How to Hire Veterans for Threat Intelligence Roles

You posted a cyber threat intelligence req. Sixty resumes came in. Almost every one of them is alert triage.

The candidates can work a queue. They can close tickets fast. Then you ask for a writing sample. You get a screenshot of a dashboard.

Meanwhile the resumes your screen threw out say things like all-source analyst or SIGINT analyst. Those people wrote finished intelligence for years. A colonel read their product and spent money based on it. Your filter dropped them because the resume never named your threat intel platform.

Threat intelligence production is its own discipline. Watch-floor triage is different work. An insider threat program is different again. Employers jam all three into one posting, then wonder why the new hire cannot write an assessment.

This guide gives you a screen that finds producers. It covers what the job really makes and which military codes map to it. It also covers how to read analytic tradecraft on a resume. And it tells you what to cut from your posting today.

What does a threat intelligence analyst actually produce?

Start with the output. The tool list can wait.

NIST defines cyber threat intelligence as threat information that has been aggregated, analyzed, and enriched. The point of that work is context for a decision. Decision is the key word.

A working CTI analyst makes things people read and act on.

• Adversary tracking: a living file on a named group and how it operates.
• Finished assessments: a written judgment with stated confidence and shown sourcing.
• Warning products: a short alert that says what changed and why it matters to you.
• Briefings: ten minutes in front of a leader who will act on the answer.
• Collection tasking: a list of what you still do not know and where to go get it.

None of that is ticket work. All of it is writing and judgment under time pressure.

Want the sharing side of this discipline? Read NIST SP 800-150, the Guide to Cyber Threat Information Sharing. It came out in October 2016. It still holds up well.

Why does your req keep drawing SOC resumes?

Because your screen was built for a different job.

Most CTI postings ask for four things. SIEM experience. An EDR console. A named commercial threat platform. Five years of commercial CTI. Those four filters all point at the same person. They surface whoever sat in the queue.

Three separate jobs keep getting jammed into one posting. Pulling them apart fixes most of the problem.

Alert triage is the watch floor. Someone works a detection queue on a shift rotation. Staffing that seat is a coverage math problem. We cover it in the guide to hiring veterans for SOC analyst and detection roles.

Counterintelligence and insider threat work is person-focused. It is investigative. It runs on referrals, interviews, and case files. Different skill, different vetting, different guide: hiring veterans for counterintelligence and insider threat roles.

Threat intelligence production is the third room. The analyst tracks outside actors and writes for people who make choices. That is the job this article is about.

What did a military intelligence analyst do all day?

This is the part hiring teams guess wrong most often.

A military all-source analyst does not live in a queue. The day runs on a loop, and the loop is the CTI job.

Leadership hands down a standing list of questions that need answers. The analyst works out which sources can answer them. Then the analyst asks for collection against the gaps.

Reporting comes back. Some of it is thin. Some of it came from a source that has been wrong before. The analyst grades the source and weighs it against everything else on hand.

Then comes the writing. Not a summary of the inbox. A judgment. The wording is precise on purpose. A finished line opens with a confidence statement. We assess with moderate confidence that this group will change tactics. Confidence stated. Sourcing shown. Gaps named out loud.

Then the analyst briefs it. Often to someone senior. Often with fifteen minutes of warning. Hard questions get asked. The analyst defends the call or changes it in the room.

Federal law puts a name on that standard. 50 USC 3364 sets it out plainly. Finished intelligence must be timely and objective. It must rest on all available sources. And it must use proper analytic tradecraft. That is the bar these people worked under for years.

One more habit carries straight over. A military analyst owns an account, not a queue. They track the same actor for months or longer. They watch how it changes and they say so in writing. A commercial CTI seat calls that an adversary portfolio. The name is new to them. The work is not.

Which military job codes map to this work?

Anchor your search on the code. Titles get renamed. Codes stay put longer.

These are the backgrounds that show up most often in real CTI production seats.

We keep a career page for each of these codes. They are a fast way to see what the job really covered:

• Army 35F Intelligence Analyst.
• Army 35N Signals Intelligence Analyst.
• Air Force 1N0X1 All Source Intelligence Analyst.
• Navy Intelligence Specialist.

