How to Become a Threat Intelligence Analyst: What 182 Open Threat Roles Ask and Pay

What threat intelligence analysts, threat hunters, malware analysts and security researchers actually produce, what 182 open postings demand of them, what they pay, and the doors that lead into the work.

A threat intelligence analyst studies the people and the tooling behind attacks (who goes after an organization, how they get in, which servers and malware they rely on) and turns that study into something a defender or a decision maker can act on: a detection rule, a list of addresses to block, a warning to a customer, a one-page assessment for an executive. Very few people are hired into that seat first. The open roles assume two to five years of security work beforehand, most often in a security operations center or incident response, sometimes in military or government intelligence, and now and then in journalism, fraud investigation or self-taught malware research that left a public trail. Of the 182 threat postings CyberJobs.cc read in full on 12 November 2026, just 4 carried an intern or associate title, and the median minimum experience asked was five years, so the practical question is less "which course" than "which job gets me the evidence these postings want".

How the sample was drawn. The starting point was every role the board files under threat intelligence and security research (141 that day). Fifteen of them were taken out because the work is not threat analysis: engineers who build the software intelligence teams use, a program manager, a product director, an incident responder, an application security reviewer, a vulnerability management lead and a freelance listing that pays practitioners to train AI models. To the remaining 126 were added 56 roles filed under other specialties whose titles named threat intelligence, threat hunting, threat investigation, malware, vulnerability research, detection research or security research, after removing detection engineers and SOC analysts (covered in the SOC analyst guide), red team and emulation consultants, forensic examiners, abuse-control software engineers, market intelligence managers and French postings where "exploitation" means running a system. That left 182 postings from 69 employers. Each was read in full and counted for its title level, the fewest years it accepts, the frameworks, tools, languages, certifications and clearances it names, the writing it describes, its location and its printed salary. Pay comes only from ranges employers published, taken from the posting's own words where the board had misread them (a learning budget read as a salary, for one). Figures the board can recount live are written as live counts: right now it lists 141 open roles in threat intelligence and research, 52 of them remote. Every figure from outside the board is linked to its source and dated in the sentence.

Contents

1. What a threat intelligence analyst produces, and for whom
2. Eight kinds of threat work, and how the day differs
3. The intelligence cycle on a working team
4. What 182 threat research postings ask for
5. A learning order where each skill feeds the next
6. Routes in: SOC, service, newsroom, fraud desk and home lab
7. Writing for people who decide
8. Threat intelligence certifications, and how often postings name none
9. Threat intelligence analyst salary by level and kind of work
10. AI as a target and as a tool
11. Threat intelligence career questions, answered

1. What a threat intelligence analyst produces, and for whom

The US government's workforce framework gives the job one line. Its Threat Analysis work role (PD-WRL-006) is "responsible for collecting, processing, analyzing, and disseminating cybersecurity threat assessments", and the first sample task it lists is "Answer requests for information" - NICCS, NICE Framework 2.2.0. That second phrase is the more useful one for a newcomer, because it names the customer. Intelligence is work done for someone who has a question.

Reasoned from the ground up, the role exists because defense is a budget problem. An organization can be attacked in more ways than it can afford to guard, and most of those ways will never be used against it. The analyst's product is a narrower list: these groups, using these techniques, against systems we actually run, this month. A report that changes no decision has cost money and saved nothing, which is why the field's own surveys keep returning to the same gap. In the SANS 2026 Cyber Threat Intelligence survey, published on 19 May 2026, 91% of the CISOs asked said they value threat intelligence, yet only 26% said it drives their decisions - SANS Institute. The distance between those two numbers is, in a sense, the job description.

Three customers, three kinds of product

Every posting in the sample sells its work to one or more of three readers, and the reader decides what the product looks like.

The machine. Firewalls, endpoint agents and email filters consume indicators: addresses, domains, file hashes, byte patterns, behavioural rules. TRM Labs, a blockchain intelligence firm, puts this customer bluntly in its posting for a senior analyst covering hacks: when an exchange is breached, its clients "need to know within minutes or hours which addresses to block and where the funds are going". Speed and precision matter here more than prose.

The defender. Hunters, detection engineers and incident responders need to know how an adversary behaves, so they can look for it in their own data. This product is a description of technique: what the intruder does after getting in, which logs record it and what a query for it would look like.

The decision maker. Executives, insurers, product leaders and government partners need judgments: how likely is this, what is our exposure, what should we do. ID.me's senior analyst posting describes owning coverage of a set of threats "from detection engineers to executives and government partners", which is the whole range in one sentence. Abnormal Security's threat researcher posting lists the formats (a short brief, a deeper report, material for a customer's quarterly review, a webinar) and calls the defining skill "intelligence synthesis".

A newcomer can use those three readers as a map of the field. Work aimed mostly at the machine pays for code and reverse engineering; work aimed at the defender pays for operating-system and network depth; work aimed at the decision maker pays for judgment, writing and sometimes languages. Section 4 shows how often postings ask for each.

Who employs threat analysts

The answer is lopsided. Of the 182 postings, 120 (66%) came from security software vendors, 42 of the 69 employers in the sample. Palo Alto Networks alone posted 28, followed by Sophos (9), Two Six Technologies (9), Wiz (8) and Arctic Wolf (8). The economics explain it. An in-house team protects one organization and needs a handful of analysts; a vendor sells the same research to thousands of customers through its product, so it can pay for whole departments of researchers, and their published findings double as the company's reputation. That is also why so many postings ask for public writing, a point section 7 returns to.

The rest of the sample came from cloud and infrastructure companies (15 postings), defense contractors (13), security consultancies (10), AI labs (10), finance and crypto firms (9) and other software companies (5). One honest caveat belongs here. The board reads employers' own careers systems, and the roughly 300 employers it reads lean toward technology companies; banks, government agencies and the largest defense integrators are under-represented, and those are the places where much strategic and government-facing intelligence work happens. The sample describes the commercial market well and the public-sector one only partly.

