Threat intelligence analyst also known as “cyber intelligence analyst,” is an information security professional who defend his/her organization from activities of cyber criminals such as hackers and malicious software developers using advance cyber defense techniques in the areas of network security engineering, vulnerability management and continuous security event monitoring. As a starting point, threat intelligence analyst must understand and have adequate inventory of an organization's information technology assets/infrastructures, personnel and business operations to enable it be aware of those that present opportunities to malicious actors. Cyber threat intelligence analyst also helps to identify, assess and mitigate potential vulnerabilities or risk in an organization's information assets/infrastructure that enable business operations in readiness to cyber threat defense. Beyond vulnerability identification and assessment, threats and threat agents/sources are identified to ensure holistic mitigation and treatment plan.
Threat source analysis, digital forensics, offensive security defense techniques to identify, assess, counter and monitor threats posed by cyber criminals against an organization's information systems, critical technology infrastructure and related interests are some of the core duties of a cyber threat intelligence analyst. They apply some scientific and technical methods/models in deciphering complex intelligence putting into consideration the architecture of the respective systems in scope of their activities. Their assessment reports and intel are sent to senior/executive management for critical business and strategic decision making. To be effective as an threat intelligence analyst, access to quick and credible intelligence is imperative. As such, it is important that threat intelligence analysts become members of professional bodies or security forums of common interest for the purpose of sharing/dissemination intelligence and threat information to its members based on incidents and threats within the industry. This could also be in form of subscription to threat intelligence platforms and real-time monitoring such as Imperva Secure Sphere Threat Radar for Web Application Filtering (WAF), McAfee Threat Intelligence Exchange, MasterCard SafetyNet (PCI rule based anti-fraud solution), VISA anti-fraud solution, Scorebridge (PCI rule based anti-fraud solution), etc., where information on threats, imminent attacks, malware, compromised card information and other malicious activities in the cyberspace that are far-reaching are updated with their threat sources (e.g. IP addresses, location information, prevailing or targeted regions and attack vectors) to enable members take necessary preventive and defensive measures to protect their organization's network or information assets/infrastructure from being attacked or compromised.
Threat intelligence analyst could report to CISO of an organization.
To be endorsed as a threat intelligence analyst, practitioners must acquire certification such as Certified Information Systems Security Professional (CISSP) by ISC2, Certified Ethical Hacker (CEH) by EC-Council, Offensive Security Certified Professional (OSCP), Global Information Assurance Certification (GIAC), Security+, among others.