How to Become a Cyber Threat Intelligence Analyst in the UK
Cyber threat intelligence (CTI) analysts track the criminal groups and state-backed hackers who target organisations, then turn that research into warnings and advice. You monitor open sources, criminal forums and threat feeds, analyse malware and attacker infrastructure, map behaviour to the MITRE ATT&CK framework, and write briefings for security teams and executives. Employers include banks, large companies, security vendors, consultancies and government.
It is rarely a first job in cyber. Most CTI analysts start as security operations centre (SOC) analysts or incident responders, or as intelligence analysts in the police or armed forces.
Quick facts
- Starting salary
- £40,000 - £50,000
- Mid-career salary
- £55,000 - £75,000
- Senior salary
- £80,000 - £120,000
- Work environment
- Office or remote
- Time to entry
- 2 - 4 years cyber background
- Degree required
- Preferred
- Category
- Technology
Compare pay across careers in the UK salaries by career report. Also in: High-paying careers, Stable careers.
What a Cyber Threat Intelligence Analyst does
Track threat actors, analyse malware and produce intelligence reports for security teams and execs.
How to become a cyber threat intelligence analyst in the UK
You usually need two to four years of security or intelligence experience before moving into CTI. Common starting points are SOC analyst roles, the Level 4 Cyber Security Technologist apprenticeship in England, a cyber security degree, or intelligence work in the military or police. Learn open-source intelligence (OSINT) techniques, malware basics, and frameworks such as MITRE ATT&CK and the Diamond Model. Respected certifications include GIAC Cyber Threat Intelligence (GCTI) and CREST's threat intelligence exams. Many government and defence roles need security clearance, which normally requires several years of UK residence.
- Get a first cyber security job, ideally as a SOC analyst, so you see real alerts and incidents before specialising in threat intelligence.
- Learn OSINT techniques for researching domains, IP addresses, malware samples and threat actors safely, using an isolated environment rather than your own device.
- Map public threat reports to MITRE ATT&CK techniques for practice, and publish short write-ups on a blog or GitHub as evidence of your analysis.
- Practise intelligence writing: short, sourced briefings with a clear statement of confidence, written for both technical teams and executives.
- Study for GIAC Cyber Threat Intelligence (GCTI) or a CREST threat intelligence exam once you have the security basics in place.
- Apply for CTI analyst roles at banks, managed security providers, security vendors and government, and be ready for security clearance checks.
| Route | How long | Cost | Best for |
|---|---|---|---|
| SOC analyst, then CTI | 2-4 years | Paid role | Most people entering cyber |
| Military or police intelligence | Varies | Paid role | Analysts with intelligence training |
| Level 4 Cyber Security Technologist apprenticeship | About 2 years | Paid by the employer | School leavers in England |
| Cyber security degree plus SOC role | 3 years, then experience | Tuition fee loan | Graduates |
How long it takes
Expect two to four years in a cyber or intelligence role before you are hired as a CTI analyst. Starting from scratch, add the time needed to land a first SOC or other cyber security job.
Cyber Threat Intelligence Analyst salary in the UK
Cyber threat intelligence analysts usually start on around £40,000 to £50,000, reflecting the security experience needed to get in. With several years in CTI, pay rises to about £55,000 to £75,000. Senior analysts, CTI leads and heads of threat intelligence can earn £80,000 to £120,000. Banks, consultancies and security vendors in London pay the most. Security clearance, malware analysis and foreign language skills can all raise pay, while government roles may pay less but offer more stability.
Key skills
- OSINT
- Malware analysis
- MITRE ATT&CK
- Written reporting
Cyber Threat Intelligence Analyst FAQs
How do I become a cyber threat intelligence analyst?
Start in a cyber security role such as SOC analyst, or in military or police intelligence, and build two to four years of experience. Learn OSINT, malware basics and MITRE ATT&CK, practise intelligence writing, and consider GCTI or CREST threat intelligence certifications.
Do you need a degree for threat intelligence jobs?
Not necessarily. Many employers prefer a degree in cyber security, computing or international relations, but experience counts for more. Apprenticeships, military intelligence backgrounds and SOC experience are all accepted routes, especially when backed by published analysis and certifications.
How much does a cyber threat intelligence analyst earn?
Starting salaries are around £40,000 to £50,000. Mid-level CTI analysts earn about £55,000 to £75,000, and senior analysts or heads of threat intelligence can earn £80,000 to £120,000, with London banks and consultancies paying the most.
Do I need security clearance for threat intelligence jobs?
Not for every job, but government, defence and some critical infrastructure roles require clearance, often SC or DV. Clearance usually needs several years of UK residence and background checks, and employers normally sponsor it after offering you the job.
Is Cyber Threat Intelligence Analyst right for you?
Career Compass ranks careers from your interests and priorities and explains every suggestion, with UK routes and trade-offs. See how well Cyber Threat Intelligence Analyst actually fits you. £19.99 once, full report included.
Comparing cyber threat intelligence analyst with other careers? A career quiz gives you a type; a proper assessment gives you reasons, routes and trade-offs.