Defenders fight better when they know who's coming, and producing that picture is the job — tracking threat groups, their tools and tactics, and turning it into actionable intelligence. Knowing the enemy before they strike.
The work blends research, analysis, and writing — following threat actors across reports and feeds, assessing what they're doing, and producing intelligence others act on. You translate a messy external world into something defenders can use, and good intelligence has to drive a decision, not just inform. Much of the craft is judging which threats actually matter to your org.
The role varies by program. Some teams produce strategic intelligence for leadership; others feed tactical indicators straight to defenders. Sources can be noisy and contradictory, attribution is hard and rarely certain, and a confident-sounding assessment can still be wrong. For many, the difficulty is drawing conclusions from incomplete, conflicting evidence.
It tends to suit the analytical and intellectually curious — people who like research, writing, and connecting dots across a fuzzy picture. If you want hands-on hacking or system work, the analytical remove may not satisfy. But if understanding the adversary well enough to predict them appeals, the work is intellectually rich and increasingly valued.
Where this role sits in the broader career landscape — and where it can take you.
Roles like this one sit within a broader occupational category. The numbers below reflect that full landscape — helpful for context, but your specific experience will depend on level, specialty, and where you work.
No skills data available
Roles with similar work and overlapping career paths
View all Technology roles →Truest gives you tools to understand your strengths, explore roles that fit, and plan your next move.
Explore Truest career tools