Skills

Personal attributes

critical thinker with an investigative mindset
have a genuine interest in cyber security, international affairs and geo-political dynamics
synthesising multiple and divergent sets of data/ information into concise and clear analyses

written and spoken communication
strong interpersonal and team skills
the ability to think like an adversary
evaluating the probable social, commercial, cultural, ethical and environmental consequences of an action

Specialist skills

analytical tradecraft
intelligence analysis
handling open-source intelligence (OSINT) research and common tool sets
application of formal methodologies (for example: Kill Chain, MITRE ATT&CK, Diamond Model)

For the more experienced professional:

subject matter expert in Advanced Persistent Threat (APT) groups
subject matter expert in adversaries Tactics, Techniques and Procedures (TTPs)

CIISec Skills Groups* (additional Skills Groups may also be relevant to particular jobs)

B1 – Threat Intelligence, Assessment and Threat Modelling

Principles:

assesses and validates information from several sources on current and potential Cyber and Information Security threats to the business, analysing trends and highlighting Information Security issues relevant to the organisation, including Security Analytics for Big Data
processes, collates and exploits data, taking into account its relevance and reliability to develop and maintain ‘situational awareness’
predicts and prioritises threats to an organisation and their methods of attack. Analyses the significance and implication of processed intelligence to identify significant trends, potential threat agents and their capabilities
predicts and prioritises threats to an organisation and their methods of attack. Uses human factor analysis in the assessment of threats
uses threat intelligence to develop attack trees

prepares and disseminates intelligence reports providing threat indicators and warnings

D4 – Penetration Testing and conducting Simulated Attack Exercises

Principles:

contributes to the scoping and conduct of vulnerability assessments and tests for public domain vulnerabilities and assessment of the potential for exploitation, where appropriate by conducting exploits
reports potential issues and mitigation options

contributes to the review and interpretation of reports
co-ordinates and manages Remediation Action Plan (RAP) responses
this Skill Group covers, but is not limited to, penetration testing against networks and infrastructures, web applications, mobile devices and control systems
this Skill Group also covers contributing to the conduct of testing and simulated attack exercises based on scenarios derived from threat intelligence, potential threat agents and their capabilities
predicts and prioritises threats to an organisation and their methods of attack

uses human factor analysis in the assessment of threats
uses threat intelligence to develop attack trees
prepares and disseminates intelligence reports providing threat indicators and warnings

F1 – Intrusion Detection and Analysis

Principles:

monitors network and system activity to identify potential intrusion or other anomalous behaviour
analyses the information and initiates an appropriate response, escalating as necessary
uses security analytics, including the outputs from intelligence analysis, predictive research and root cause analysis in order to search for and detect potential breaches or identify recognised indicators and warnings
monitors, collates and filters external vulnerability reports for organisational relevance, ensuring that relevant vulnerabilities are rectified through formal change processes
ensures that disclosure processes are put in place to restrict the knowledge of new vulnerabilities until appropriate remediation or mitigation is available

produces warning material in a manner that is both timely and intelligible to the target audience(s)

*Non-Commercial - No Derivatives (BY-NC-ND) license. 2021 Copyright © The Chartered Institute of Information Security. All rights reserved. Chartered Institute of Information Security®, CIISec. Chartered Institute of Information Security®, CIISec®, AfCIIS®, ACIIS®, MCIIS®, FCIIS® and the CIISec graphic logo are trademarks owned by The Chartered Institute of Information Security and may be used only with express permission of CIISec.

Experience

Any role that has developed an aptitude for working in the intelligence analysis and threat cycle and instilled an ability to conduct the kind of analysis required for Cyber Threat Intelligence work could, with additional specialist training, provide a good foundation for working in this specialism.

Such careers and roles include:

intelligence and investigative roles in police services
intelligence roles in military services
security and intelligence services

technical intelligence
business intelligence
intelligence analysis

Cyber Threat Intelligence

More about a career in Cyber Threat Intelligence

An introduction to this specialismWorking life

An introduction to this specialism

What will your responsibilities include? What are your tasks likely to include?Responsibilities

What will your responsibilities include? What are your tasks likely to include?

What core, related and wider knowledge is important for working in this specialism?Knowledge

What core, related and wider knowledge is important for working in this specialism?

What personal attributes might you need? What specialist skills are important?Skills

What personal attributes might you need? What specialist skills are important?

What other cyber security or IT role might you progress to from this specialism?Moving on

What other cyber security or IT role might you progress to from this specialism?

Which certifications and qualifications are relevant to roles in this specialism?Qualifications

Which certifications and qualifications are relevant to roles in this specialism?

Hear from someone already working in this specialismReal Life Examples

Hear from someone already working in this specialism