CTI Academy
Log in Create account

Threat Intelligence Analyst Interview Questions and Answers

By CTI Academy Team

Real CTI interview questions with short model answers, an annotated take-home sample, and how to brief this month's threats.

Ninety-one percent of CISOs say cyber threat intelligence is valuable. Only 26% say it significantly influences their decisions, according to the SANS 2026 CTI Survey. SANS calls the gap "a translation problem, not a credibility one," and that sentence is the best summary of what threat intelligence analyst interview questions are really probing: can you turn what you found into something a decision-maker will act on?

Employers say the same thing in their job ads. When we coded 214 detailed CTI postings for our analysis of 1,000 CTI and EASM job postings, reporting and briefing appeared in 95% of them, ahead of every technical skill. In our view, that is why the written exercise and the briefing decide more CTI interviews than any trivia round.

Most CTI interviews test five things: whether you know the core models (the intelligence lifecycle, the Pyramid of Pain, the Diamond Model, MITRE ATT&CK), whether you can pivot through infrastructure, whether you reason without fooling yourself, whether you can write and brief for a specific reader, and whether you can say what a current threat means for this employer. This guide covers all five with short model answers, an annotated writing sample and real October 2026 examples. If the vocabulary is new, read our complete guide to cyber threat intelligence first; if you are still deciding whether this is the career for you, start with how to become a CTI analyst.

How a CTI Interview Loop Works

No two employers run the same process, but in our experience most CTI loops are assembled from some mix of five stages. Small teams compress them: SANS found that most CTI teams remain under four full-time employees, so you may meet three of these stages in one long call with the same two people.

Five-stage CTI interview loop from screen to panel, with what each stage tests and where candidates are most often cut

Figure 1: A typical CTI interview loop. The practical exercise and the briefing (outlined in red) are where, in our view, most candidates are cut, because they are the only stages that show your actual work. Diagram: CTI Academy.

The failure pattern in take-homes is rarely bad analysis. It is a first paragraph that does not answer the question asked, confidence that is missing or stacked on top of likelihood, and a threat actor's leak-site claims repeated as facts. There is an annotated example of the fix further down.

What Employers Screen For

The skills in job ads map neatly onto the loop. The top two, reporting and briefing (95%) and threat actor, TTP and campaign analysis (90%), are what the written product and the technical interview examine. The skills that sit near 50% (detection engineering, IOC and infrastructure analysis, MITRE ATT&CK, SOC and incident response integration) come back as scenario questions about handing intelligence to defenders.

Bar chart of the ten skills most often required in 214 CTI job postings, with the interview stage that usually tests each

Figure 2: Share of 214 detailed CTI job postings that require each skill, from CTI Academy's 2026 job market analysis, and the interview stage that typically tests it (our mapping). Source: CTI Academy job market analysis. Diagram: CTI Academy.

Calibrate for your level. In the entry-level postings (a small sample of 27), OSINT appeared in 63% and fell to 26% at the advanced tier, while scripting rose from 22% to 63% and detection engineering from 15% to 67%. Two more numbers from the same dataset are worth knowing. Malware analysis and reverse engineering appeared in only 22% of postings, so it is a bonus for most CTI roles, not a gate. Structured analytic techniques were named in just 12%, yet nearly every tradecraft question below tests them anyway.

Core Threat Intelligence Analyst Interview Questions

Interviewers rarely want the textbook definition here; they want to see that you have used the idea.

"Walk me through the intelligence lifecycle. Where does it break?"

Direction, collection, processing, analysis, dissemination, feedback. Some models merge steps; the order matters more than the labels. In practice it breaks at direction: teams collect first and ask questions later, which is how you end up with a feed of two million indicators and no customer. I start every piece of work from a written requirement and close it by asking the requester whether it answered their question.

"What is a PIR? Write one for us."

A priority intelligence requirement is a question leadership needs answered to make a decision, specific enough that you can tell when it has been answered. For a university: "Which extortion groups are exploiting our student information and ERP systems, and are we exposed?" A weak PIR is "What are the threats to us?" because nobody can ever finish it.

"Give me strategic, operational and tactical intelligence from one event."

