Threat Analyst Insights: An Early Career Perspective

I like to tell people that I “won the lottery” when it came to finding a job in cyber threat intelligence. Coming into college as an international relations major, I picked up computer science along the way and decided that the most obvious path to combining my two interests was cybersecurity. I assumed that I was narrowing down my career path, but I was totally wrong. The field I had entered into contained a range of technical and non-technical flavors, each with its own specific language. I had never heard of penetration testing¹ or security operations centers,² let alone what GDPR³ was or why it was important.

Because of this, I spent a good chunk of my college career figuring out paths in security that I didn’t want to take. I had some technical internships, competed in CTFs,⁴ and did compliance research⁵ for pro-bono projects. At one point, it felt like I was randomly choosing career paths, only to be disappointed by the path I chose. Landing in Recorded Future as a threat intelligence researcher right out of college was my lucky break — had it not been for some great mentors and a Recorded Future advertisement in my favorite security podcast, I might not have known that threat intelligence even existed.

My underlying problem was that even though I knew I wanted to pursue cybersecurity, I had no idea if there was a cybersecurity field that fit my interests. Thus, this blog post will describe threat intelligence, what I’ve already learned from my job, why I enjoy it, and what skills make an individual valuable in this field. To anyone looking to pursue cybersecurity who doesn’t know where to start, I hope that you read this and realize one of two things: either that threat intelligence is the perfect field for you, or that this is a field you know you won’t enjoy and you can now focus on finding something else that better fits your interests. (To be extra helpful to industry newbies, I’ve put definitions for industry-specific jargon in the footnotes).

“What Is Cyber Threat Intelligence?”

Gartner defines threat intelligence as “evidence-based knowledge, including context, mechanisms, indicators, implications, and actionable advice about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” These emerging hazards can be anything from an insider threat (disgruntled employee selling sensitive company data online), to state-sponsored espionage (what the Chinese do all the time). Organizations range from small businesses to governments, and decision makers range from security architects to CEOs.

Effectively, a threat intelligence researcher finds a threat relevant to the organization and turns the information about a threat into a narrative. What do we know about this threat? What makes this threat a danger? What can be done about it? This threat can come from vulnerability disclosures,⁶ dark web forums,⁷ malware analysis,⁸ news stories, or even social media posts. Then, this threat intelligence researcher makes sure the people in charge know three important details:

1. That this information is relevant to their organization.
2. Why it’s important for them to know.
3. What they can do about it to prevent harm to their organization.

Threat intelligence researchers find needles in haystacks and then somehow spin those needles into gold.

“What Can You Do In Threat Intelligence?”

Malware analysis, data collection, open source research, developing tools and platforms, and mapping out C2⁹ infrastructure are all tasks that I’ve conducted in the last three months. Because threat intelligence focuses on investigating leads and threats, investigations need to be as holistic as possible. Understanding how an actor sets up their C2 infrastructure or writes their malware will help you attribute other campaigns¹⁰ to them in the future, while knowing current events within their home country can help you figure out their motives. Of course, investigations also need to be accurate and timely — threat intelligence encourages specialization in the above fields as well as space to explore.

“What Skills Do I Need To Succeed?”

Anyone, regardless of age or specialization, can start a job in threat intelligence if they can do the following:

• Understand how to tackle things from all angles. Actors have different motivations, TTPs,¹¹ and targets. Believe it or not, I use my international relations degree in my job far more than my computer science degree during investigations. Understanding how an actor works complements the technical analysis of an actor’s tools.
• Understand how networks (and computers) work. The above being said, it is important to have a deep technical understanding of how computers work and how they interact with each other. Without that, you cannot begin to analyze tools or campaigns, let alone explain it to others.
• Specialize in an area (technical or non technical). Becoming an expert in one section of threat intelligence — be it on malware, network penetration, product development, or even analysis of a particular region or collection source — is valuable. It adds nuances to the reports you write and sets you apart from other researchers.
• Communication and writing skills are a plus.

“What Have You Learned?”

So far, being a threat intelligence researcher suits me well. I enjoy learning new things and picking apart a problem from both technical and non-technical angles. I have a desire to investigate problems and am fascinated by cyber threat actors — who they are, how they conduct operations, and why they conduct them. In addition, I am good at communicating these threats to others. I also picked up important skills along the way, such as when to follow my gut, how to analyze trends and connections between actors, and how to communicate in a way that engages others.

If you identify with many of these character traits, and if the skills that I have learned also interest you, I highly recommend that you consider a job in threat intelligence. If not, I hope that you eventually find the job you want. Finding a job that fits into this field is just as validating as winning the lottery, and this is one less path you need to try before that happens.