Cyber Threat Intelligence Analyst

This is a remote position.

Simulation-Based Work Experience Programme Founding Cohort

Cyber Threat Intelligence professionals rarely work with perfect information. They must determine what matters evaluate reliability understand potential threats communicate uncertainty and convert analysis into intelligence somebody can actually use.

Participants may receive threat information indicators contextual information organisational requirements and incomplete intelligence and be required to determine what it means why it matters and what should happen next
.

The responsibilities below represent the breadth of professional work available across the simulation library. Individual participants will encounter different combinations depending on the simulations they activate and may undertake simulations across other disciplines.

• Threat-information triage: You may receive multiple pieces of threat information and determine which information is relevant to the organisation and deserves further investigation.

• Source evaluation: You may assess reliability credibility and relevance of information sources and explain how those judgements affect analytical confidence.

• Threat-actor analysis: You may examine available intelligence about a threat actor and assess likely motivation capability targeting behaviour and organisational relevance.

• TTP analysis: You may analyse tactics techniques and procedures associated with malicious activity and determine their implications for defensive priorities.

• Indicator analysis: You may assess indicators of compromise within their broader context rather than treating individual indicators as conclusive evidence.

• Intelligence-gap identification: You may determine what important information is missing and define what additional intelligence would materially improve decision-making.

• Intelligence requirements: You may develop or refine intelligence requirements based on organisational priorities assets threat exposure and stakeholder needs.

• Threat prioritisation: You may compare several threats and determine which deserves greatest attention based on relevance likelihood potential impact and available evidence.

• Structured analytical reasoning: You may evaluate competing explanations or hypotheses and communicate why available evidence supports one assessment more strongly than another.

• Threat assessment: You may synthesise multiple information sources into an assessment explaining what is happening why it matters and what the organisation should consider doing.

• Confidence assessment: You may communicate the confidence associated with an intelligence judgement and identify factors limiting certainty.

• Executive communication: You may translate technical threat information into concise intelligence suitable for senior decision-makers who require implications rather than technical detail.

• Defensive recommendation: You may recommend proportionate defensive priorities based on the intelligence assessment within the remit of legitimate defensive security.

• Assessment updating: You may receive new information after an initial assessment and reconsider or revise your previous judgement.

All activities take place within simulated environments and are intended for legitimate defensive educational and professional-development purposes.

• Cyber Threat Intelligence Assessment:
  You may produce an analytical product describing the simulated threat available evidence organisational relevance analytical judgement and recommended defensive priorities.

• Threat Actor Profile:
  You may develop an assessment of a simulated threat actor covering motivation capability observed behaviour targeting and organisational relevance.

• Executive Intelligence Brief:
  You may translate technical findings into business implications and decision-relevant recommendations for senior stakeholders.

• Intelligence Requirements Document:
  You may define priority intelligence questions and specify information required to support organisational decision-making.

• TTP Assessment:
  You may analyse relevant simulated adversary behaviours and explain their implications for organisational defensive priorities.

• Indicator Assessment:
  You may produce a contextual evaluation of supplied indicators and explain their evidential significance rather than merely listing technical indicators.

• Analytical Confidence Statement:
  You may document confidence associated with an assessment…