Start free

← All paths

Threat Intelligence Analyst — career path

StationX Advanced

Know the adversary before they arrive. Security+ and CySA+ for the SOC grounding every CTI advert expects, then open-source intelligence tradecraft, the CTI models and frameworks, and Python to enrich the data.

6 courses · 83 sections · 403 lectures · 6 labs · ≈ 5 h of hands-on labs

Free to start: the free lessons and guides for this roadmap →

Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.

The path

Start here →

Step 1 — Security foundation

The baseline virtually every CTI job spec requires.

follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs

Learn

CompTIA Security+ badge

11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs

9 steps — The industry-standard entry certification for a cyber security role.

Open the full CompTIA Security+ (SY0-701) roadmap →

Step 2 — SOC grounding, certified

CTI teams hire from the SOC: alerts, SIEM and incident response first.

follows the whole CompTIA CySA+ (CS0-004) roadmap: 5 courses · 35 sections · 188 lectures · 169 labs · ≈ 181 h of hands-on labs

Learn

CompTIA CySA+ badge

5 courses · 35 sections · 188 lectures · 169 labs · ≈ 181 h of hands-on labs

6 steps — The blue-team analyst certification and the natural step after Security+. Security operations, vulnerability management, incident response and reporting.

Open the full CompTIA CySA+ (CS0-004) roadmap →

Step 3 — OSINT tradecraft

Find, verify and pivot on open sources without tipping anyone off.

3 courses · 61 sections · 282 lectures

Learn

Free resources

Step 4 — Cyber threat intelligence core

The Kill Chain, the Diamond Model and ATT&CK — the intelligence labs are on the CySA+ step. STIX/TAXII and platforms such as MISP are learned on the job; no course for them is sold here.

2 courses · 17 sections · 103 lectures

Learn

Step 5 — Script the enrichment

Pull, parse and enrich indicators in Python instead of by hand.

1 course · 5 sections · 18 lectures · 6 labs

Learn

Where this leads

Choose your next roadmap

Advanced · after the job

The AI-Driven Threat Intelligence Analyst

Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.

See the AI Master's Program →Application-only. A separate programme for when you're ready.