strong>: expiry, suppression, and revalidation workflows integrated into TIP\/SIEM.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tasks that remain human-critical<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Relevance judgment<\/strong>: deciding what matters to <em>this<\/em> business, <em>now<\/em>.<\/li>\n<li><strong>Analytic rigor<\/strong>: weighing conflicting sources, assessing deception, articulating confidence and uncertainty.<\/li>\n<li><strong>Tradeoff decisions<\/strong>: recommending disruptive mitigations with awareness of operational impact.<\/li>\n<li><strong>Stakeholder influence and alignment<\/strong>: securing buy-in for prioritization, SLAs, and investments.<\/li>\n<li><strong>Incident leadership support<\/strong>: real-time decision support in ambiguous, high-stakes situations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How AI changes the role over the next 2\u20135 years<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The role shifts from \u201ccollect and summarize\u201d toward <strong>curate, validate, and operationalize<\/strong> at scale.<\/li>\n<li>Leads will be expected to:<\/li>\n<li>implement AI-assisted workflows safely (governance, evaluation, auditing),<\/li>\n<li>measure model output quality (false summaries are dangerous),<\/li>\n<li>develop standards for AI usage in TI products (citation requirements, labeling, handling restrictions),<\/li>\n<li>build and maintain high-quality datasets (internal incident learnings, detections, outcomes) to improve automation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">New expectations caused by AI, automation, or platform shifts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ability to design <strong>human-in-the-loop<\/strong> pipelines where AI accelerates triage but humans control final analytic judgments.<\/li>\n<li>Increased emphasis on <strong>identity and SaaS telemetry<\/strong> as attackers leverage AI for phishing, social engineering, and faster infrastructure churn.<\/li>\n<li>Stronger integration with security data engineering: normalized schemas, entity resolution, and scalable analytics.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19) Hiring Evaluation Criteria<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to assess in interviews<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Threat intelligence tradecraft<\/strong>\n   &#8211; Can they define PIRs, evaluate sources, and articulate confidence?\n   &#8211; Do they understand the TI lifecycle and feedback loops?<\/p>\n<\/li>\n<li>\n<p><strong>Operationalization mindset<\/strong>\n   &#8211; Do they naturally translate intel into detections, hunts, mitigations, and prioritized actions?\n   &#8211; Can they define SLAs and success criteria?<\/p>\n<\/li>\n<li>\n<p><strong>Technical fluency<\/strong>\n   &#8211; SIEM query ability, indicator validation, ATT&amp;CK mapping, and basic scripting.\n   &#8211; Ability to reason about cloud\/identity threats.<\/p>\n<\/li>\n<li>\n<p><strong>Communication quality<\/strong>\n   &#8211; Can they write and speak clearly to both operators and executives?\n   &#8211; Are outputs concise, structured, and action-oriented?<\/p>\n<\/li>\n<li>\n<p><strong>Leadership (Lead-level)<\/strong>\n   &#8211; Mentoring approach, ability to influence without authority, program improvement track record.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Practical exercises or case studies (recommended)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Intel-to-action case<\/strong> (60\u201390 minutes)\n   &#8211; Provide: a vendor report on an active campaign + a handful of IOCs + brief company context.<br\/>\n   &#8211; Ask candidate to produce:<\/p>\n<ul>\n<li>a one-page operational bulletin (actions + owners),<\/li>\n<li>ATT&amp;CK mapping,<\/li>\n<li>3\u20135 hunting hypotheses with sample queries (pseudo-SPL\/KQL acceptable),<\/li>\n<li>an executive summary paragraph with confidence statements.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>Vulnerability exploitation prioritization scenario<\/strong> (30\u201345 minutes)\n   &#8211; Provide: 3 CVEs with mixed signals (KEV status, EPSS, exploit PoC, limited telemetry).