Take ShinyHunters (Mandiant's UNC6240) and Oracle PeopleSoft. Strategic, for the board: extortion crews are targeting higher education ERP platforms, an enterprise risk rather than an IT ticket. Operational, for security leadership: Mandiant reported the group exploiting CVE-2026-35273 as a zero-day between 27 May and 9 June 2026, then renewed the campaign in September. Tactical, for the SOC: hunt for requests to the encoded path /%50SEMHUB/ and unexpected .jsp files in the PSEMHUB directory.

"IOC versus TTP. Where does the Pyramid of Pain fit?"

An IOC is an observable artifact: a hash, an IP, a domain. A TTP is behavior. David Bianco's Pyramid of Pain ranks indicators by how much it hurts the adversary when you deny them, from trivial (hashes) through IPs, domains, network and host artifacts and tools, up to TTPs. The PeopleSoft case shows it live: organizations that blocked the literal path /PSEMHUB/ with a WAF rule were defending a string, and Mandiant says the actor URL-encoded one character and walked past it. A detection on the behavior (a request reaching the hub servlet, then a new JSP file on disk or a shell spawned by the WebLogic Java process) survives that change.

"Explain the Diamond Model and when you would use it."

The Diamond Model describes each intrusion event by four features: adversary, capability, infrastructure and victim, and lets you pivot along the edges between them. I use it to cluster activity without forcing attribution. If two intrusions share infrastructure but use different capabilities, I keep them as separate clusters until something else connects them.

"How do you use MITRE ATT&CK, and how do people misuse it?"

ATT&CK gives me a common language for observed behavior, so I can compare an actor report with our detection coverage and find the gaps. The misuse is treating a technique heat map as a risk score, or mapping techniques from a vendor summary without evidence. "Exploit Public-Facing Application" tells a detection engineer almost nothing; the procedure, an encoded path to one servlet, is what they can actually detect.

"What is TLP, and what would you do with a TLP:AMBER+STRICT report?"

The Traffic Light Protocol is FIRST's standard for sharing limits: TLP:RED, TLP:AMBER (with the AMBER+STRICT variant), TLP:GREEN and TLP:CLEAR. AMBER+STRICT means my organization only, not our clients. So I would not paste it into an MSSP portal or a vendor ticket without asking the source first.

"How do you express confidence?"

Separately from likelihood. Likelihood is how probable the event is, using fixed terms such as the seven in ICD 203, from "almost no chance" to "almost certain." Confidence is how good my evidence is: low, moderate or high. I keep them in separate sentences, because "we have high confidence it is very likely" leaves the reader unsure what is being hedged. Our guide to threat intelligence report writing has worked examples.

"How do you grade a source?"

With the Admiralty (NATO) system: source reliability from A (completely reliable) to F (cannot be judged), information credibility from 1 (confirmed by other sources) to 6 (cannot be judged), graded independently. MISP ships it as the admiralty-scale taxonomy. A ransomware group's claim about how much data it stole starts low on both scales, because the source benefits from exaggerating, and its credibility rating moves up only when the victim or a regulator filing confirms it.

Technical and Pivoting Questions

Expect at least one live exercise. The interviewer listens for which pivots you trust, and when you stop.

"Here is a phishing domain. Pivot."

Say it out loud, in order. Take the lure domains Microsoft published in September 2026, such as passkeyhelpdesk[.]com, and the pattern contoso[.]add-passkey[.]com, with the target's name as a subdomain. I check registration data (Microsoft says these domains were often registered through the Nicenic registrar), name servers, passive DNS for co-hosted domains, and certificate transparency (CT) logs for other company names used as subdomains. CT is not a toy: Google said on 6 October that CT log data revealed additional organizations believed to have been hit by the .gh, .sl and .as registry hijacks. Then I grade: a shared IP on a large host is not a link; a reused certificate or naming pattern is. Passive sources only, and never a live lure from a corporate IP.

"An IP from a threat feed hit our firewall. Is it malicious?"

Context first. What is it (CDN, cloud tenant, scanner, Tor exit)? When was it listed, and when did we see it? Indicators age. What direction, how much traffic, and what did our host do next? My answer to the SOC is a verdict with a confidence level and the one query that would change my mind.

