Cyber Threat Intelligence Analyst

Job Description This is a remote position. Simulation-Based Work Experience Programme — Founding Cohort Opportunity Overview Cyber Threat Intelligence professionals rarely work with perfect information. They must determine what matters, evaluate reliability, understand potential threats, communicate uncertainty and convert analysis into intelligence somebody can actually use. Participants may receive threat information, indicators, contextual information, organisational requirements and incomplete intelligence and be required to determine what it means, why it matters and what should happen next . The responsibilities below represent the breadth of professional work available across the simulation library. Individual participants will encounter different combinations depending on the simulations they activate and may undertake simulations across other disciplines. Workplace Responsibilities & Jobs to Be Done Threat-information triage: You may receive multiple pieces of threat information and determine which information is relevant to the organisation and deserves further investigation. Source evaluation: You may assess reliability, credibility and relevance of information sources and explain how those judgements affect analytical confidence. Threat-actor analysis: You may examine available intelligence about a threat actor and assess likely motivation, capability, targeting behaviour and organisational relevance. TTP analysis: You may analyse tactics, techniques and procedures associated with malicious activity and determine their implications for defensive priorities. Indicator analysis: You may assess indicators of compromise within their broader context rather than treating individual indicators as conclusive evidence. Intelligence-gap identification: You may determine what important information is missing and define what additional intelligence would materially improve decision-making. Intelligence requirements: You may develop or refine intelligence requirements based on organisational priorities, assets, threat exposure and stakeholder needs. Threat prioritisation: You may compare several threats and determine which deserves greatest attention based on relevance, likelihood, potential impact and available evidence. Structured analytical reasoning: You may evaluate competing explanations or hypotheses and communicate why available evidence supports one assessment more strongly than another. Threat assessment: You may synthesise multiple information sources into an assessment explaining what is happening, why it matters and what the organisation should consider doing. Confidence assessment: You may communicate the confidence associated with an intelligence judgement and identify factors limiting certainty. Executive communication: You may translate technical threat information into concise intelligence suitable for senior decision-makers who require implications rather than technical detail. Defensive recommendation: You may recommend proportionate defensive priorities based on the intelligence assessment within the remit of legitimate defensive security. Assessment updating: You may receive new information after an initial assessment and reconsider or revise your previous judgement. All activities take place within simulated environments and are intended for legitimate defensive, educational and professional-development purposes. Requirements Professional Artefacts & Evidence of Work Cyber Threat Intelligence Assessment: You may produce an analytical product describing the simulated threat, available evidence, organisational relevance, analytical judgement and recommended defensive priorities. Threat Actor Profile: You may develop an assessment of a simulated threat actor covering motivation, capability, observed behaviour, targeting and organisational relevance. Executive Intelligence Brief: You may translate technical findings into business implications and decision-relevant recommendations for senior stakeholders. Intelligence Requirements Document: You may define priority intelligence questions and specify information required to support organisational decision-making. TTP Assessment: You may analyse relevant simulated adversary behaviours and explain their implications for organisational defensive priorities. Indicator Assessment: You may produce a contextual evaluation of supplied indicators and explain their evidential significance rather than merely listing technical indicators. Analytical Confidence Statement: You may document confidence associated with an assessment, explain evidence quality, identify information gaps and state important assumptions. Threat Prioritisation Assessment: You may rank relevant simulated threats according to defined organisational and intelligence criteria. Intelligence Update: You may revise a previous assessment after receiving new information and demonstrate how additional evidence changes—or does not change—your earlier judgement. These outputs demonstrate the ability to turn information into decision-useful intelligence . Capabilities You Can Demonstrate Threat Intelligence • Analytical Reasoning • Source Evaluation • Threat Assessment • Intelligence Requirements • Risk Prioritisation • Structured Analysis • Cybersecurity Awareness • Intelligence Communication • Decision Support • Critical Thinking Ethical Use All CTI simulations are intended for legitimate educational, defensive and professional-development purposes. Participants must comply with Career Bridge acceptable-use and ethical standards. Who Should Apply? Aspiring Cyber Threat Intelligence Analysts, cybersecurity students and graduates, SOC professionals seeking CTI exposure, career changers entering cybersecurity, intelligence or security professionals moving towards cyber, self-taught practitioners and professionals with cyber certifications who need applied evidence.