<br\/>\n   &#8211; Ask: which gets escalated, recommended patch SLA, and what evidence would change the decision.<\/p>\n<\/li>\n<li>\n<p><strong>Writing sample<\/strong> (take-home, time-boxed)\n   &#8211; Candidate rewrites a noisy intel feed item into a crisp, internally shareable note with citations and handling label.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Strong candidate signals<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Uses structured thinking: facts vs assumptions, clear confidence levels.<\/li>\n<li>Prior experience operationalizing intel into detections\/hunts with measurable outcomes.<\/li>\n<li>Comfortable with SIEM queries and can explain what data is needed to validate a claim.<\/li>\n<li>Communicates with clarity and brevity; includes owners and next steps.<\/li>\n<li>Demonstrates humility and willingness to update judgments with new evidence.<\/li>\n<li>Has built or improved TI processes (templates, cadences, scoring systems).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Weak candidate signals<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Focuses heavily on attribution without tying it to actions.<\/li>\n<li>Produces long summaries with no prioritization, no owners, and no decision points.<\/li>\n<li>Cannot explain how they validated indicators or assessed source reliability.<\/li>\n<li>Limited understanding of ATT&amp;CK or inability to translate TTPs into detections.<\/li>\n<li>Treats TI as separate from SecOps rather than integrated.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Red flags<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Overconfidence: states conclusions without evidence or confidence framing.<\/li>\n<li>Recommends disruptive blocks\/patching without considering operational risk.<\/li>\n<li>Poor handling discipline: willing to overshare restricted intel or ignore privacy constraints.<\/li>\n<li>Blames other teams for lack of action without demonstrating influence or collaboration.<\/li>\n<li>Cannot describe a single example where their TI work changed an outcome.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scorecard dimensions (with suggested weighting)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Dimension<\/th>\n<th>What \u201cmeets bar\u201d looks like<\/th>\n<th style=\"text-align: right;\">Weight<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>TI tradecraft &amp; analytic rigor<\/td>\n<td>Clear PIR thinking, source evaluation, confidence scoring<\/td>\n<td style=\"text-align: right;\">20%<\/td>\n<\/tr>\n<tr>\n<td>Operationalization &amp; impact orientation<\/td>\n<td>Converts intel into actions; defines outcomes and SLAs<\/td>\n<td style=\"text-align: right;\">20%<\/td>\n<\/tr>\n<tr>\n<td>Technical fluency (SIEM\/EDR, ATT&amp;CK, infra)<\/td>\n<td>Can validate\/pivot; produces workable hunting\/detection ideas<\/td>\n<td style=\"text-align: right;\">20%<\/td>\n<\/tr>\n<tr>\n<td>Communication (written + verbal)<\/td>\n<td>Concise, structured, executive-ready<\/td>\n<td style=\"text-align: right;\">15%<\/td>\n<\/tr>\n<tr>\n<td>Collaboration &amp; influence<\/td>\n<td>Works across SOC\/IR\/VM\/Eng; constructive conflict handling<\/td>\n<td style=\"text-align: right;\">15%<\/td>\n<\/tr>\n<tr>\n<td>Leadership (Lead-level mentoring\/process)<\/td>\n<td>Mentors others; improves programs; sets standards<\/td>\n<td style=\"text-align: right;\">10%<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20) Final Role Scorecard Summary<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Summary<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Role title<\/strong><\/td>\n<td>Lead Threat Intelligence Analyst<\/td>\n<\/tr>\n<tr>\n<td><strong>Role purpose<\/strong><\/td>\n<td>Turn internal and external threat signals into actionable intelligence that improves detection, response, and risk prioritization across a software\/IT organization.