Threat Intelligence interview
I currently work in vuln management but want to switch to threat intelligence and have my panel interview for a threat intelligence role this week. Any tips on what kind of questions will be asked? Thanks for any sort of help! Tc: 165 Yoe: 3
Whats the point of these frameworks: - Diamond model - cyber Killchain - att&ck - pyramid of pain How do you minimize bias? - structured analytic techniques (look into them) Method for analyzing adversary infrastructure If you're looking for an internal cyber role you'll need to know best practices for stakeholders needs and how threat intelligence helps their needs. E.g. how can threat intel help an incident investigation beyond atomic IOCs?
How do you even get interviews for roles like that this? Does your resume have a stack of certifications?
I actually don’t have any certs way too lazy to get them. I have a big tech company and a start up where I got a lot of unique experience and with a referral I usually don’t have too much trouble getting interviews honestly. Startups suck working at but you can get any experience you want at them tho
Read up about the types of TI: tactical, strategic and operational. Be prepared to answer questions like why is threat intelligence important and how would you use that to explain how it aids risk reduction to executive leadership for e.g. CISO.
What is the JD exactly? Even if they give a precise role name the responsibilities may vary. What is a threat? Threat intel lifecylcle. Difference between threat feed and threat intelligence. Difference between threat hunting and threat intelligence. Frameworks used in threat intel General secuity domain knowledge Scenario based questions. etc..
Explain TTPs, explain attribution, describe some common APT behavior seen in the wild, and how you would leverage the information.