2. Eight kinds of threat work, and how the day differs

"Threat intelligence" is used as an umbrella for work that ranges from writing assessments in plain English to reading disassembled firmware. Splitting the 182 postings by what the hire would actually produce gives eight groups of very different size. (For a shorter tour of the specialty with three worked cases, from a leadership brief to an infrastructure pivot, see the board's threat intelligence career overview.)

Detection and product research: the largest group

Every one of these 46 postings carries a research title, and the work behind the title is studying an attack technique closely enough to teach a product to recognize it. Sysdig's posting for a director of security research draws the line inside its own department neatly: "Adversary research is hypothesis-driven and sets its own agenda. Detection engineering is demand-driven." A typical week: reproduce a technique in a lab, watch what it leaves in endpoint, cloud or network telemetry, write logic that catches it, then measure the false positives it would raise across thousands of customers. Arctic Wolf's detection researchers in Bengaluru write rules that must work across customers' third-party integrations; Palo Alto Networks' Cortex teams in Tel Aviv research Linux, Windows and identity attacks for its endpoint and XDR products; Elastic's research engineers write C and C++ that runs on customers' endpoints. Only 4 of these 46 postings were remote, because most sit in research centres: 17 in Israel, 14 in the United States and 7 in India.

Vulnerability and offensive research

These researchers look for flaws rather than for attackers. The work splits three ways in the postings. Defense contractors such as Two Six Technologies (9 postings) hire cleared researchers to analyze firmware on ARM, MIPS and PowerPC processors for government customers. Vendors such as Qualys and Palo Alto Networks hire researchers to turn newly disclosed vulnerabilities into checks and signatures their products run. And intelligence teams hire exploit analysts: CrowdStrike's Technical Analysis Cell was seeking a researcher for what it calls "purely a defensive role", documenting exploitation techniques observed in attacks in the wild. Where this work shades into breaking into clients' systems for a living, it becomes penetration testing, which has a guide of its own.

Technical cyber threat intelligence

This is the work most people picture: tracking named groups, their malware and their infrastructure over months, and publishing what the tracking shows. Wiz was hiring two cloud threat intelligence researchers and said plainly that it wanted "a cyber espionage specialist and a cyber crime specialist". Recorded Future's senior analyst in the US researches criminal forums and marketplaces and requires professional proficiency in Russian. Coalition, a cyber insurer, runs a Zero-Day Alert process and a network of honeypots so it can warn policyholders before exposed systems are exploited. Arctic Wolf's staff-level researcher is asked to set "rigorous standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation", a list that doubles as a syllabus for the discipline.

Fraud, abuse and insider investigations

Twenty postings apply intelligence methods to people who abuse a platform or an employer from inside. TRM Labs' scam team follows "pig butchering" syndicates through their infrastructure and money; Elliptic hires analysts to investigate how terrorist networks use cryptoassets; Roblox, Reddit, Discord and xAI hire investigators for safety, ad fraud and influence operations; SpaceX, Anduril Industries, Coupang and CoreWeave hire insider threat analysts. This group behaves differently from the rest: none of its 20 postings asks for public research, 9 name open-source intelligence, and 11 describe working with law enforcement, government partners or sharing groups.

Threat hunting

A hunter starts from a hypothesis rather than an alert ("if this group were inside our customers' networks, what would it look like?") and searches the data to prove or disprove it. CrowdStrike's threat hunting intelligence analysts, Palo Alto Networks' Unit 42 hunters, Huntress's detection and hunting team and Trellix's cleared hunter in Virginia fit here, as do Sophos's managed detection and response threat analysts, whose day sits closest to SOC work: their entry posting in India asks for two years in a SOC and a willingness to work weekends and holidays. Hunting is the most remote-friendly group in the sample (14 of 20), because the data lives in the cloud and the customers are everywhere.

AI threat research

Nineteen postings study AI either as a target (attacks on models and agents) or as a weapon in someone else's hands (misuse of models by criminals and states). Anthropic, OpenAI and xAI hire investigators for the second; Check Point, SentinelOne, Vectra AI, Snyk and Palo Alto Networks hire researchers for the first. Section 10 is devoted to this group, because it is the newest and the best paid.

Malware analysis and reverse engineering

A smaller group than its reputation suggests (11 postings), but a distinct craft. Recorded Future's senior malware analyst triages samples its sandbox surfaces, analyzes them statically and dynamically on Windows, macOS and Android, writes and maintains YARA rules, builds configuration extractors and needs "strong skills in Assembly language". Dragos hires malware analysts for industrial control system malware and firmware. A newer branch studies malicious open-source packages: Endor Labs, Socket and JFrog all posted roles analyzing poisoned libraries and extensions in the software supply chain.

Strategic, sector and advisory intelligence

The smallest group here, for the reason given in section 1. ESET's vertical threat intelligence analyst follows the actors active in particular industries and must "analyze cyber threats beyond purely technical indicators". Check Point's strategic cyber intelligence researcher works on cybercrime and hacktivist ecosystems through web intelligence and "virtual HUMINT operations". Palo Alto Networks' Unit 42 advisory consultant in Dubai helps large enterprises improve their intelligence programmes and must follow the US intelligence community's analytic standard, ICD 203. GuidePoint Security's threat actor engagement consultant advises victims, their lawyers and insurers on dealing with ransomware operators, and asks for two to four years of talking to threat actors through personas, negotiations or "sock puppet" accounts.

3. The intelligence cycle on a working team

Intelligence training everywhere draws the same loop: decide what you need to know, collect, process, analyze, disseminate, collect feedback, repeat. FIRST, the global forum of incident response teams, teaches it in its threat intelligence curriculum alongside priority intelligence requirements, source evaluation and communicating uncertainty - FIRST CTI SIG. Postings use the same vocabulary: Check Point asks for experience "across the full threat intelligence research lifecycle (collection, validation, analysis, production, and dissemination)". The loop is simple to draw and hard to run, and the places it breaks are where good analysts earn their keep.

