Day-to-Day Responsibilities
Collect threat data from open sources, security feeds, dark web forums, malware repositories and industry sharing groups.
Analyse attacker tactics, techniques and procedures, often mapped to the MITRE ATT&CK framework, to understand how an attack is likely to unfold.
Track threat actors and campaigns over time and identify which ones are targeting the client's sector or region.
Write threat briefings and reports for security teams, IT leaders and, in some cases, senior management or the board.
Share indicators of compromise (such as malicious IP addresses, domains and file hashes) with monitoring teams so they can block or detect threats.
Support incident response teams during an active attack by providing context on the attacker and their likely next steps.
Review what worked and what did not after an incident, and recommend changes to monitoring rules and defences.