"How would you triage a malware sample without reverse engineering it?"

Hash lookup and first-seen date, then static basics: file type, signer, strings, imports. Detonate it in a sandbox for network indicators and behavior, extract the configuration if the family is known, and map what it did to ATT&CK. The output is detection opportunities and a list of questions for a reverse engineer, not a disassembly.

"How do you cluster infrastructure without overclaiming?"

I want several independent overlaps (registrar plus naming pattern plus certificate reuse plus timing), and I weight rare overlaps over common ones. Until attribution is earned I track a cluster under its own name, the way Microsoft uses Storm numbers and Mandiant uses UNC numbers. Microsoft's passkey report is a good warning: it says the same initial access technique is used by several actors, including Storm-3121 and Storm-3032. Same lure, different groups. Our piece on why threat actor names do not line up goes deeper.

Analytic Tradecraft Questions

This is where interviewers separate analysts from researchers who collect well.

"Name a bias that affects CTI work, and what you do about it."

Anchoring on the first attribution you read. Once a vendor names an actor, every later artifact looks like confirmation. Before I look at new evidence, I write down what would prove the current view wrong. Richards Heuer's Psychology of Intelligence Analysis is the classic text; it sits near the top of our threat intelligence reading list.

"What is Analysis of Competing Hypotheses, and when would you use it?"

List every plausible hypothesis, build a matrix of evidence against each, and focus on evidence that rules hypotheses out rather than evidence that fits. I use it when stakes are high and evidence is ambiguous. Example: who defaced the Clop ransomware gang's leak site in September? H1, ShinyHunters as claimed; H2, Clop staged it; H3, a third party borrowed the name. BleepingComputer saw the uploaded file on Clop's server, Clop admitted its Grav CMS install was not fully updated, and Grav confirmed the flaw details ShinyHunters shared were accurate (BleepingComputer). H1 survives best. ShinyHunters' claim that it stole valuable data does not: Clop disputes it and nothing independent confirms it.

"Who is behind this attack?"

The strong answer starts by asking who needs to know and why. Most consumers need "what will they do next, and are we exposed," not a name. I separate levels: an activity cluster, a named group, a sponsoring state, an individual. Each needs more evidence than the last, and naming individuals is for courts and law enforcement, not for my report.

The Written Exercise and the Briefing

A take-home usually gives you a requirement, a few source documents and a few hours. My advice on time: spend the first fifth reading the requirement and grading the sources, two fifths on analysis, two fifths on writing. Write the BLUF last and put it first. One page that answers the question beats five pages that describe the threat.

Graders look for four things, and the excerpt below shows each. We wrote it ourselves, as the first paragraphs of a take-home answer for a university.

Annotated excerpt of a sample CTI assessment on PeopleSoft exploitation, with four reviewer comments in the margin

Figure 3: A sample take-home answer with reviewer comments. The BLUF answers the requirement in its first sentence, likelihood and confidence sit in separate sentences, the threat actor's claims are labeled as claims, and the action has an owner and a deadline. Facts from Mandiant's June and September 2026 reports. Diagram: CTI Academy.

The briefing then tests the same product out loud. Open with the answer, not the background. Keep it to three minutes, and prepare for the three interruptions you will almost certainly get: "How confident are you?", "What would change your mind?" and "So what do we do on Monday?"

Current Threat Questions and How to Answer Them

"Tell me about a recent threat you have followed" is close to universal, so expect it in some form. Interviewers are not scoring whether you picked the right story. They are scoring structure: do you say what happened, separate confirmed facts from claims, say what it means for this employer, state your confidence and name your sources?

Five-beat answer structure for current-threat questions, worked through for the ShinyHunters arrests

Figure 4: A five-beat structure for any current-threat question, filled in for the ShinyHunters arrests. Confirmed evidence is solid; claims from the actor are dashed amber and never carry the assessment on their own. Diagram: CTI Academy.

Here are six questions you could plausibly get in October 2026, with model answers in that structure.

