ronutz

The Roles · Who defends it

Threat intelligence analyst

Written from published sources

The analyst who studies adversaries rather than systems. The framework describes the work as collecting, processing, analysing and disseminating threat assessments, and the last of those verbs carries the role: intelligence that reaches nobody in a form they can act on has been research rather than intelligence.

What the day looks like

  • Collecting from sources of varying reliability, and recording which was which.
  • Assessing what an adversary can do and what they appear to intend, which are separate judgements.
  • Translating that into something concrete for the people who defend: a detection, a priority, a hunt.
  • Writing assessments with confidence stated, so that a reader can weigh them.
  • Tracking whether the assessment held, which is how the sources are calibrated over time.

What it answers for

  • Sourcing that is recorded and weighted, rather than aggregated into a single confident voice.
  • Assessments that state their confidence and what would change it.
  • Relevance: intelligence about this organisation's actual exposure.

What it is measured on

  • Detections and hunts that originated with the intelligence.
  • Timeliness against events that later mattered.
  • Assessments used in decisions, which is the honest measure and the hardest to count.

Who it receives from

External feeds, vendors and sharing communities
Indicators, reporting and the occasional thing that arrives before it is public.
The organisation's own telemetry
What is being attempted here, which outranks anything external for relevance.
Incident response
What an adversary actually did once inside, which is the highest-quality source available.

Who it serves

Security operations
Priorities, and the detections worth building.
Incident response
Context about who this appears to be and what they usually do next.
Security leadership
The threat picture that shapes where the programme spends.

Who else has a stake

  • The sharing communities the organisation both draws from and owes to.
  • Legal, since attribution carries consequences beyond the technical.
  • Every defender whose attention this work directs.

What it takes

  • Source discipline, and the habit of recording provenance and confidence together.
  • Analytic writing: a judgement, its basis, and its uncertainty, in that order.
  • Enough operational grounding to know which findings a defender can use.
  • Resistance to the compelling narrative, since a good story is the commonest way an assessment goes wrong.

What the job turns on

Intelligence earns its name by changing a decision. A report that arrives, is read, and leaves the defence exactly as it was has cost the organisation an analyst's week and delivered news. The analysts who matter work backwards from the decision — which detection, which priority, which hunt — and write toward it, which also makes the work measurable in a way that generic reporting leaves out of reach.

The published sources

Where it leads

Roles that lead here

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

Read The Practice