Face the attacker
Threat Intelligence & Security Research
Track the groups behind attacks and turn what you learn into warnings, detections and decisions.
The job, briefly
Threat intelligence analysts and security researchers study adversaries: who is attacking, how, with what infrastructure and against which targets. They gather material from incident data, malware samples, open sources and industry sharing groups, analyze it and turn it into products others use: briefings for leadership, indicators and detection logic for the SOC, risk assessments for the business. Researchers and malware analysts take the technical side further, reverse engineering malicious code and documenting new techniques.
Day to day
- Collect and weigh material from incident data, malware sandboxes, open-source reporting, dark web monitoring and sharing groups such as ISACs
- Track threat groups, their tooling and their infrastructure over time
- Reverse engineer malware samples to pull out capabilities, configurations and indicators
- Write reports and briefings sized to the reader: one paragraph for executives, full technical detail for the SOC
- Turn findings into detections and hunting leads mapped to MITRE ATT&CK
- Answer the organization's intelligence requirements, such as which groups target its sector and what they are exploiting now
Worked examples
Brief leadership on a campaign hitting your sector
Peer companies in your industry's sharing group report intrusions through a newly disclosed flaw in a file transfer product. You confirm your company runs it, check with infrastructure that it is patched, ask the SOC to hunt for the published indicators and write a one-page brief for leadership: who is behind the campaign, what they want, your exposure, what has been done and what is still needed. You state your confidence and what would change it.
Analyze a malware sample from an incident
Responders recover an unknown executable from a compromised host. You run it in a sandbox, then open it in Ghidra to find what the sandbox missed: an encrypted configuration holding two command-and-control domains and a long sleep timer meant to outlast automated analysis. You extract the domains and the decryption routine, write a YARA rule that matches the family and share the indicators with the SOC and your sharing group.
Pivot on attacker infrastructure
Starting from one phishing domain in an alert, you look up its registration, hosting, TLS certificate and passive DNS history. The same certificate pattern shows up on a dozen other domains registered that week, several imitating your company's brand. You get them blocked before they are used, report them for takedown and document the pattern so the next batch is caught automatically.
Who does well here
Threat intelligence suits analytical people who read widely, think in hypotheses and write carefully about how confident they are. Backgrounds vary more than in most specialties: SOC analysts who prefer the investigation to the queue, military and government intelligence veterans, journalists and researchers who learned the technical side, and reverse engineers who started in software. Malware analysis needs strong low-level technical skill; strategic intelligence leans on analysis and writing.
Signs it suits you
- You read security research for pleasure and follow how campaigns develop
- You are comfortable stating how sure you are and what evidence would change your mind
- You enjoy writing for very different readers, from executives to detection engineers
- You have patience for slow, detailed analysis of code or data
Requirements
- A solid grasp of how attacks work, usually from time in a SOC, incident response or an intelligence role
- Clear analytical writing; employers often ask for a writing sample
- For malware analysis and research roles: assembly, operating system internals and reverse engineering tools such as Ghidra or IDA
Useful skills
A route in
- 1Build attack fundamentals in security operations or incident response, the most common route in
- 2Read public reporting from major security vendors and government agencies regularly, and practise boiling a technical report down to one paragraph
- 3Learn the analytic frameworks: intelligence requirements, the intelligence cycle, estimative language, ATT&CK and the Diamond Model
- 4For the technical track, work through malware analysis courses and practice samples and consider GREM; for the analytic track, GCTI is the best-known credential
- 5Publish your own analysis of a public campaign or malware sample to show your method and your writing
- 6Apply for CTI analyst roles at security vendors, large enterprises, banks and government, and for SOC roles with an intelligence component
Myths and reality
Myth: Threat intelligence is a feed of bad IP addresses.
Reality: Indicator feeds are the least valuable part. Good intelligence answers a question someone in the organization actually has, such as whether a group targeting your sector could reach you, and arrives with a confidence level and a recommendation.
Myth: It is mostly dark web hunting.
Reality: Underground forums are one source among many. Most analysis draws on your own incident data, malware, infrastructure records, vendor reporting and sharing groups, and the hard part is judgment, not access.
Myth: You can start in threat intelligence straight out of school.
Reality: A few graduate schemes and government routes exist, but most CTI analysts arrive with operations, incident response or intelligence experience. The roles are relatively few and competitive, so plan on building that base first.
Salary
Salary ranges on open threat intel & research roles currently center on $150k–$278k/yr. The median sits at $193000, measured over the 55 openings that publish a range.
Questions career changers ask
Is a clearance required for intelligence analyst jobs?
For government and many defense contractor roles, yes, and the employer sponsors it. Commercial roles at security vendors, banks and technology companies usually do not require one, though prior government intelligence experience is valued there too.
What is the difference between strategic, operational and tactical intelligence?
Strategic intelligence informs leadership decisions: trends, threats to the business, risk. Operational intelligence describes specific campaigns and adversaries: who, how and when. Tactical intelligence feeds defenders directly with indicators, detection logic and techniques. Most analysts work across all three, but roles tend to lean toward one.
How technical do I need to be?
It depends on the track. Strategic analysts must understand attacks well enough to judge reporting, but they write more than they code. Malware analysts and researchers need reverse engineering, assembly and scripting. Start from your strengths and build the other side over time.
Is intelligence work different at a security vendor?
Yes. Vendor researchers often publish (blog posts, conference talks, reports that also serve marketing) and see attacks across many customers. In-house teams concentrate on one organization's threats and work closely with its SOC and leadership. Both feed security operations through the detections they produce.
Neighboring paths
Security Operations & Incident Response
Work the alert queue, separate real intrusions from noise, and lead the response when one is real.
Penetration Testing & Red Team
Break into systems with written permission, then show the owners exactly how and what to fix.
Security Leadership
Lead security teams and programs, set priorities and budgets, and answer for risk to executives and the board.