"What do the ShinyHunters arrests mean for us?" (asked by a university or a heavy SaaS user)

Dutch police confirmed the arrest of a 24-year-old Amsterdam man in their ShinyHunters investigation. In a 28 September statement the FBI called him one of the alleged leaders and said the group had allegedly breached more than 140 organizations and taken at least $70 million in extortion payments; the Bureau later told The Register it had worked with partners to arrest "multiple subjects". Still a claim: that the group stole FBI personnel data through a PeopleSoft zero-day, which BleepingComputer has not independently verified. My assessment: do not bank on the arrests lowering near-term risk. Mandiant's 25 September update documents PeopleSoft intrusions in September, the same month as the Dutch arrest, and the FBI's statement is addressed to "the remaining members" of the group. Moderate confidence. Recommendation: patch CVE-2026-35273 rather than relying on WAF rules, and enforce call-back verification at the help desk. Our ShinyHunters profile has the full timeline.

"Microsoft's data shows phishing's share of initial access more than tripled. What do you tell our CISO?"

In the 2026 Microsoft Digital Defense Report, incident response findings show phishing rising from 7% to 23% of initial access, and exploitation of public-facing applications from 15% to 24%, comparing July 2024 to June 2025 with July 2025 to June 2026. Eleven pages later, Microsoft Defender Experts notifications tell a different story: user execution 30%, valid accounts 20%, public-facing exploitation 5%.

Microsoft Digital Defense Report 2026 crops: initial access in IR findings versus Defender Experts notifications

Figure 5: Same report, two populations. Left, initial access across two years of Microsoft incident response findings (page 33). Right, initial access in Microsoft Defender Experts customer notifications (page 44). Source: Microsoft Digital Defense Report 2026, Microsoft, October 2026.

The good answer reconciles them. Incident response engagements skew toward severe, completed intrusions, while managed detection notifications catch more early, user-driven attempts. Note too that "none identified" fell from 25% to 14% and "social engineering", counted separately, fell from 15% to 7%, so part of the growth elsewhere may be better identification or different labeling of entry points rather than more attacks. Both point at identity and internet-facing systems, so that is where I would put the money. Moderate confidence: one vendor's telemetry. Our comparison of what the 2026 threat reports agree and disagree on sets Microsoft beside other vendors.

"Our ML team runs Ollama and LiteLLM. Should we worry about PoeLLM?"

Lumen's Black Lotus Labs reported on 7 October that PoeLLM has hit more than 3,400 victim servers since April 2026, with peak activity around 800 active servers a day, mostly through exposed LiteLLM, Ollama, Gotenberg and Gitea deployments. It installs the XMRig and Iron miners and derives its C2 address from words in a poem hosted on GitHub. My assessment: opportunistic and exposure-driven, so the real question is whether our instances face the internet unpatched. High confidence in the campaign data; low confidence about the actor, where Lumen is the only source. Recommendation: inventory AI endpoints this week, take them off the internet, and alert on mining traffic or unexpected outbound connections from inference servers.

"What changed for us on 11 September 2026?" (asked by a company that sells hardware or software in the EU)

The Cyber Resilience Act's reporting obligations started to apply on that date, ahead of the Act's main obligations, which apply from 11 December 2027. Under Article 14, a manufacturer must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability in its product, a fuller notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available. Severe incidents affecting the product's security run on the same 24- and 72-hour clock, with a final report within a month. The CTI angle is the clock: someone has to notice fast that a flaw in our product is exploited in the wild, from vendor reports, exploitation trackers and our own telemetry. Legal decides what "aware" means, not me.

"A user says IT called her about setting up a passkey. What do you do?"

Microsoft described this exact pattern on 9 September: calls or texts to personal phones from a fake IT help desk, using a passkey, MFA or SSO pretext to steer the victim through an adversary-in-the-middle page or a device code sign-in. Microsoft says one cluster using it, Storm-3121, conducts initial access leading to ShinyHunters and Falcon extortion. So I check her sign-ins for device code authentication and newly registered authentication methods, look for bulk SharePoint or Graph activity, revoke sessions if anything looks wrong, and recommend blocking the device code flow where there is no business need. Our device code phishing explainer covers the detections.

"How should we screen remote candidates for North Korean IT workers?"

