CTI Analyst

Master the intelligence cycle, distinguish strategic/operational/tactical CTI, write Priority Intelligence Requirements, and understand what separates finished intelligence from raw data.

Systematically collect open-source intelligence from clearnet, paste sites, code repositories, and dark web sources while maintaining operational security to avoid tipping off adversaries.

Model threat intelligence in STIX 2.1, share via TAXII, and operate MISP and OpenCTI platforms to ingest, enrich, and disseminate structured intelligence across teams and organizations.

Build defensible threat actor profiles, track campaigns across intrusion sets, cluster activity by TTP/infrastructure/malware overlap, and maintain living profiles that update as new evidence emerges.

Evaluate IOC quality across atomic/computed/behavioral types, understand indicator decay and when to retire stale indicators, and prioritize which IOCs actually belong in detection tools vs. intelligence records.

Produce intelligence products that actually drive decisions: strategic threat landscape reports for executives, tactical threat briefs for SOC/IR teams, and flash reports for urgent emerging threats.

Operationalize threat intelligence into working detections: extract TTPs from reports, write Sigma rules from adversary playbooks, assess ATT&CK detection coverage gaps, and close the feedback loop with detection engineers.

Move beyond CVSS scores: assess exploitation probability using EPSS and KEV, track threat actor exploitation of specific CVEs, and deliver vulnerability intelligence that focuses limited patching resources on actual risk.