Research
What cyber threat intelligence actually pays
An anonymous, open salary survey for CTI roles. No name, no email, no employer field — anonymous by construction rather than by promise. Sample sizes are published alongside every figure, and cells with fewer than 5 responses are withheld rather than shown with a caveat.
There is not yet enough data to publish anything honestly. A median built from a handful of responses is both misleading and re-identifying, so nothing goes out until each role, region and seniority cell reaches at least 5 responses.
The fastest way to change that is to add your own. It takes about two minutes, and the dataset is published openly once it can be published responsibly.
By role
- SOC Analyst moving into CTI You already triage alerts and understand detection. The gap is intelligence tradecraft: requirements, sourcing, structured analysis and writing for someone who is not in the SOC.
- Junior CTI Analyst First dedicated intelligence role. You run collection against defined requirements, enrich and triage indicators, map activity to ATT&CK, and draft reporting that a senior analyst edits.
- Cyber Threat Intelligence Analyst The core role. You own a collection area, produce finished intelligence against standing requirements, brief stakeholders, and drive detection and hunting priorities from what you find.
- DFIR-leaning Intelligence Analyst Intelligence work anchored in incident response. You turn forensic findings into durable intelligence, feed IR with adversary context mid-incident, and write the intrusion analysis afterwards.
- Senior CTI Analyst / Threat Hunter You set collection strategy, own contested analytic calls, run hypothesis-driven hunts from intelligence, and are the person who says "we do not know that" when the room wants a name.
- CTI Team Lead / Manager You run the function: intelligence requirements with the business, team capability and tooling, stakeholder relationships, and proving the team changed a decision rather than produced a volume of reports.
How this data is handled
- Anonymous by construction. The form has no name, no email and no free-text employer field, so there is nothing to de-anonymise.
- Low-N suppression. A cell is published only once it holds at least 5 responses. A median of two salaries identifies people.
- Sample sizes shown. Every row carries its n, so you can judge how much weight to give it.
- Self-reported. Nobody verifies these figures. Treat them as a directional benchmark, not an authority.
- Survey data is kept separate from any figures derived from public job postings — the two are not blended into the same medians.
Full detail on the privacy page.