Two more codes are worth a look. Army 35G does imagery and geospatial analysis. Marine Corps 2629 does signals intelligence analysis. Both write products and both brief them. Does your CTI work lean on infrastructure mapping? Then see our guide to hiring veterans for GIS and geospatial work.

How do you read analytic tradecraft on a resume?

Tradecraft leaves fingerprints. You can spot them in about ten seconds.

Filler says the candidate analyzed intelligence data and supported operations. Real signal names the product, the reader, and the decision it drove.

Named techniques are the strongest tell of all. The US government published A Tradecraft Primer in March 2009. It lays out the structured techniques these analysts get trained on.

Watch for these names on the resume or in the room.

• Analysis of Competing Hypotheses: testing several explanations against the same evidence.
• Key Assumptions Check: listing what a judgment rests on, then attacking each one.
• Quality of Information Check: grading sources before trusting what they say.
• Devil's Advocacy: putting someone on the other side of the argument on purpose.
• Red Team Analysis: reasoning the way the adversary would, not the way you would.

A candidate who can walk you through one of these has done the work. A candidate who only recites tool names has sat near it.

There is one more line to hunt for. Good analysts write a so-what. They state the finding, then they say what it means for the reader. A resume bullet that ends with a business outcome shows that habit. A bullet that ends with a system name does not.

What should you cut from the threat intelligence req?

Four lines in your posting are doing real damage.

The degree screen is the first one. A hard bachelor's filter drops most senior enlisted analysts. Plenty of them have fifteen years of production and no degree. We make the longer case in the argument for dropping the degree screen.

The vendor tool list is the second. Naming three commercial platforms as must-haves cuts everyone who did the same analysis on government systems. A console takes weeks to learn. Judgment takes years.

The "five years of commercial CTI" line is the third. No transitioning analyst can meet it on day one. It is a proxy for skill, and it is a poor one.

The job title is the fourth. Some veterans search for intelligence analyst, not cyber threat intelligence analyst. Put both strings in the posting body so search picks them up.

While you are in there, run the posting through a language pass. Our guide on how to audit a job req for veteran-hostile language covers the rest.

Which interview questions separate a producer from a triager?

Five questions do most of the work. Ask all five in the same order every time.

Give the same prompt to every candidate and score it the same way. Our structured interview scorecard for veteran candidates has a format you can copy.

One more thing to skip. Do not run a tool test as your first screen. You will grade console familiarity and miss the analyst.

What does a clearance buy you here?

Short answer. A clearance proves the person was trusted with sensitive material. It says nothing about whether they can write.

For a commercial CTI seat working unclassified data, the clearance may not matter at all. Screening on it there just raises your price.

For a GovCon or federal-facing seat, it matters a lot. An active clearance can pull months out of your start date.

Either way, read the clearance line correctly. Start with how to read a security clearance on a resume. Then check how to verify a veteran's clearance as an employer. Do that before you promise a start date.

A lapsed clearance is often still worth something. Do not treat it as a dead line. Why cleared veteran talent is scarce explains the market you are buying into.

Where do you find threat intelligence candidates?

A posting alone will not fix this. It sits there and collects the same triage resumes you already have.

Search a pool where the military background is written down in plain terms. Then filter on the code and the analysis work, not on a vendor name.

Veterans have built 65,000+ resumes on BMR. Over 1,000 new profiles are added every month. Intelligence and cyber backgrounds run deep in that pool, because those career fields separate people every single month.

Two of our other guides pair well with this one. Read sourcing veterans for hard-to-fill technical roles and finding cleared veteran talent for defense roles.

If you are staffing more than one cyber seat this year, start higher up. This article sits under our broader guide to building a cybersecurity veteran hiring pipeline.

Want role names and skill language that match the commercial market? The NIST NICE Framework is a clean place to pull work role wording for your req.

Ready to see who is out there? Reach out to access BMR's veteran talent pool. Tell us the codes you want and what the seat writes. We will point you at the people who fit.