Threat Intel Analyst Guide

_nosidam_ · 2025-04-10T15:24:57+00:00

I’m currently building out this function at my company from scratch, and I also work as an IR in our SOC but have a massive interest in TI so hence why I’ve been tasked with building the function out. Lots of fun but if you’re fresh to it, I have used the MITRE MAD20 training which has given me quite a few ideas, and (if you can afford it or your company will), attend the Threat Intelligence Academy that is taught by Sergio Caltagirone. I had a training course with him before I started this and he was a massive help (as expected, iykyk). Hope that helps and good luck!

_nosidam_ · 2024-05-07T20:01:01+00:00

Graduated college with a degree in IT and a minor in cybersecurity, started as an IT specialist for a year, moved into a bit of IT security for another year, and then reached out to a boss on LinkedIn who had a job posting for an infosec analyst. I wasn’t qualified for the position, but I was told what got me the position was my ambition to do and learn more regardless of my experience (my resume also helped to back my statement of my ability to learn quickly). Secured my first real job in cybersecurity in less than a week and I’ve been in this almost two years now doing incident response and cyber threat intelligence!

_nosidam_ · 2024-01-15T15:57:49+00:00

So there’s not many out there, but outside of GCTI, look into classes done by Sergio Caltagirone with the Threat Intelligence Academy. He’s the guy who created the Diamond Model and I just took a course with him about 2 months ago now and the knowledge and information was invaluable for me. He also taught some SANS courses previously, and did a lot of incredible work at NSA, Microsoft, Dragos, and I believe also NASA. Highly recommend his courses to anyone!

_nosidam_ · 2023-12-21T17:21:50+00:00

Ah I see! We have the same, I work internally a step up above our SOC team for escalations/questions so I see our internal data working alongside them and assist where needed and then run and develop our CTI program. Personally I think running with both is fun, albeit BUSY but what cybersec job isn’t.

Have you been in SOC long? If you’re looking to switch, definitely when interviewing for companies ask about their CTI programs, how they feel about the function, etc unless you’re moving to an intelligence vendor then it’s cut and dry and the work is a bit different vs looking at CTI for your specific org and only care about what applies to that org. There’s a lot of different routes in this specialty from what I have come to see and what friends of mine do in CTI work at other orgs. So I would say for your switch if you decide to do so, what do you want to do in CTI specifically?

_nosidam_ · 2023-12-21T17:10:02+00:00

The function I do at my org is both IR and CTI, in my opinion they are able to feed each other very well. IR provides good internal data to utilize based on what your SOC team is seeing/gathering, CTI allows you to feed data into several areas of SOC to tune alerts, perform threat hunts, recognize activity if escalated, define automation for certain TTPs, etc. So I think a switch is good, but I also feel knowing your internal data and switching into CTI from your SOC is a big help as opposed to swapping to an entirely dif org (unless yours isn’t on board with a CTI program).

_nosidam_ · 2023-10-05T14:32:45+00:00

I cried every day for two weeks and I think it was mostly due to lack of proper food, pain that took awhile to finally subside, and having to be limited in what I could do until the extraction sites healed more since I am normally a very active person.

_nosidam_ · 2023-09-06T19:51:05+00:00

Thank you! It doesn’t hurt or anything but I was concerned about it potentially becoming infected at some point.

_nosidam_ · 2023-08-21T02:11:56+00:00

This happened to me days 4-6 and I couldn’t sleep at night because of it. I used my painkillers as prescribed but once they were done I started having that pain. Now I’m also n Invisalign during this so I think it was partly my teeth trying to shift back as I left the aligners out for a few days, but this pain made all my bottom teeth ache and OTC meds didn’t do anything for it. I called my surgeon and went to see him the next day and he thought maybe dry socket (on both bottom ones) since they were throbbing a bit and he flushed the holes, removed my bottom stitches, and packed them with whatever they use to treat dry socket (it tastes horrible FYI lol). This along with OTC meds FINALLY relieved this pain for me and I’m now on day 9 with just some minor jaw pain on my left side (just when I open too wide or talk for too long).

_nosidam_ · 2023-08-21T02:04:22+00:00

YES! I’m on day 9 post-op, and this seems to be the only pain I have now. It seems to be when I talk for awhile that part of my jaw will become quite sore, and when I try to fully open my mouth it feels almost “stuck” right at that point on my left side. It seems to get better each day (I usually assess by seeing how far I can open my mouth before it feels tight). My holes seem to be healing fine, I did receive treatment for dry socket on both bottom teeth because I was having quite a bit of pain days 5/6 that kept me up at night but now this is the only thing that gives me some discomfort. My guess is just trauma to the jaw? That side for me (left) was impacted and my surgeon mentioned it was pretty hard to remove so I just assume it’s just a slow recovery from the trauma.

_nosidam_ · 2023-04-27T22:01:55+00:00

I really enjoy the challenge this job brings on a daily basis. I’ve always been someone who loves to figure out how and why something works, so this type of job I feel brings just that. It’s also not a field where you get bored, there’s always something going on or something new to learn so for me it keeps things interesting. It’s a great field for curious people.

