Threat Intelligence Analyst Interview Questions UK: 8 Real Questions and What Interviewers Want

Most Threat Intelligence Analyst interviews in the UK follow a pattern, and knowing it beats guessing. Below are eight questions from our bank of 12, each with a note on what the interviewer is really after.

Eight Threat Intelligence Analyst interview questions, and what the interviewer is thinking

1. Talk me through the intelligence cycle and how you would apply it in a corporate threat intelligence team.

Why they ask: They want to see you apply intelligence tradecraft, not just consume feeds.

2. What is the difference between strategic, operational and tactical intelligence, and what would you produce for each audience?

Why they ask: They want to check you can match products to audiences.

3. How do you assess the reliability of a source and express confidence in your analytical judgements?

Why they ask: They want to see analytical rigour and good use of structured language.

4. How do STIX, TAXII and a platform such as MISP or OpenCTI help share and manage intelligence?

Why they ask: They want to confirm familiarity with standards and tooling.

5. How would you track a threat actor over time, and how cautious should an analyst be about attribution?

Why they ask: They want to see analytical discipline around a common area of overreach.

6. A news story says a ransomware group is exploiting a vulnerability in software that your company uses. The CISO wants a briefing within two hours. What do you do?

Why they ask: They want to see prioritised, relevant and timely intelligence production.

7. Tell me about a time your intelligence analysis changed a decision or led to a concrete security action.

Why they ask: They want to see operational impact from your analysis.

8. What does a typical day for a threat intelligence analyst involve, and what makes someone good at it?

Why they ask: They want to confirm realistic expectations and the right qualities.

A sample answer to question 1

Talk me through the intelligence cycle and how you would apply it in a corporate threat intelligence team.

The cycle has direction, collection, processing, analysis, dissemination and feedback. In a company, it starts with direction: agreeing priority intelligence requirements with stakeholders, such as the CISO, SOC, vulnerability team and fraud team, for example 'which ransomware groups are targeting UK manufacturers, and how do they get in?' Collection draws on open sources, vendor reports, government feeds such as NCSC alerts, the CiSP community, ISACs, internal incident data and, where authorised, dark web monitoring. Processing normalises and enriches the data, de-duplicates indicators and stores them in a platform like MISP or OpenCTI. Analysis is the core: assessing reliability and credibility, linking activity to actors and techniques, deciding what matters to us and expressing confidence. Dissemination tailors the product to the audience: tactical indicators for the SOC, operational briefings for incident responders and strategic reports for executives. Feedback closes the loop, as I'd ask consumers whether the product helped and adjust the requirements.

Common mistake to avoid: Reciting the cycle with no examples; Ignoring the feedback stage

Want the rest?

Full model answers, key points and common mistakes for all 12 questions are on the Threat Intelligence Analyst interview questions page. The first five are free, no sign-up needed.