RomanNum3ral
/
Cybersecurity-Projects
mirror of https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Cybersecurity-Projects/ROADMAPS/THREAT-INTELLIGENCE-ANALYST.md

7.8 KiB
Raw Permalink Blame History

Threat Intelligence Analyst Certification Roadmap

A structured path to becoming a Threat Intelligence Analyst, specializing in collecting, analyzing, and disseminating actionable intelligence on cyber threats.

Career Path Overview

Threat Intelligence Analysts research adversaries, analyze attack patterns, and provide actionable intelligence to security teams. This role requires analytical thinking, research skills, and the ability to transform raw data into strategic insights that guide defensive operations.

Studying for the certifications below? CertGames is the platform I built to run this whole journey in one place: 25,000+ practice questions across 20 certifications (CompTIA, AWS, Cisco, ISC2), Learn lessons that teach each exam objective, guided projects you build from scratch, these career roadmaps with progress tracking, and deep analytics like an exam readiness score. Free, no credit card required. Start practicing free

Certification Path

Level Certification Organization Link
Foundation Security+ CompTIA Website
Core CySA+ CompTIA Website
Cyber Threat Intelligence GCTI GIAC Website
Intrusion Analysis GCIA GIAC Website
OSINT (Optional) GOSI GIAC Website
OSINT (Optional) C|OSINT McAfee Institute Website

Recommended Learning Path

Phase 1: Security Foundations (2-4 months)

Target: Security+

Build fundamental security knowledge:

  • Security concepts and terminology
  • Attack methodologies and threat actors
  • Network security basics
  • Malware types and indicators
  • Security operations overview

Resources:

  • CompTIA Security+ materials
  • Threat landscape overviews
  • Cyber threat fundamentals

Phase 2: Cyber Defense Analysis (4-6 months)

Target: CySA+

Develop analytical capabilities:

  • Threat detection and analysis
  • Security monitoring techniques
  • Vulnerability management
  • Threat intelligence fundamentals
  • Incident response support
  • Log analysis and correlation

Resources:

  • CySA+ study materials
  • SIEM training
  • Threat analysis platforms
  • Intelligence reporting practice

Phase 3: Threat Intelligence Specialization (6-12 months)

Target: GCTI

Master cyber threat intelligence:

  • Intelligence collection requirements
  • Threat actor profiling and attribution
  • Indicator analysis and validation
  • Threat intelligence platforms and tools
  • Intelligence dissemination and reporting
  • Strategic, operational, and tactical intelligence
  • Intelligence lifecycle
  • Threat modeling

Resources:

  • SANS cyber threat intelligence course (FOR578)
  • Threat intelligence platform training
  • Intelligence writing courses
  • Open-source intelligence techniques

Phase 4: Advanced Analysis (1-2 years experience)

Target: GCIA

Deepen technical analysis skills:

  • Advanced network traffic analysis
  • Intrusion detection techniques
  • Attack pattern recognition
  • Advanced persistent threat (APT) analysis
  • Malware behavior analysis
  • Threat hunting methodologies

Resources:

  • SANS intrusion analysis course (SEC503)
  • Network analysis tools (Wireshark, Zeek)
  • Threat hunting platforms
  • Real-world intelligence operations

Phase 5: OSINT Specialization (Optional, 2+ years)

Target: GOSI or C|OSINT

Specialize in open-source intelligence:

  • OSINT collection techniques
  • Social media intelligence
  • Dark web monitoring
  • Public database research
  • Geospatial intelligence
  • Technical footprinting
  • Legal and ethical considerations

Resources:

  • OSINT training courses
  • OSINT tools and frameworks
  • Intelligence collection practice
  • Case study analysis

Skills to Develop

Technical Skills:

  • Threat intelligence platforms (MISP, ThreatConnect, Anomali)
  • SIEM platforms (Splunk, ELK, QRadar)
  • Network analysis (Wireshark, Zeek, tcpdump)
  • Malware analysis basics
  • OSINT tools (Maltego, Shodan, TheHarvester)
  • Scripting (Python for automation)
  • Indicator enrichment and validation
  • Threat modeling frameworks

Analytical Skills:

  • Critical thinking
  • Pattern recognition
  • Attribution analysis
  • Hypothesis development and testing
  • Data correlation
  • Trend analysis
  • Strategic thinking

Intelligence Frameworks:

  • MITRE ATT&CK framework
  • Diamond Model
  • Cyber Kill Chain
  • F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate)
  • Intelligence cycle

Communication Skills:

  • Intelligence report writing
  • Executive briefings
  • Technical documentation
  • Stakeholder communication
  • Information sharing

Estimated Timeline

  • Foundation to Core: 6-10 months
  • Core to Specialization: 1-2 years
  • Specialization to Advanced: 2-3 years

Total time to senior level: 4-6 years with hands-on intelligence analysis experience.

Intelligence Types

Strategic Intelligence:

  • Long-term threat trends
  • Threat actor capabilities and intentions
  • Geopolitical analysis
  • Industry threat landscape
  • Executive decision support

Operational Intelligence:

  • Campaign tracking
  • Threat actor tactics, techniques, and procedures (TTPs)
  • Infrastructure analysis
  • Attack trend analysis
  • Medium-term planning

Tactical Intelligence:

  • Indicators of Compromise (IOCs)
  • Malware signatures
  • Attack patterns
  • Immediate threat response
  • Short-term defensive actions

Intelligence Lifecycle

  1. Planning and Direction

    • Define intelligence requirements
    • Prioritize collection efforts
    • Allocate resources

  2. Collection

    • Gather raw data from sources
    • OSINT collection
    • Partner intelligence sharing
    • Internal telemetry

  3. Processing

    • Data normalization
    • Deduplication
    • Enrichment
    • Categorization

  4. Analysis and Production

    • Pattern identification
    • Correlation and fusion
    • Attribution analysis
    • Report generation

  5. Dissemination

    • Deliver intelligence to stakeholders
    • Format for different audiences
    • Integrate with security tools
    • Share with community

  6. Feedback

    • Assess intelligence value
    • Refine collection requirements
    • Improve analysis processes

Threat Actor Categories

Nation-State APTs:

  • Advanced capabilities
  • Long-term persistence
  • Espionage and disruption
  • Well-resourced campaigns

Cybercriminal Groups:

  • Financial motivation
  • Ransomware operations
  • Data theft and fraud
  • Organized criminal enterprises

Hacktivists:

  • Political/ideological goals
  • Website defacement
  • DDoS attacks
  • Data leaks

Insider Threats:

  • Malicious insiders
  • Negligent employees
  • Compromised accounts
  • Third-party risks

Related Projects

Build threat intelligence skills with these projects:

The certification grind is rough. Make it less painful with CertGames: gamified practice where you earn XP, level up, build streaks, and compete on leaderboards, plus Learn lessons, guided projects, and roadmaps to keep you moving. 25,000+ questions across 20 certifications. Free, no credit card. certgames.com

Back to All Roadmaps