Career path
Threat Intelligence
What people in this area work on
Threat intelligence is information about threats that has been collected, checked, and analyzed so people can make decisions with it. Analysts study attack campaigns, the groups behind them, and the techniques those groups use.
Much of the work is reading reports from security companies, government agencies, and researchers, comparing their claims, and judging how reliable each source is. Good analysts state how confident they are in each conclusion and keep verified facts separate from claims.
The results are usually written: briefings, reports, and recommendations shaped around what a specific organization needs to know.
Terms used on this page
- Campaign
- A series of related attacks that share goals, methods, or infrastructure.
- Phishing
- Messages designed to trick people into sharing information, sending money, or opening something harmful.
- Confidence level
- A statement of how strongly the evidence supports a conclusion, often described as low, moderate, or high.
- Tactics, techniques, and procedures (TTPs)
- The patterns of behavior attackers use to reach their goals.
- Intelligence brief
- A short report that explains a threat and what to do about it.
How the work flows
One piece of work, start to finish. Every step below is something you can practise in the starter project.
- CollectGather public reporting with dates
- VerifyCompare sources against each other
- AssessState confidence in each conclusion
- BriefWrite what defenders should do
- ShareHand behavior to hunters and SOC
Examples of everyday tasks
- Track reporting on campaigns that matter to an organization.
- Compare sources and judge how reliable each one is.
- Describe attacker behavior using a shared framework such as MITRE ATT&CK.
- Write briefings with clear confidence statements.
- Share findings with SOC analysts and threat hunters so they know what to look for.
Related job titles
- Cyber threat intelligence analyst
- Threat researcher
These are career areas to explore, not a checklist. Some of these job titles usually require experience, and completing a starter project does not by itself make someone ready for them.
Starter project
Investigate a Fake Internship Campaign
Research a documented phishing or fake internship campaign using public reports and publicly accessible community discussions, then write a concise intelligence brief with defensive recommendations.
Reviewing online reports about a campaign is threat intelligence. Searching an environment’s logs for evidence of that behavior is threat hunting.
Keep the project to public evidence and defensive analysis. Do not contact suspected scammers, reply to offers, or look for stolen information. Remove names and usernames when you quote community discussions.
What you’ll use
- Public reports about job or internship scams from government agencies, universities, or security companies
- Publicly accessible community discussions about the campaign; relevant public Discord conversations can be one source
- A source log in a spreadsheet: publisher, date, link, and what each source claims
Resources to start with
- FTC Consumer Advice: Job Scams (opens in a new tab)
The Federal Trade Commission’s public guidance on how job scams work and how to report them.
- Internet Crime Complaint Center (IC3) (opens in a new tab)
The FBI’s complaint center, which publishes public service announcements about current fraud schemes.
- MITRE ATT&CK (opens in a new tab)
A shared vocabulary for describing attacker techniques in your brief.
More projects for this path
Each one comes with the framework to follow, five name ideas and a walkthrough for publishing it on GitHub.
- Fake Internship Campaign Brief
Research a documented job-scam campaign from public sources and brief a non-technical team.
- Threat Actor Profile
Build a sourced profile of one publicly documented group and what it means locally.
Project walkthrough
- Choose a documented phishing or fake internship campaign that has public reporting.
- Collect sources and record each one’s publisher, date, link, and main claims.
- Identify recurring patterns, such as how the offer arrived, what it asked for, and how it tried to look legitimate.
- Mark which details are confirmed by several reliable sources and which are single, unconfirmed claims.
- Assign a confidence level to each conclusion and explain the reason for it.
- Write defensive recommendations that students and career offices could realistically follow.
What to publish
- A concise intelligence brief explaining the campaign
- A source list with publication dates
- Confidence statements that separate verified facts from claims
- Practical defensive recommendations
Optional extension
Translate one observed behavior into a hypothesis that could be tested in practice system logs.
Example résumé bullet
Numbers are what make a bullet worth reading, so count them while you work: how much data you searched, how many findings you fixed, how many tests you added. Every figure should be one a reader can find in your report. Write the line after the work is done, and leave out impact or experience you cannot show.