Requirements: deciding what not to look at

The first step is also the easiest to rush. FIRST's guidance on priority intelligence requirements says they "must be limited and well-scoped", sums its advice up as "Less is more", and warns that they are "not static" and need revisiting as the business changes - FIRST, PIR curriculum. For a mid-sized software company, a usable set might be three questions: which groups are exploiting the internet-facing products we run; who is selling access to companies like ours or our customers; and what would an intrusion into our build pipeline look like. Everything collected should serve one of them. ID.me's senior analyst is asked to "define and prioritize intelligence requirements in partnership with security, fraud, product, and company leadership", and in the sample 5 of the 34 core intelligence postings name requirements or requests for information explicitly.

Collection: more sources than time

Collection draws on four kinds of source. The first is the organization's own telemetry: endpoint, identity, cloud, email and network logs, plus incident case files. The second is official reporting: government advisories often ship machine-readable indicators. CISA's April 2026 advisory on Iranian-affiliated actors exploiting programmable logic controllers, revised in July, maps the activity to ATT&CK for Enterprise version 19 and provides its indicators as STIX XML and STIX JSON files - CISA, AA26-097A. The third is vendor and community reporting. The fourth is what analysts collect themselves: open-source research (24 postings name OSINT), criminal forums and markets (14), and sensors such as honeypots (CrowdStrike's research team in Europe and Coalition both operate them).

Processing: making material comparable

Processing means normalizing raw material into one store, de-duplicating it and tagging each item with its source and date. Shared formats exist for this: STIX is "a language and serialization format" for threat intelligence and TAXII "an application layer protocol" for exchanging it over HTTPS - OASIS CTI documentation. STIX 2.1 became an OASIS Standard on 10 June 2021 - OASIS, STIX 2.1. Teams usually keep the result in a threat intelligence platform; MISP, an open-source example, describes itself as software "for collecting, storing, distributing and sharing cyber security indicators" and exports to STIX - MISP project. Postings rarely name these by brand (section 4 has the counts), but the concepts come up whenever intelligence moves between teams or companies.

Analysis: models that keep you honest

Three models do most of the work. The Diamond Model, published in 2013 by Sergio Caltagirone, Andrew Pendergast and Christopher Betz, describes every intrusion event through four connected features: adversary, capability, infrastructure and victim - Vectra AI, Diamond Model explainer. Its practical value is pivoting: knowing one corner, you look for the others. Lockheed Martin's Cyber Kill Chain, part of its "Intelligence Driven Defense" model, breaks an intrusion into seven steps an adversary must complete - Lockheed Martin. MITRE ATT&CK catalogues what attackers do at each stage; its current release, version 20.1, came out on 13 October 2026, replacing version 19.2 from April - MITRE ATT&CK versions. Section 4 shows how much more often postings name ATT&CK than the other two.

The models are scaffolding. The analysis itself is clustering (are two incidents the same actor?), attribution (who is that actor, and how sure are we?) and assessment (what does it mean for the reader?). The hardest discipline is resisting the attractive story: two campaigns that share a malware family may share a seller, not an operator.

Dissemination and feedback

The same finding usually ships as several products: indicators to the machine, a technique write-up to the hunters, a short judgment to leadership. Then the loop needs a return path, and that is where the industry is weakest: 49% of organizations in the SANS 2026 survey do not systematically gather feedback on their intelligence, and 57% do not track their programme's maturity over time - SANS Institute. An analyst who asks "did this change anything?" after every product, and writes the answer down, is doing something most teams do not.

One week of the cycle, worked through

An illustrative week at that mid-sized software company, built on real figures about how intrusions unfold:

On Monday a vendor advisory reports active exploitation of a remote-access appliance the company runs. Speed matters because exploits are the most common way in: in Mandiant's M-Trends 2026 report, published on 23 March 2026, they were the leading initial infection vector for the sixth consecutive year, at 32% of intrusions, and the median time between an initial access event and its hand-off to a second threat group fell from more than 8 hours in 2022 to 22 seconds in 2025 - Google Cloud, M-Trends 2026. The analyst confirms with the infrastructure team which appliances are exposed and whether they are patched (requirement one, answered in hours).

On Tuesday the analyst gathers the advisory's indicators, the vendor's technical details and two community write-ups into the team's platform, drops duplicates, and tags each indicator with its source and age, because an address an attacker used last spring may belong to someone innocent today.

On Wednesday the analyst writes a hunting hypothesis for the SOC: if the appliance was exploited before patching, its logs should show unusual administrative sessions and new outbound connections from the appliance itself. The same report notes a global median dwell time of 14 days in 2025, up from 11, and 122 days for espionage cases, which argues for hunting back weeks rather than days.

On Thursday comes a three-paragraph assessment for the CISO: what is happening, whether the company is exposed, what was done, what remains, how confident the team is and what would change that. Section 7 shows how to write it.

On Friday the analyst asks the SOC whether the hunt found anything and whether the indicators raised false alarms, and records both answers. That last step is the one most teams skip.

4. What 182 threat research postings ask for

The table gathers the counts that matter most for a learning plan. Required and preferred mentions are counted alike, once per posting.

Seniority: a field without a ground floor

Only 2 postings carried an intern title (Palo Alto Networks' PhD research pipeline in California and Illumio's security research internship) and only 2 an associate or level-one title ( Cobalt's associate security researcher and Sophos's Threat Analyst 1). Another 61 had no level word, 51 were senior, 46 were staff, principal or lead roles and 20 were managers, directors or heads of research. More than a third of the sample sits at staff level or above, because much of this work rewards knowledge of specific adversaries or codebases that takes years to build.

Of the 182, 130 state a minimum number of years. Their median is five, 77 ask for five or more, 13 ask for eight or more, and 15 accept two or fewer. The chart shows how the asks spread by the level the title names.

The untitled middle is where newcomers should look: 27% of those postings accept two years or fewer and their median ask is three. A "senior" title usually means five: 62% of senior postings ask for five or six years.