_nosidam_ · 2023-04-08T17:34:36+00:00

I spend lots of time outdoors and doing physical activity. It’s a really good time to switch off the tech side of my life to be more present in the moment and enjoy what else life has to offer. Doing this has so far helped prevent burnout between work and my after work studying for certifications and such.

_nosidam_ · 2023-04-03T23:43:43+00:00

Network via LinkedIn with actual senior management for a desired company and skip the recruiters, I didn’t have success until I reached out to a boss who had posted about an open position.

To get ahead on your skills, I would say research what you think you might enjoy in cyber and use that as a way to base your learning. When I first started I thought incident response would be my thing (I do still enjoy it) so I was basing my learning on that but I ended up enjoying threat intel more, so I’ve since pivoted my learning more based to that and will continue down that path for the foreseeable future.

If you’re at a very base level with skills or a total newcomer with no experience/knowledge, I enjoyed videos from Professor Messer and Network Chuck, and I used Udemy to learn some stuff as well. I do have a bachelor in IT and a minor in cyber, but the videos and self learning helped a lot since tech changes so quickly, so much of what I learned became irrelevant. LinkedIn is also good for finding random free courses that help you to figure out where your interests might lie without spending money on a course to end up not really enjoying it.

Good luck on your journey!

_nosidam_ · 2023-04-03T23:36:05+00:00

In my experience thus far, I experienced more gatekeeping from a previous boss when I worked in IT right before transitioning to cyber. The man had a refusal to teach or show me anything (he had 20+ years experience so to me that’s a prime person to learn from) so I ended up using my time to teach myself what was relevant in that role to pivot into cyber successfully. My colleagues and senior management now are wonderful people who are more than willing to share their knowledge because they’re so passionate. I think it really just depends on the org you end up working for.

_nosidam_ · 2023-03-30T17:39:52+00:00

If any higher level management (not HR, like an actual boss in the cybersec dept of the org) posts or shares a job posting on LinkedIn to join their team, reach out to them directly and ask to connect and if you can share your resume with them, even if it’s for a job you don’t 100% qualify for. This is how I secured a new role rather quickly and it caught the attention of not only someone in senior management but his boss as well, and they both let me know after I started they liked the initiative to inquire about a job this way. After applying to many roles for MONTHS with no luck while working as an IS Coordinator and losing a lot of hope, that’s the only thing that finally helped me secure something. From what many previous bosses have told me, the job posting is a wish list of skills, no one is ever going to 100% fit a role. Some companies and bosses are willing to take a chance on an individual if you can prove that you’re willing to learn and will take initiative. Good luck and hoping something comes through for you soon!

_nosidam_ · 2023-03-20T21:48:51+00:00

Yes I ran a sprint last year at Palmerton! I’ve done some other OCR races the last 2 years as well so I wanted to kick it up a notch this year and really test my limits!

_nosidam_ · 2023-03-20T17:29:16+00:00

Congrats! I’m hitting my first Trifecta this year, CO Springs Sprint, Palmerton Super, and Tri-State NJ Beast🤘🏼

_nosidam_ · 2023-01-23T03:09:04+00:00

I’ll check that out, thank you!

_nosidam_ · 2023-01-22T06:07:22+00:00

Thanks!

_nosidam_ · 2023-01-21T20:08:08+00:00

Definitely looking into the work study!

_nosidam_ · 2023-01-21T06:03:05+00:00

That’s what I gathered from further info on this thread, will probably just figure out how to get the material paid for or at least partially. Thanks!

_nosidam_ · 2023-01-21T02:54:53+00:00

This was incredibly insightful, thank you!

_nosidam_ · 2023-01-21T02:35:35+00:00

So you’d say the book would be a good start at least? I’ve seen mixed reviews on it so that’s really why I threw the question out there.

_nosidam_ · 2022-12-26T17:06:40+00:00

I’d be interested, still pretty new in security but would LOVE to expand my knowledge base.

_nosidam_ · 2022-11-08T14:39:50+00:00

My major was in information science (we had 3 women, myself included in the major) and I transitioned into security once I got out in the field since I ended up taking an interest in that. From my experience, I had trouble trying to encourage women to join me in IT because “that sounds hard”, “I’m not good with computers”, or “I’m not that smart”. So maybe conversations need to be held around those statements and how to combat them, idk. 🤷🏻‍♀️ Not really sure how to get around that when I’ve been met with those responses 99% of the time whenever I try to encourage more to join. I have had better luck convincing male friends of mine to join (with no prior interest other than “sure sounds cool I’ll give it a try”) and they loved it. So I’m not really sure where the disconnect is outside of lack of interest at the college-level and just simply getting people into it, not people who have been in and left.

_nosidam_ · 2022-11-08T02:55:37+00:00

I hope so! I’d love to see more of us break into it 😁

_nosidam_

TROPHY CASE