Interview track
Junior CTI Analyst
First dedicated intelligence role. You run collection against defined requirements, enrich and triage indicators, map activity to ATT&CK, and draft reporting that a senior analyst edits.
What is expected at this level
Expected to apply ATT&CK, the Diamond Model and basic source grading correctly, to distinguish observation from inference, and to hedge appropriately. Not expected to set requirements or own attribution judgements.
Start a mock interview
22 questions
Questions from this track
Each one has a vetted expert answer you can read before or after you practise.
- What is cyber threat intelligence, and how is it different from a threat feed?
- Why do you want to work in threat intelligence rather than another security discipline?
- What threat intelligence do you read regularly, and how do you decide whether to believe a vendor report?
- Explain the difference between tactical, operational and strategic threat intelligence, with an example of each.
- A board member asks you what your team does and why it is worth the budget. You have two minutes. What do you say?
- What is the difference between an indicator of compromise and a TTP, and why does the distinction matter?