Frameworks: ATT&CK everywhere, the intelligence models where analysis is the product

MITRE ATT&CK appears in 47 postings (26%), spread across every kind of work. The classic intelligence models are rarer and concentrated. Among the 34 core intelligence postings (technical, strategic and advisory), ATT&CK appears in 13, the Diamond Model in 6, the kill chain in 5, the intelligence cycle in 6, structured analytic techniques or confidence language in 8, requirements or requests for information in 5, and STIX or TAXII in only 2. Outside those 34 postings the Diamond Model does not appear at all except once in a fraud role. Two Dragos postings show what the analytic ones value: "strong technical and strategic writing skills for developing CTI analysis products, including confidence-based assessments and threat modeling frameworks (such as Diamond Model of Intrusion Analysis)".

Tools: rarely named, and almost never the reason someone is hired

Tool names are scarce. IDA and Ghidra appear in the same 16 postings (9%), always together, with Binary Ninja in 7. YARA is named in 21, Suricata or Snort in 15, packet capture tools in 15, Sigma in 13 and sandboxes in 11. Threat intelligence platforms appear in 9, the Synapse analysis platform in 4 (two of them at Dragos), VirusTotal in 3, Maltego in 3 and MISP in 1. No employer other than Recorded Future named Recorded Future, and nobody named OpenCTI. The pattern says what employers are buying: the method and the programming languages, with any particular console expected to be learned on the job.

Languages: Python first, then the language of the target

Python appears in 112 postings (62%), SQL in 48, C or C++ in 34, Go in 33, PowerShell in 21, Rust in 15, assembly in 12 and KQL in 12. The mix depends on the work, as the chart below shows: detection researchers and malware or vulnerability researchers are programmers first, while strategic and fraud analysts are asked for Python less often and for writing and open-source research more.

"Intelligence methods" here means the posting names the Diamond Model, the kill chain, the intelligence cycle, STIX or TAXII, structured analytic techniques or confidence language, or intelligence requirements. Read across the chart and the field divides roughly into analysts who are expected to write and judge, and researchers who are expected to build and publish.

Spoken languages, clearances and degrees

Fifteen postings (8%) asked for a language other than English, and they split in two. Six wanted it for reading adversaries: Recorded Future required Russian for its US dark web role and preferred Mandarin, Arabic, Turkish or Farsi in London; Check Point called Russian, Spanish, Portuguese or Mandarin a "big plus"; Anthropic wanted Mandarin or Russian for its model exploitation team; ID.me and Roblox asked for a language relevant to the communities they watch. The other nine wanted it for clients or colleagues: Japanese at Tanium and Sophos, Arabic for a CrowdStrike seat serving a client in Riyadh, Arabic or Spanish for Unit 42's regional clients from Dubai, Hebrew at Wiz and Nebius, and Mandarin for two seats in Taiwan.

Twenty postings (11%) named a security clearance: nine vulnerability research roles at Two Six Technologies (some at Top Secret with a polygraph), four AI threat roles at Anthropic that ask for an active Top Secret clearance, two each at SpaceX and Trellix, and one each at Anduril Industries, OpenAI and Dragos (a Singapore role for citizens holding a clearance). Only 7 postings named government, military, intelligence or law enforcement experience itself, two of them accepting "equivalent military experience" in place of a degree, but 27 described working with law enforcement, government partners or sharing groups. Every cleared security role on the board, grouped by the clearance level it names, is on the cleared roles page.

Degrees come up in a minority of postings: 70 mention one at all, many of them adding "or equivalent experience" or similar wording. Twelve mention a PhD: seven Palo Alto Networks research roles, two Elliptic analyst seats, one Two Six Technologies researcher and two Anthropic roles on chemical and biological misuse, where scientific training is the point.

Countries and the remote share

Of the 182 postings, 79 were in or open to the United States, 36 were in Israel (12 of them at Palo Alto Networks, 5 each at Wiz and Check Point), 17 in India and the rest scattered across Canada, the UK, Australia, Taiwan and Europe, with some naming no country at all. Fifty-nine (32%) were listed as remote, ranging from 70% of hunting roles to 9% of detection research roles. The remote threat intelligence jobs page recounts the remote roles every hour.

5. A learning order where each skill feeds the next

The order below follows the three customers from section 1. Each step makes the next one usable, and the first three serve every kind of threat work.

Step 1: how intrusions actually happen

Before studying adversaries, learn their terrain: how Windows authentication and Active Directory work, how Linux services and permissions work, what DNS, TLS and HTTP look like on the wire, and how cloud identity and access keys work. Then read ATT&CK with that knowledge, one tactic at a time, asking for each technique what log would record it. Cloud appears in 48% of the postings, so give cloud audit trails the same attention as endpoints. If you come from a SOC this step is mostly done; if not, the SOC analyst guide explains the logging foundations in depth.

Step 2: analytic method

Learn the cycle from section 3, and practise the habits behind it: writing a requirement before collecting, grading each source's reliability and each claim's credibility, stating assumptions, considering a second hypothesis before settling on the first. ICD 203, the US intelligence community's standard, runs to a few public pages, and its nine tradecraft standards are a checklist for every product you write - ICD 203. Section 7 turns them into practice.

Step 3: Python and SQL for evidence

With Python in 62% of postings and SQL in 26%, scripting is not optional. The useful level is modest: pull data from an API, parse a messy feed, join two datasets, cluster indicators, and produce a table someone can check. Aim to automate the second time you do anything by hand. Detection, malware and AI research postings want more (production-quality code, in Anthropic's phrasing for its threat intelligence engineer), but the analyst who can query her own data is already ahead of one who waits for someone else to do it.

Step 4: infrastructure pivoting

Attackers reuse things: registrars, hosting providers, TLS certificate patterns, server configurations, naming habits. Learning to move from one known domain or address to the infrastructure around it is the core technical skill of tracking work. Anthropic's posting lists "passive DNS, certificate pivoting, netflow" as analysis it expects the hire to do personally; Palo Alto Networks' Unit 42 researcher is asked to map command-and-control infrastructure through "pivot analysis across closed and open-source datasets". Practise on infrastructure named in public reports: start from one indicator and document every step that led you to the next, including the dead ends.

