Career Guide
Threat Intelligence Analyst
The role of a cyber threat intelligence (CTI) analyst involves identifying, analysing and anticipating cyber threats to an organisation’s information systems.
The profession
What is a threat intelligence analyst?
His role
The threat intelligence analyst collects and interprets data on attacker groups in order to anticipate cyber risks. You produce threat intelligence reports that inform the decisions of IT security teams and guide the organisation’s defensive posture.
Its scope of activity
You will mainly work within a SOC (Security Operations Centre), a CSIRT or an IT department. The banking, defence and energy sectors account for a significant proportion of recruitment, alongside digital services companies specialising in cybersecurity.
The functions
What are the responsibilities of a threat intelligence analyst?
The CTI analyst is involved at every stage of the intelligence cycle, from raw data collection to the dissemination of operational reports. Their responsibilities include intelligence monitoring, technical analysis and strategic advice.
Monitor open and closed sources to detect new threats
Produce intelligence reports for SOC teams and senior management
Analysing malware samples to extract usable signatures
Analysing the tactics, techniques and procedures (TTPs) of attacker groups
Contribute to the incident response by providing background information on the attacker
Feeding SIEM tools and threat intelligence platforms with high-quality data
Identifying and assessing indicators of compromise (IOCs)
Mapping attack campaigns using the MITRE ATT&CK framework
Work with the security teams to prioritise patches and remedial actions
Qualifications
Qualities and skills required to be a good threat intelligence analyst
The role of a threat intelligence analyst requires a combination of analytical rigour and technical curiosity. You must be able to process large volumes of diverse information in order to draw conclusions that can be put to use by teams with a range of roles, from SOC technicians to decision-makers.
From a technical perspective, proficiency in threat analysis tools is essential: SIEM for event correlation, CTI platforms for sharing indicators of compromise (IOCs), and frameworks such as MITRE ATT&CK for modelling adversarial behaviour. Experience in malware analysis, even at a static level, is a recognised asset in the market. The ability to read code and understand network protocols rounds off this technical foundation.
Beyond technical skills, the ability to write clear and concise reports is crucial: intelligence that is not communicated has no operational value. Fluency in English is essential, as the majority of threat intelligence sources and publications on attacker groups are written in that language. Constant monitoring and rapid adaptation to new threats are part and parcel of the job.
The benefits
What are the benefits of working as a threat intelligence analyst?
The CTI sector is regularly recruiting, with demand exceeding the supply of qualified candidates with a five-year post-secondary qualification. According to INSEE, 74 per cent of digital professionals have access to partial or full remote working, and professional certifications (GCTI, GCIH) are frequently covered by the employer.
Salaries rise rapidly with experience: from €38,000–45,000 at the start of a career to €70,000–100,000 for senior roles. Career progression into roles such as Lead CTI Analyst, CSIRT Manager or cyber risk management consultant offers opportunities in management or consultancy.
Remuneration
Threat Intelligence Analyst: Salary and Career Progression
At the start of their career, a CTI analyst’s salary ranges from €38,000 to €45,000 gross per annum (approximately €3,200 to €3,750 gross per month), according to Studyrama and current APEC job vacancies. After 5 to 10 years’ experience, remuneration rises to between €50,000 and €70,000 gross per annum, reflecting greater specialisation in malware analysis and expertise in attack frameworks. For senior roles (10 years’ experience and above), particularly Lead CTI Analysts or CSIRT managers in the banking or defence sectors, the range can reach €80,000 to €100,000 gross per annum. The Île-de-France region offers the highest salaries (€52,000 to €75,000 for experienced candidates), whilst regional cities such as Rennes or Toulouse offer ranges of €42,000 to €55,000, with a lower cost of living. In addition to these salaries, there are often performance-related bonuses, compensation for on-call duty and coverage of the costs of professional qualifications.
Up to
€100,000
Annual salary
Training courses
What qualifications do you need to become a threat intelligence analyst ?
Our training courses
To become a threat intelligence analyst, you generally need a five-year degree in cybersecurity or information systems security. A specialised master’s degree or an engineering qualification with a specialisation in cybersecurity is the most common route to joining a SOC or a CTI unit.
The ECE offers a Master’s degree in Cybersecurity, which prepares students for these roles through a programme combining technical fundamentals with practical, work-based learning. This course is available as a work-study programme, enabling students to gain initial work experience whilst still studying.
You can choose between:
Everything you need to know about
Our guides
Take a look at our guides to find out everything you need to know about education, work-study schemes and careers.