A joint advisory from seven agencies on 18 September 2026 linked North Korean IT workers with WaterPlum, better known as Contagious Interview, which the agencies say infected at least 30,000 devices in more than 100 countries. Its interview advice includes asking for detailed explanations of skills on the resume and watching for repeated video freezes. I would add identity verification at onboarding, ship laptops only to verified addresses, and alert on unapproved remote access tools. Our North Korean IT workers breakdown has more.

Scenario and Behavioral Questions

Scenario questions test judgment under time pressure:

Behavioral questions want short, specific stories: situation, action, result. Prepare one each for changing your mind on evidence, pushing back on a stakeholder who wanted firmer attribution than the evidence allowed, and explaining something technical to a non-technical audience. For "how do you stay current?", name a routine: vendor research blogs, CISA and IC3 advisories, and a daily aggregator such as todayincyber.io. On AI, be concrete. SANS found that 45% of organizations use AI in CTI, mainly for summarization, reporting and workflow automation; say you use it to summarize and draft, and never accept a fact from it without a source.

Questions to Ask, and Red Flags

The end of the interview is part of the interview. Good questions show you think like an intelligence function:

Red flags worth taking seriously:

A Two-Week Prep Plan

Two weeks is enough to walk in prepared if you already have the basics.

For structured material, our comparison of cyber threat intelligence training ranks free and paid courses and certifications by career stage.

Interview questions reward reps more than reading. Our Cyber Threat Intelligence learning path is free, ends with a certificate, and is built around the tasks above: writing PIRs, grading sources, using ATT&CK and the Diamond Model, tracking campaigns without forcing attribution, and writing assessments. It includes six case-based missions, among them one called Four Hypotheses.

CTI Academy Cyber Threat Intelligence learning path page: 82 steps, 3 sections, about 16 hours, certificate

Figure 6: The Cyber Threat Intelligence learning path on CTI Academy: three sections, six case-based missions and a certificate at the end. Source: ctiacademy.io, captured 8 October 2026.

Frequently Asked Questions

What questions are asked in a threat intelligence analyst interview?

Expect fundamentals (the intelligence lifecycle, PIRs, the Pyramid of Pain, the Diamond Model, MITRE ATT&CK, TLP, confidence language), a live pivot on a domain or IP, tradecraft questions about bias and competing hypotheses, a written exercise or take-home, and at least one question about a recent threat and what it means for the employer.

How do I prepare for a CTI analyst interview with no experience?

Build a small public portfolio of three written products: an actor profile, a current-threat assessment with a BLUF and stated confidence, and a pivot write-up. Then practice timed take-homes and three-minute briefings. A portfolio is the closest thing to experience an interviewer can review.

What is the written exercise in a threat intelligence interview?

It is usually a take-home or timed task where you receive a requirement and some source material and must produce a short assessment. Graders look for a bottom line that answers the question, separated likelihood and confidence, sourced facts, claims labeled as claims, and actionable recommendations.

Do I need malware reverse engineering skills for a CTI interview?

Usually not. In CTI Academy's sample of 214 CTI job postings, malware analysis or reverse engineering appeared in 22%. You should be able to triage a sample with hashes, static basics and a sandbox, and explain what detection opportunities it gives a SOC.

How do I answer a question about a current threat in a CTI interview?

Use five beats: the requirement (who is asking and why), the evidence (confirmed facts separated from claims), your assessment, your confidence, and a recommendation for this employer. Name your sources. Interviewers score the structure more than the story you pick.

What should I ask at the end of a threat intelligence interview?

Ask who consumes the team's intelligence and what decision it changed recently, what the current priority intelligence requirements are, who will review your writing, and what sources and sharing rules the team works with. These questions show you think like an intelligence function.

How should I split my time on a CTI take-home assessment?

Spend about a fifth of the time reading the requirement and grading the sources, two fifths on analysis and two fifths on writing. Keep the product to one or two pages unless the brief asks for more, and respect any time limit, because scoping work is part of what is being tested.

Sources

Continue with the Cyber Threat Intelligence Learning Path

Start Learning Path

Related Articles

Read more at CTI Academy Blog