Numbers to record while you work
| Count | Where it comes from |
|---|---|
| Sources reviewed | your source log, with dates |
| Corroborated facts vs single-source claims | confidence column in the brief |
| Indicators or patterns catalogued | campaign table |
| Recommendations delivered | the defensive section |
Project name | tools, datasets and frameworks | link
LighthouseOSINT, MITRE ATT&CK, FTC and IC3 advisories, Source log, MarkdownGitHub
Researched a documented fake internship campaign across 11 public sources spanning 6 months; separated 7 corroborated facts from 4 single-source claims and delivered 5 defensive recommendations to a career center audience.
Give the project a name of its own: “Lighthouse” is an example, not a label to copy. List the tools, datasets and frameworks you actually used, since several relevant ones show more than a single tool does. Hyperlink the last part to your published repository or report.
A day on the job
Try the work before you try the project
A short walkthrough of a realistic situation. Nothing is scored: each choice explains what would happen, so you can talk through the reasoning later.
Students are getting a fake internship offer
Several students received the same internship offer asking for a fee and a copy of their ID. The career center wants to know what this is and what to tell people.
Where do you start?
Two reports disagree about who is behind it. What do you write?
Choose above to continue.
What goes in the brief for the career center?
Choose above to continue.
Turn your project into a portfolio piece
A project becomes easier to evaluate when someone can understand what you did, inspect the evidence, and follow your reasoning.
Create a short report, GitHub README, or portfolio page. A clear two-to-four-page report is a useful starting point, not a strict requirement.
Include:
- Goal: What question or problem did you investigate?
- Environment: What tools, practice data, or systems did you use?
- Your work: What did you personally do, and why?
- Evidence: Include useful screenshots, queries, code, or test results.
- Findings: What did you discover? What remains uncertain?
- Fix or recommendation: What should change, and did you test it?
- Sources and limitations: Credit datasets and guides. Clearly identify simulated work.
Use sample or redacted information in the public version.
Publish the report somewhere accessible without requesting permission, and check the link before putting it on a résumé.
Put numbers in it
Count as you work, and put the figures in the report: records searched, findings confirmed, tests added, checks failing before and after. A reviewer can check every one of them against your evidence, which is exactly why they are worth including. Leave out business impact you cannot show.
Name it, then show your tools
A résumé line works best in three parts: your project’s own name, the tools and frameworks you used, and a link to the work. “Role-Based Access Lab” reads like a class exercise. A name plus a tool list tells a reviewer what you can actually work with, and every tool, dataset or framework you list honestly is another thing an interviewer can ask you about.
Project name | tools, datasets and frameworks | link
- Role-Based Access LabTurnstile | Keycloak, RBAC design, NIST SP 800-63, Docker | GitHub
- Login HuntBeacon | Python, pandas, Sigma, MITRE ATT&CK | GitHub
- Cloud ProjectBedrock | Terraform, Checkov, AWS IAM, CIS Benchmarks | GitHub
Why link a report?
Your résumé gives a short description of the project. The linked report lets a reviewer inspect your work and gives you concrete evidence and decisions to discuss during an interview.
Not every recruiter will open it, but it makes your work available for review.
BeaconPython, pandas, Sigma, MITRE ATT&CK, LANL authentication datasetGitHub
Investigated a public authentication-log dataset for repeated failed logins followed by successful access; documented search queries, supporting evidence, and limitations in a reproducible hunt report.
Hyperlink the last part to the published work, so “GitHub” or “Project Report” opens your repository or report. Check the link before you send the résumé.
Preview the write-up template
# Project title > Practice project. Describe the simulated scenario, practice data, or lab used. ## Goal What question or problem did you investigate? ## Environment What tools, practice data, or systems did you use? Link datasets and guides. ## My work What did you personally do, and why? ## Evidence Screenshots, queries, code, or test results. Use sample or redacted information only. ## Findings What did you discover? The numbers behind it (records searched, findings confirmed, tests added). What remains uncertain? ## Fix or recommendation What should change, and did you test it? ## Sources and limitations - Datasets and guides used: - What was simulated: - Limitations: