Job adverts use "threat analyst" and "SOC analyst" almost interchangeably, and that is doing every beginner a disservice, because the two jobs point in genuinely different directions. A SOC analyst reacts to what has already touched your network. A threat analyst tracks who is out there and what they are likely to try next, whether or not they have come near you yet. One job starts the moment an alert fires. The other starts long before that, reading, correlating, and asking uncomfortable questions about people who have not shown up on your doorstep, yet.
What actually is a threat analyst, and how is it different from a SOC analyst?
CISA's NICE Cybersecurity Workforce Framework is precise about this in a way most job adverts are not. SOC analyst work sits under the framework's "Protect and Defend" category. Threat analyst work sits under a separate category entirely, "Analyze," in a specialty area literally named Threat Analysis, with the work role titled Threat/Warning Analyst. That is not a technicality. It reflects a real difference in what the job produces. A SOC analyst's output is a closed ticket. A threat analyst's output is a written assessment that changes what somebody else decides to do next, before there is a ticket to close.
In a lot of smaller organisations, one person ends up doing both jobs, which is exactly how the titles got blurred in the first place. In anything resembling a mature security function, they are distinct roles with distinct skill profiles, and only one of them spends its day buried in threat feeds instead of alert queues.
What foundations do you need before any of this makes sense?
None of the frameworks below mean anything without solid ground underneath them. Networking fundamentals, how systems and services actually talk to each other, and the shape of common attacks are the bedrock every threat analysis skill gets built on top of. TryHackMe's Pre Security path covers exactly this layer for someone starting from nothing, and the Cyber Security 101 path extends it into a broader tour of the field. Skip this stage and every later concept becomes memorisation instead of understanding, which is a bad trade for something you are supposed to be able to reason about under pressure.
What does a threat analyst actually need to know how to do?
Three things, and none of them are optional. First, MITRE ATT&CK, the reference library of documented adversary tactics, techniques, and procedures, which is how you describe attacker behaviour in a shared language other analysts and tools actually understand. Second, the Pyramid of Pain, the model security researcher David Bianco published in 2013 that ranks indicators by how much it actually costs an attacker when you act on them. Blocking an IP address costs an attacker almost nothing, they get a new one in minutes. Detecting their TTPs costs them time, money, and retooling. Knowing the difference is what separates busywork from actual defensive value.
Third, and this is the skill nobody puts on the syllabus: writing clearly for people who do not share your technical vocabulary. An intelligence report nobody outside the security team can act on is a report that accomplished nothing, no matter how technically sound the analysis inside it is.
What does a day actually look like?
Less dramatic than the job title suggests, and more valuable for it. Most days start with threat feeds, vendor advisories, and vulnerability disclosures, hunting for anything relevant to your organisation's actual footprint rather than reading everything indiscriminately. From there it is building or updating a threat actor profile: who they are, what they tend to target, which TTPs show up in their campaigns, and what that means for you specifically. The output is a written product, a briefing, an advisory, an update to detection logic, that goes to a SOC team, an incident responder, or a decision-maker who needed to know this before Monday, not after.
It is quiet work. It is also the work that determines whether Monday's alert gets caught in ten minutes because someone already knew what to look for, or missed entirely because nobody did.
How do you prove you can do this before anyone is paying you to?
Employers hiring for this role are checking for demonstrated judgement, not a certificate that says you attended a course. TryHackMe's Cyber Threat Intelligence module is built around exactly that: Intro to Cyber Threat Intel covers the CTI lifecycle and the standards the field actually runs on, Threat Intelligence Tools works through the OSINT tooling used to investigate real indicators, and Threat Intelligence for SOC covers how that intelligence actually gets used once it reaches a security operations team. The module sits inside the broader SOC Level 1 path, backed by the Security Analyst Level 1 certification as a credential that tests the work directly rather than your ability to sit a multiple choice exam.
Where do these roles actually sit, and is the demand real?
Yes, and it is not slowing down. The Bureau of Labor Statistics projects information security analyst roles to grow 33 percent through 2033, nearly four times the average across all occupations, and threat analysis sits inside that broader growth. In practice, the role lives in a few different places: inside a large organisation's own SOC or security team, inside an MSSP serving multiple clients at once, or on a dedicated threat intelligence team that exists purely to answer the question "what should we be worried about" before it becomes anyone's emergency.
The analysis is not the hard part
It is tempting to think the value of this job is the analysis itself: the correlation, the attribution, the neat write-up of who is doing what to whom. It is not. Raw intelligence is worth exactly nothing until it changes what somebody else decides to do, block this domain, prioritise that patch, brief the board on this specific risk instead of a generic one. A brilliant piece of analysis that sits in a report nobody reads has the same practical value as no analysis at all.
That is the part of this job that is genuinely hard, and genuinely underrated: turning "here is what is happening" into "here is what you should do about it," in language someone without your background will actually act on. Get that translation right consistently, and you become the person a SOC trusts before the alert ever fires, not after.
Frequently asked questions
Is a threat analyst the same job as a threat hunter? Related, but not identical. A threat hunter proactively searches inside your own network for signs an attacker is already present. A threat analyst tracks external threat actors and campaigns more broadly, and that intelligence often feeds directly into what a threat hunter goes looking for.
Do you need a background in intelligence or law enforcement to do this job? No. Most working threat analysts came up through general security operations or a hands-on training path, not a formal intelligence background. What matters is analytical rigour and the ability to write clearly, both of which are trainable.
Is coding a requirement for this role? Not a strict requirement, but Python or PowerShell for automating repetitive lookups and enrichment tasks is genuinely useful and increasingly expected as feed volume grows past what anyone could review manually.
Can you move from SOC analyst into a threat analyst role? Yes, and it is one of the more common routes in. SOC experience gives you a real sense of what intelligence is actually useful downstream, which is difficult to learn any other way.
Do you need a certification to get hired as a threat analyst? Not strictly, but a credential that tests practical investigation and reporting ability, like TryHackMe's Security Analyst Level 1, carries more weight with hiring managers than a purely theoretical qualification.
What is the single most useful skill to build first? Learning to read attacker behaviour through MITRE ATT&CK's lens. Almost everything else in this role, from the Pyramid of Pain to writing a usable intelligence report, builds on being able to describe what an attacker did in that shared language.
Nick O'Grady