Threat Intelligence Analyst Resume Example

Professional Summary

Threat intelligence analyst with 5 years of experience tracking APT groups, producing finished intelligence products, and integrating tactical and strategic threat data into defensive operations. Experienced with MITRE ATT&CK mapping, OSINT collection, and STIX/TAXII-based sharing across sector ISACs.

Key Skills

What to Include on a Threat Intelligence Analyst Resume

• A concise summary that states your threat intelligence analyst experience level, strongest domain, and the business problems you solve.
• A skills section that mirrors the job description language for MITRE ATT&CK, OSINT Collection, STIX/TAXII, Threat Modeling.
• Experience bullets that connect threat intelligence, cyber threat analysis, APT tracking to measurable outcomes such as cost savings, faster delivery, better quality, or improved customer results.
• Tools, platforms, certifications, and methods that are current for cybersecurity roles.
• Recent projects that show ownership, cross-functional work, and a clear result instead of generic responsibilities.

Sample Experience Bullets

• Tracked 8 APT groups targeting the financial services sector, producing 45+ finished intelligence reports that directly informed firewall rule updates and email gateway policies blocking 1,200+ malicious domains
• Built an automated IOC ingestion pipeline using Python and MISP that processed 50,000+ indicators weekly from 12 external feeds, reducing manual analyst processing time by 80% and improving detection coverage across the SIEM
• Mapped 300+ observed TTPs to MITRE ATT&CK framework techniques, creating a heat map that identified 4 coverage gaps in endpoint detection rules and guided the SOC team's detection engineering priorities for 2 quarters
• Authored a quarterly strategic threat landscape briefing for C-suite executives covering emerging ransomware trends, supply chain risks, and geopolitical factors, which informed the $2.4M annual security investment roadmap
• Monitored dark web forums and paste sites daily using Recorded Future and manual OSINT techniques, identifying 3 instances of corporate credential dumps totaling 8,000 accounts before they were used in attacks
• Developed a STIX/TAXII-based sharing workflow with 4 sector ISACs that automated bidirectional IOC exchange, contributing 2,000+ indicators per quarter and receiving early warnings on 5 campaigns targeting peer organizations
• Conducted deep-dive analysis on a spear-phishing campaign that bypassed email filters, reverse-engineering the payload to extract C2 infrastructure and attributing the activity to a known threat cluster with 85% confidence
• Created 20 threat profiles for ransomware-as-a-service operators, documenting initial access methods, negotiation patterns, and average ransom demands, which the incident response team referenced during 3 active engagements
• Reduced false positive rate on threat intel-driven alerts by 35% by implementing confidence scoring for all ingested IOCs based on source reliability, age, and corroboration across multiple feeds
• Trained 15 SOC analysts on intelligence-driven hunting techniques using the Diamond Model, resulting in 2 new threat discoveries during the first month of implementation that would have been missed by signature-based detection alone
• Integrated VirusTotal Enterprise, Shodan, and Censys APIs into a custom Python dashboard that provided real-time infrastructure pivoting, cutting research time for new IOC clusters from 4 hours to under 30 minutes

ATS Keywords for Threat Intelligence Analyst Resumes

Use these terms naturally where they match your experience and the job description.

Recommended Certifications

• GIAC Cyber Threat Intelligence (GCTI)
• CompTIA Security+
• SANS FOR578: Cyber Threat Intelligence

What Does a Threat Intelligence Analyst Do?

• Design, develop, and maintain software solutions using MITRE ATT&CK, OSINT Collection, STIX/TAXII and related technologies
• Collaborate with cross-functional teams including product managers, designers, and QA engineers to deliver features on schedule
• Write clean, well-tested code following industry best practices for threat intelligence and cyber threat analysis
• Participate in code reviews, technical discussions, and architecture decisions to improve system quality and team knowledge
• Troubleshoot production issues, optimize performance, and ensure system reliability across all environments

Resume Tips for Threat Intelligence Analysts