You are the first intelligence hire at a company with a working SOC but no CTI function. What do you do in your first 90 days?

The first thirty days are conversations, not tooling. I would identify who the consumers are — SOC lead, IR, detection engineering, the CISO, and whoever owns risk — and ask each of them what decisions they are making that better information would improve. That produces a draft set of intelligence requirements. Most first CTI hires skip this and start by evaluating feeds, which is how you end up producing reports nobody reads.

In parallel I would build the organisation's own threat picture: what sector and geography we are in, what an attacker would actually want here, what is internet-facing, and what the crown jewels are. Intelligence that is not scoped to this organisation is just news.

The second thirty days are about visibility. What telemetry do we have, what retention, and where are the blind spots? This matters because it determines what I can actually assess. It also tends to produce the first genuinely valuable finding, which is usually a gap nobody had articulated.

Alongside that I would want one early deliverable — a short profile of the two or three intrusion sets most relevant to our sector, mapped to ATT&CK, with the hunt hypotheses and detection gaps that fall out of it. Small, useful, and it gives stakeholders something concrete to react to, which sharpens the requirements far faster than another round of interviews.

The last thirty days are about making it repeatable: a standing reporting rhythm pitched at the right audiences, a feedback loop so I find out what was used, and only now a view on whether a commercial feed or a platform fills a gap I can actually name. Buying tooling before you can state the requirement it satisfies is the classic failure.