Step 5: malware triage, then reverse engineering if you want the technical track

Every analyst should be able to triage a sample safely: identify the file type, extract strings and configuration, run it in an isolated sandbox, and recognize what the sandbox missed. Those who want the malware or vulnerability track go further into assembly, a disassembler (IDA and Ghidra are named together in 16 postings) and a debugger. GIAC's reverse-engineering exam objectives make a good syllabus even if you never sit it: static analysis, behavioural analysis, Windows assembly, unpacking, anti-analysis tricks, .NET programs, malicious documents and script-based malware - GIAC GREM.

Step 6: turning findings into detection

Writing detections appears in 44% of postings, so learn at least one format for each layer: YARA for files, Sigma for logs, Suricata or Snort for network traffic. YARA is "a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples" - YARA; Sigma is "a generic and open signature format" for log events - SigmaHQ. A first YARA rule shows the shape. The rule below is a teaching example: its strings are invented, and a real rule is built from the sample you analyzed.

rule Example_Loader_Config_Markers
{
    meta:
        description = "Teaching example: PE files carrying two config markers and one byte sequence"
        reference = "your own analysis notes"
    strings:
        $cfg1 = "cfg_sleep=" ascii wide
        $cfg2 = "cfg_host=" ascii wide
        $seq  = { 8B 45 ?? 33 C9 }
    condition:
        uint16(0) == 0x5A4D and filesize < 2MB and all of ($cfg*) and $seq
}

The condition checks for the "MZ" header that Windows executables start with, keeps the rule away from large files, and requires both marker strings plus a short byte sequence with one wildcard byte. The craft lies in choosing strings that survive the next version of the malware but never appear in legitimate software, then testing the rule against a clean collection to count its false positives.

Step 7: writing and briefing

Four postings in five (144 of 182) name report writing, briefing, public research or written communication in some form, and section 7 is about this skill alone. Start early: write up every exercise in steps 3 to 6 as if someone else had to act on it.

Step 8: a specialty that makes you the obvious hire

Postings reward depth in one domain: cloud (48% mention it), identity, industrial control systems (14 postings name ICS or OT), cryptocurrency (8), email and phishing, supply-chain malware, a region's actors and language, or AI systems. Pick one by the second year and publish on it.

6. Routes in: SOC, service, newsroom, fraud desk and home lab

The postings name their feeder jobs openly. Check Point's senior researcher wants five years "as a threat researcher, incident responder, malware analyst, detection engineer or other relevant roles"; Abnormal Security accepts four years "in threat intelligence, SOC operations, or a closely related cybersecurity discipline"; Trend Micro's future threat research team wants six years in offensive security or in threat investigation and hunting, with real exposure to both. The routes below are ordered roughly by how many seats in the sample they lead to.

From the SOC and incident response

The most common route, and the most direct. A SOC analyst already reads the telemetry that hunters and detection researchers use, and an incident responder has seen real adversaries up close. Sophos's Threat Analyst postings ask for two years in a SOC; Huntress's senior detection and hunting analyst asks for two years in detection engineering, hunting or a related field. The move is easiest from inside: own the team's intelligence feed, write the hunting hypotheses after each incident, and turn your best investigations into write-ups. Two years of that is a threat analyst's résumé. How to win that first operations seat is laid out in our walkthrough for aspiring SOC analysts.

From military, government and law enforcement intelligence

Veterans and former government analysts bring exactly what the rarest postings want: tradecraft, discipline with sources, and often a clearance. Trellix's cleared intelligence analyst at Fort Belvoir asks for five years of "intelligence gathering, analysis, and reporting experience within military or defense environments"; Canonical's threat intelligence lead accepts experience in "government/military signal intelligence departments"; CoreWeave's insider threat investigator asks for eight years in federal law enforcement, counterintelligence or similar work. Two obstacles are common. Classified work cannot be shown, so write unclassified samples on public campaigns to prove you can do it in the open. And commercial telemetry differs from government systems, so learn the cloud and endpoint data from section 5 before interviewing. Unit 42's advisory role naming ICD 203 shows how directly the tradecraft transfers.

From journalism, international relations and area studies

The door for strong researchers without a security job is narrower but real. Strategic and advisory roles and fraud, abuse and insider investigations together hold 28 postings, the AI labs' misuse investigators add a handful more, and they ask for what a good journalist or regional specialist already has: open-source research, source evaluation, clear writing, sometimes a language. Check Point's strategic researcher needs three years in threat intelligence and "strong WEBINT research and virtual HUMINT operations skills"; Recorded Future's US analyst needs Russian and operational security for working dark web sources, and accepts a degree in international relations, security studies, regional studies or criminology. The gap to close is technical. Twelve of the 20 fraud and insider postings name Python or SQL, so learn both well enough to answer your own questions with data, and learn enough networking and malware triage (steps 1 and 5) to follow a technical report.

From the fraud desk and the investigation team

Fraud analysts, anti-money-laundering investigators and trust and safety specialists already practise intelligence: they track networks of bad actors, follow money and infrastructure, and build cases that must hold up later. TRM Labs, Elliptic, Roblox, Reddit and Discord hire into intelligence titles from these backgrounds, and a year on such a team is also the usual bridge for the researchers above. Elliptic's terrorism-financing analyst can use "Python, SQL, or AI-assisted querying" on blockchain data, a fair summary of the technical bar there.

From the home lab and public research

Malware and vulnerability research is the one corner where public work can substitute for job history. OPSWAT's malware researcher posting asks for "Certifications or public work (GREM, OSCP, conference talks, published research)"; Qualys's senior researcher lists "CVEs, security advisories, open-source security tooling, or published research". Cobalt's associate security researcher (one to three years of hands-on experience, $60,000 to $80,000) promises to mentor the hire "into a full-scale Security Researcher". A disclosed vulnerability, a well-documented analysis of a malware family or a tool other analysts use carries more weight with these employers than any course. Testers who already break systems for clients often cross over here, and the penetration tester's own path is written up separately.