<\/td>\n<\/tr>\n<tr>\n<td><strong>Top 10 responsibilities<\/strong><\/td>\n<td>1) Define TI operating model and PIRs  2) Produce actionable intel products (weekly\/monthly)  3) Operationalize intel into detections\/hunts\/mitigations  4) Support incidents with rapid enrichment  5) Map TTPs to MITRE ATT&amp;CK and drive coverage  6) Lead vulnerability exploitation prioritization inputs  7) Manage TI tooling workflows and integrations  8) Maintain adversary\/campaign dossiers  9) Govern intel quality, confidence, and handling (TLP)  10) Mentor analysts and drive continuous improvement KPIs<\/td>\n<\/tr>\n<tr>\n<td><strong>Top 10 technical skills<\/strong><\/td>\n<td>1) TI lifecycle &amp; tradecraft  2) MITRE ATT&amp;CK mapping  3) SIEM querying (SPL\/KQL\/Elastic)  4) IOC validation and infra pivoting  5) Incident response collaboration  6) Vulnerability exploitation intelligence (KEV\/EPSS)  7) Scripting\/automation (Python\/APIs)  8) Cloud security fundamentals (IAM\/logs)  9) TIP\/SOAR concepts and integrations  10) Detection content fundamentals (Sigma\/YARA\/queries)<\/td>\n<\/tr>\n<tr>\n<td><strong>Top 10 soft skills<\/strong><\/td>\n<td>1) Analytic rigor  2) Executive synthesis  3) Operational empathy  4) Influence without authority  5) Prioritization under ambiguity  6) Clear writing  7) Incident calmness  8) Collaboration &amp; conflict navigation  9) Mentoring\/teaching  10) Accountability for outcomes<\/td>\n<\/tr>\n<tr>\n<td><strong>Top tools or platforms<\/strong><\/td>\n<td>SIEM (Splunk\/Sentinel\/Elastic), EDR (CrowdStrike\/Defender), TIP (Recorded Future\/ThreatConnect\/Anomali\u2014context-specific), SOAR (XSOAR\/Splunk SOAR), OSINT enrichment (VirusTotal\/urlscan\/GreyNoise\/Shodan), ITSM (ServiceNow\/Jira), Cloud logs (AWS\/Azure\/GCP), Collaboration (Slack\/Teams), Docs (Confluence\/SharePoint), Python + Git<\/td>\n<\/tr>\n<tr>\n<td><strong>Top KPIs<\/strong><\/td>\n<td>Intel-to-action cycle time; % curated intel operationalized; TI-driven detection coverage lift; incident enrichment SLA; patch acceleration for exploited vulns; source value score; analytic quality score; stakeholder satisfaction; report timeliness; hunt yield rate<\/td>\n<\/tr>\n<tr>\n<td><strong>Main deliverables<\/strong><\/td>\n<td>PIRs and TI operating model; weekly intel notes; monthly threat landscape reports; campaign\/adversary dossiers; hunting packages; detection requests and rule artifacts; vulnerability exploitation advisories; TI dashboards\/KPI reports; TI runbooks; training briefings<\/td>\n<\/tr>\n<tr>\n<td><strong>Main goals<\/strong><\/td>\n<td>First 90 days: establish cadence, scoring standards, and TI-to-action workflow with measurable early wins. 6\u201312 months: mature program into a trusted, metrics-driven intelligence-led defense capability integrated across SOC\/IR\/VM\/Product Security.<\/td>\n<\/tr>\n<tr>\n<td><strong>Career progression options<\/strong><\/td>\n<td>Principal\/Staff Threat Intelligence Analyst; Threat Intelligence Manager; SOC\/Detection &amp; Response Manager; Security Operations Director path; adjacent: Detection Engineering lead, IR lead, Cloud Security lead, Product Security\/Abuse lead<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>The **Lead Threat Intelligence Analyst** is a senior, hands-on security analyst who designs, runs, and continuously improves an organization\u2019s threat intelligence (TI) capability to reduce cyber risk. The role turns raw signals (telemetry, OSINT, vendor feeds, dark web monitoring, incident learnings) into **actionable intelligence** that informs detection engineering, incident response, vulnerability management, and security strategy.<\/p>\n","protected":false},"author":61,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[24453,24460],"tags":[],"class_list":["post-72702","post","type-post","status-publish","format-standard","hentry","category-analyst","category-security"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/72702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=72702"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/72702\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=72702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=72702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=72702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}