SOC Threat Intelligence Analyst

Threat Intelligence Analyst – SOC Team

Role Summary

The Threat Intelligence Analyst is responsible for collecting, analysing, and operationalizing cyber threat intelligence to support the SOC’s detection, response, and defensive strategy. This role transforms raw intelligence into actionable insights that help the organization anticipate, detect, and mitigate cyber threats.

Key Responsibilities

Monitor and analyse threat intelligence sources (open-source, commercial feeds, ISACs, dark web, social media, malware repositories) to identify emerging threats relevant to the organization.

Produce actionable intelligence reports for SOC analysts, incident responders, and leadership, including indicators of compromise (IOCs), threat actor profiles, and attack trends.

Enrich SOC alerts and investigations by correlating events with threat intelligence to improve detection accuracy and reduce false positives.

Track threat actors, TTPs, and campaigns using frameworks such as MITRE ATT&CK, Diamond Model, and Cyber Kill Chain.

Collaborate with SOC, Incident Response, and Vulnerability Management teams to prioritize risks and support remediation efforts.

Develop and maintain threat intelligence platforms (TIPs) and integrate intelligence into SIEM/SOAR tools.

Conduct malware triage and basic reverse engineering to extract IOCs and understand behaviour (depending on seniority).

Support threat hunting activities by providing hypotheses, intelligence-led hunt packages, and adversary emulation insights.

Create and maintain intelligence requirements (PIRs) aligned with business and security priorities.

Participate in tabletop exercises and incident post-mortems to refine intelligence processes and improve detection capabilities.

Required Skills & Qualifications

Strong understanding of cybersecurity fundamentals, including network protocols, operating systems, and common attack vectors.

Experience with SIEM tools (CrowdStrike, Sentinel) and TIP platforms (MISP, Anomaly, Recorded Future, etc.).

Familiarity with MITRE ATT&CK, STIX/TAXII, YARA, and IOC formats.

Ability to analyse and interpret malware behaviour, threat actor TTPs, and intrusion patterns.

Strong analytical and writing skills for producing clear, concise intelligence reports.

Experience with scripting languages (Python, PowerShell) is a plus.

Certifications such as GCTI, CTIA, CEH, Security+, CySA+, GCIA, GCFA are beneficial.

Preferred Experience

Prior work in a SOC, CERT, CSIRT, or threat intelligence team.

Exposure to dark web monitoring, OSINT investigations, or cybercrime research.

Experience with cloud security (Azure, AWS, GCP) and cloud-native threat intelligence.

Knowledge of APT groups, geopolitical threat landscapes, and industry-specific risks.

Soft Skills

Ability to communicate complex technical topics to non-technical stakeholders.

Strong critical thinking and pattern recognition.

Curiosity-driven mindset and passion for tracking adversaries.

Ability to work under pressure during active incidents.