From software engineering and data work

Detection research and intelligence engineering hire developers who learn security. Anthropic's threat intelligence engineer must write production-quality Python and build data pipelines without handing requirements to someone else; Coinbase's senior threat intelligence engineer must automate the tracking of threats and present findings to executives. An engineer who learns steps 1, 4 and 6 is a strong candidate for these seats.

The evidence that persuades

Whatever the route, four kinds of proof recur in what the postings value:

1. Two or three published analyses of real campaigns, built from public reporting and your own pivoting, each with a stated confidence and the evidence behind it.
2. Detection content (YARA, Sigma or Suricata rules) in a public repository, each tied to the technique it catches and tested against clean data.
3. A small tool that automates something analysts do repeatedly, such as enriching indicators or clustering infrastructure.
4. A specialty visible in all of the above: one region, one sector, one platform or one malware family.

Then make the application match. The cybersecurity résumé guide shows how to present research and lab work so a screener sees it, and the interview questions guide covers the analysis exercises interview loops use; you can rehearse them in interview practice. Students should watch the internships page, where research internships like Illumio's appear. If you are still choosing a specialty, the career paths guide sets threat intelligence beside the other nine.

7. Writing for people who decide

Writing appears across the sample in several forms: 83 postings mention public research, 78 written communication, 67 briefing or presenting, 50 reports or assessments and 41 executives or decision makers as an audience. In the core intelligence group the share is higher still: 22 of 34 mention public research and 18 of 34 written communication. Palo Alto Networks wants its advisory consultant to tailor messaging "for audiences ranging from highly technical analysts to executive leadership"; Coinbase wants analysis turned into "clear, actionable intelligence briefs for both technical and executive audiences"; ESET wants "concise, actionable reports".

What executives actually ask for

The SANS 2026 survey asked executives what intelligence they want in the next year. At the top were vulnerabilities being actively targeted (79%) and specific adversary techniques (77%); business-focused intelligence came last at 41%. The same survey found that 45% of organizations use AI in their intelligence work, mainly for summarizing data and writing reports - SANS Institute. Leaders want to know what is being exploited and whether it touches them, not a tour of the threat landscape, and as drafting is automated the human value lies in judgment and precision rather than volume.

The standards that make a judgment checkable

ICD 203 asks every product to describe its sources' quality, express uncertainty properly, separate information from assumptions and judgments, consider alternatives, show relevance to the customer, use clear argument, explain changes from previous judgments, make accurate judgments and use visuals where they help. It also asks for "a clear main analytic message up front", which in practice means the conclusion goes in the first sentence - ICD 203.

Uncertainty needs a fixed vocabulary, or "likely" means 55% to one reader and 90% to another. Two scales are in common use.

The ICD 203 ranges come from its table of likelihood expressions; the FIRST ranges come from its curriculum on communicating uncertainty, which is based on NATO terms and notes that the percentages show how the terms relate rather than a measured probability - FIRST, uncertainty in CTI reporting. Both make the same rule about confidence, which describes the quality of your evidence rather than the chance of an event: never put a confidence level and a likelihood in the same sentence. Pick one scale, state it in your team's style guide and use it every time.

A paragraph, rewritten

Here is a weak opening of the kind analysts write early on, about an imaginary campaign:

Recent reporting from multiple sources indicates that a sophisticated threat actor may be targeting organizations in our sector using a variety of techniques, including exploitation of edge devices, which could potentially pose a risk to our environment.

It hedges four times, names nothing and asks for no decision. Here is the same content written to the standards above:

A financially motivated group is likely exploiting the authentication flaw in the remote-access appliance we run at two sites, based on three vendor reports and one government advisory published this week. Both of our appliances were patched on Tuesday. We have moderate confidence that neither was compromised before the patch: a hunt through 30 days of logs found no sign of exploitation, but one site keeps only 14 days of appliance logs. We recommend extending retention to 90 days; the network team estimates two days of work.

The second version leads with the judgment, gives a likelihood in one sentence and a confidence level in another, names its sources, says what was done, states the gap that limits confidence and ends with a decision the reader can make. It is also shorter.

Products by audience

Most teams settle on a few formats: a flash alert that answers "what happened, does it touch us, what do we do" within hours; an indicator package for machines, each item carrying its source, first-seen date and expiry; an actor or campaign profile for hunters, written in ATT&CK terms with example queries; and an assessment for leaders, shaped like the paragraph above. Vendors add public research: Endor Labs asks its researchers to "author and publish external-facing content" on malicious packages, and Elastic's researchers publish on its security research site. At a vendor that is part of the job, because it is how the company earns trust; in-house it is usually a bonus.

8. Threat intelligence certifications, and how often postings name none

The plainest finding in the sample: 157 of the 182 postings (86%) name no certification at all. Across all 2,155 security postings the board read on 11 November 2026, 26.3% named at least one certification, and the CISSP alone appeared in 16.8% - certifications page. Threat research postings name certifications about half as often as the security market as a whole, and the CISSP a third as often.

Beyond the chart, GIAC's open-source intelligence certification (GOSI) appeared in 2 postings, the CEH in 1, and the CTIA, a threat intelligence analyst certification, in none. Even the GCTI, built for this work, was named in only 2 of the 34 core intelligence postings (Palo Alto Networks' Unit 42 advisory role and Abnormal Security); its other four mentions came from fraud, hunting and detection roles. By kind of work, vulnerability researchers' postings named certifications most (7 of 32, mostly the OSCP), then hunters (5 of 20); not one of the 19 AI threat research postings named any, asking for demonstrated work instead.

The two specialist exams in detail

GIAC GCTI. An 82-question, three-hour proctored exam with a 71% passing score. Its nine objectives read like this guide's section 3: intelligence fundamentals; analysis; campaigns and attribution; collecting and storing data sets; intelligence application; the kill chain, Diamond Model and courses of action matrix; malware as a collection source; pivoting; and sharing - GIAC GCTI. The page lists no price.

