Cyber Threat Intelligence Analysts use their expert knowledge of malicious software to research and analyze cyber threats, reporting their findings to business leaders, using this intelligence to predict similar attacks, and ultimately helping to counter the activities of cybercriminals for their organization.

Cyber Threat Intelligence Analysts use intrusion detection tools like Snort, Suricata, and Bro, as well as packet inspection tools like WireShark. They also need to use command-and-control, persistence mechanisms, and common network protocols, with an understanding of various scripting and reverse engineering tools.