GIAC GREM. A 66-question, three-hour exam with a 73% passing score for versions released since 27 August 2022, covering the 13 reverse-engineering topics listed in section 5 - GIAC GREM. It is the only certification any malware posting named (2 of 11, at OPSWAT and Endor Labs), and OPSWAT lists it next to public research as equivalent evidence.

A sensible order

For a newcomer, the certifications are worth less than the portfolio in section 6, since six postings in seven name none. If you need a credential to get past a résumé filter for a first SOC job, the Security+ and SOC route is the place to spend it. Once in security, the GCTI suits analysts and the GREM suits malware researchers, ideally paid for by an employer; the OSCP suits vulnerability researchers coming from offensive work. The CISSP, named in 11 postings, 8 of them senior, staff or management seats, can wait: it requires five years of cumulative full-time experience in two or more of its eight domains, and someone who passes earlier becomes an Associate of ISC2 with six years to earn them - ISC2. The GIAC page and the OSCP page recount where each is named across every open security role.

9. Threat intelligence analyst salary by level and kind of work

Start with the widest yardstick. The nearest government category is information security analysts, a broader group whose median pay was $129,180 in May 2025, by the Bureau of Labor Statistics' count; a tenth of them were paid less than $75,090 and a tenth more than $199,850. The group held 192,900 jobs in 2025, and the agency expects it to grow 21% by 2035, opening about 14,100 positions a year - BLS, information security analysts profile.

Threat research postings pay well above that, largely because of who employs them. Across the 72 US postings in the sample that printed a salary range, from 34 employers, the median range ran from $163,200 to $229,000, with a median midpoint of $196,797. The board's live figures for the threat intelligence and research specialty right now: a middle of $190k/yr, within a typical span of $157k/yr to $278k/yr. The threat intelligence analyst salary page breaks that down by level, workplace, employer kind and employer, and recounts it every hour.

Pay by the work the hire does

AI labs pay so differently that they distort every average they enter, so the chart shows them as their own bar.

Outside the AI labs, the kinds of work pay within about $30,000 of each other at the midpoint, from $169,770 for fraud and insider investigations to $198,500 for malware analysis (hunting and malware rest on only four ranges each, so treat them as indications). The nine AI lab postings had a median midpoint of $365,200: Anthropic's two threat intelligence managers stated $375,000 to $455,000, OpenAI's technical threat investigator $347,000 to $510,000 and Anthropic's threat intelligence engineer $320,000 to $405,000.

By level

Excluding the AI labs, pay climbs with the level in the title, as the table shows.

The two interns were paid at very different scales: Illumio's at $37 an hour, Palo Alto Networks' PhD intern at an annualized $129,100 to $208,825. The step from senior to staff or principal adds about $40,000 at the midpoint, nearly twice the step from an untitled seat to a senior one: the field pays most for depth that takes years to build. Management pays no more than the senior technical track here; the career paths guide discusses that choice.

Analyst titles, one by one

Titles containing "analyst" were paid less than "researcher" or "engineer" titles: the 11 US analyst-titled ranges had a median midpoint of $161,250, against $193,150 for 43 researcher titles outside the labs. Every open role carrying the analyst title is listed, with its stated pay, on the threat intelligence analyst jobs page, and the researcher titles on the security researcher jobs page.

(SpaceX posted the same range for a second insider threat analyst seat.)

Location and remote work

Remote work carried no discount: US remote postings had a median midpoint of $196,285 and on-site or hybrid ones $197,309. Location within a company mattered more. Two Six Technologies posted the same titles in Ohio and in the Washington area: its senior vulnerability researcher stated $117,235 to $175,492 in Dayton and $128,873 to $193,310 in Arlington, its lead researcher $117,235 to $210,058 in Dayton and $154,257 to $231,386 in Arlington.

Outside the US, most postings print no salary. Sophos's Canadian threat analyst postings are an exception that shows a ladder: CA$66,000 to CA$110,000 at level 2, CA$76,000 to CA$126,000 at level 3 and CA$86,000 to CA$143,000 for a senior analyst. Elsewhere, the salary calculator sets an offer beside what postings of the same specialty and seniority state.

10. AI as a target and as a tool

Two separate changes are happening at once, and the postings show both.

AI as the target

Nineteen postings (10%) are AI threat research, and they are the best-paid group in the sample. They come in two forms. At the labs, investigators study how people misuse the models. OpenAI's technical threat investigator conducts "end-to-end investigations into sophisticated threat actors interacting with OpenAI's models, products, and broader ecosystem"; Anthropic's model exploitation team works on distillation, unauthorized access, account farming, reseller abuse and fraud. Four of Anthropic's five threat roles ask for an active Top Secret clearance. At security companies, researchers attack AI systems to defend them: Check Point's AI security posting opens with "Everyone is racing to build on AI. Far fewer people are pulling it apart to see how it breaks"; SentinelOne researches prompt injection, jailbreaking and data exfiltration through models and agents; Vectra AI studies how agents and copilots and their identities "can be misused or compromised". Twelve more postings outside this group mention AI systems as something to defend.

Google's Threat Intelligence Group reported in February 2026 that state-backed actors from North Korea, Iran, China and Russia used its Gemini model for research, targeting and phishing lures, and that a downloader it named HONESTCUE asks Gemini's API for C# code to compile in memory, yet it had "not yet observed APT or information operations (IO) actors achieving breakthrough capabilities that fundamentally alter the threat landscape" - Google Threat Intelligence Group, 12 February 2026. Anthropic's September 2026 report, covering activity it disrupted from December 2025 to August 2026 across seven harm areas, put its cyber finding in one heading: "Sophisticated attacks no longer require sophisticated attackers" - Anthropic, September 2026. Read side by side, the two reports describe a technology that so far lowers the cost and skill an attack needs rather than handing anyone a breakthrough, which is exactly the kind of judgment a threat analyst is paid to make and keep revisiting. Open seats protecting or investigating AI, in any specialty, are gathered on the AI security roles page.

AI as the tool

About 50 postings (27%) expect the hire to use AI in the work itself, and the striking thing is how they phrase it. TRM Labs' cyber threat response advisor must already be "building AI-assisted or agentic workflows" and be able "to show how you validate their outputs and where they fail". Recorded Future wants analysts who use AI to automate "busy work" while "maintaining the rigorous human-in-the-loop required to ensure high-fidelity, verified intelligence". Abnormal Security asks for "appropriate human review and validation to ensure AI-assisted work is accurate, well-sourced, and analytically sound". GitLab's threat research engineers will "build agentic workflows for research, analysis, and detection".

Reasoned from first principles, the effect is predictable. Intelligence work has always had a bulk part and a judgment part. Collecting, translating, summarizing and drafting took most of the hours, and that is what language models now do quickly and cheaply; SANS found that summarizing data and writing reports are the main uses of AI in intelligence teams today. The judgment part is unchanged: deciding which sources to trust, noticing that two reports are really one, working out what a finding means for one organization, and signing the conclusion. As the bulk part gets cheaper, an analyst's value moves to the judgment part. For a newcomer this cuts both ways. Fewer hours go into the summarizing that juniors once learned on, so the first rung is thinner; but an analyst who can run a model across a hundred reports, check its output against the sources and catch its mistakes covers far more ground than one reading by hand, and the postings ask for that person in so many words.

So use AI tools in your portfolio work and document how you checked them: an analysis that says "a model summarized 40 reports; I verified each claim against its source and found three errors, listed here" shows exactly the skill TRM Labs and Abnormal Security describe.

11. Threat intelligence career questions, answered

How many years until a first threat intelligence analyst job?

Two to five years of security work, in most cases. Of the 182 postings read on 12 November 2026, the median minimum was five years, a quarter of the untitled mid-level postings accepted two years or fewer, and only 4 carried an intern or associate title. The fastest realistic path is one to three years in a SOC, incident response, a fraud investigation team or a government intelligence role, while building the published analyses described in section 6.

Can you become a threat intelligence analyst with no experience?

Rarely straight away. Entry titles were 2% of the sample, and the exceptions were specific: Cobalt's associate security researcher, Sophos's level-one threat analyst (which still asks for two years in a SOC) and research internships for students. Without experience, the realistic plan is to get a SOC, IT or fraud job first and to start publishing analyses and detection rules alongside it, so that the first threat role sees evidence rather than a course list.

What does a cyber threat intelligence analyst do every day?

It depends on who reads the work. For machines, the analyst collects and vets indicators; for defenders, tracks adversaries and writes up their techniques; for leaders, answers questions in short, sourced assessments. A typical week mixes triaging new reporting, pivoting on infrastructure, checking exposure with other teams, writing for several audiences and asking whether earlier products changed anything.

How much does a threat intelligence analyst make?

In the US, the 72 threat research postings with a published range had a median midpoint of $196,797; analyst-titled postings alone came to $161,250, starting around $85,000 to $110,000 for the lowest-paid seats. AI labs paid far more, a median midpoint of $365,200 across nine postings. For comparison, the BLS put the median for the wider information security analyst group at $129,180 in May 2025.

What is the difference between a threat intelligence analyst and a threat hunter?

An intelligence analyst studies adversaries, mostly from outside the organization's data (reports, infrastructure, malware, forums), and tells others what to look for. A hunter searches the organization's own data for adversaries the alerts missed, often starting from the analyst's leads. In the sample, hunting postings named ATT&CK in 12 of 20 and SQL in 11, and only 4 asked for public research; intelligence postings asked for writing and research far more often.

Do threat intelligence analysts need to code?

Most do, at least at a scripting level. Python appeared in 62% of the sample and SQL in 26%. Detection researchers (80% naming Python) and malware and vulnerability researchers (70%) need real programming; strategic and fraud analysts need enough to query and analyze data themselves.

Which certification is best for threat intelligence?

None is required by most employers: 86% of the postings named no certification. Where one is named, GIAC certifications lead (11% of postings), with the GCTI and the GREM each named in 6 postings (the GCTI in just 2 of the 34 core intelligence postings) and the OSCP named mostly for vulnerability research. A portfolio of published analyses and detection rules counts for more with the employers in this sample.

Is a security clearance required for threat intelligence work?

Only in a minority of seats. Twenty of the 182 postings (11%) named a clearance, concentrated at defense contractors (nine at Two Six Technologies), AI labs (four at Anthropic) and government-facing roles. Where a posting does ask, it is usually firm (an active Top Secret clearance at Anthropic, Top Secret/SCI with a polygraph for some Two Six seats), which is where veterans and former government analysts hold a real advantage.

Is a degree in international relations useful for cyber threat intelligence?

Useful for strategic, regional and abuse-focused roles, especially with a language. Two postings named such degrees outright (Recorded Future listed international relations, security studies, regional studies and criminology; PlayStation listed intelligence studies and political science), and six asked for a language to read adversaries, among them Russian, Mandarin, Arabic, Farsi, Turkish and Spanish. On its own it is not enough. Pair it with SQL, Python, networking basics and malware triage, and consider fraud, trust and safety or a SOC as the first job.

How do I become a malware analyst?

Learn Windows internals, assembly and a disassembler, analyze samples safely in an isolated lab, and publish what you find with YARA rules attached. Malware postings in the sample asked for a median of three years, named reverse engineering in 9 of 11 and YARA in 5, and at least one employer treated published research as equivalent to a certification. Software supply-chain research, which studies malicious open-source packages, is a newer branch: Endor Labs, Socket and JFrog were all hiring for it.

Counts in this guide come from postings read on 12 November 2026, and outside figures from the pages linked beside them. Exams, frameworks and hiring patterns move quickly, so confirm the current version of anything before you study for it, pay for it or sit it.