Threat Intelligence & OSINT
The closest cyber role to investigative journalism. Research, verify, write.
What the day actually looks like.
Read the morning intel feed (Recorded Future, Mandiant, The Record, X, niche Telegram). Pivot a suspicious domain through VirusTotal, urlscan.io, DomainTools, Maltego, Shodan. Verify a screenshot circulating on X with reverse image search and EXIF; cross-reference with breach forums. Write a tactical brief for the SOC, an operational report on a campaign, or a one-paragraph executive summary for the CISO. Writing is 40–60% of the job. The OSINT–journalism overlap is direct.
Where the work lives.
What you actually need.
- Search operators (Google, X, Telegram)transferable
Researchers already have this.
- Maltego CE / SpiderFoot / Shodan / Censys / Hunchly
- MITRE ATT&CK / Diamond Model
- OPSEC (sock puppets, VMs, Tails)
- Archive.org + reverse image searchtransferable
- Source verificationtransferable
Documentary fact-checking transfers verbatim.
- Narrative writingtransferable
A great threat report is a great article.
- Social-platform fluencytransferable
TikTok/IG/X investigation skill is rare and paid.
- Visual literacytransferable
Editor's eye spots the photoshop.
- OPSEC discipline
The shape of the journey.
- 1Junior / OSINT / Trust & Safety Analyst0–2 yr
- 2CTI Analyst II2–4 yr
- 3Senior CTI / Adversary Hunter4–8 yr
- 4Head of Threat Intelligence8–15 yr
Note. Times reflect typical paths for someone with strong communication and 10–15 hrs/week of focused study.
What it pays.
Ranges are directional. Currency: USD · annual. Last updated: 2025.
The cert sequence that won't bankrupt you.
Trace Labs CTFs
Trace LabsFree missing-persons OSINT CTFs. The single best portfolio builder.
Bellingcat Online Open Source Investigations Toolkit
BellingcatFree, comprehensive, and respected by employers.
Amnesty Open Source Investigations course
Amnesty InternationalMission-driven entry path.
Security+
CompTIAVocabulary baseline.
TCM PORP (Practical OSINT Research Professional)
TCM SecurityHands-on, well-respected, affordable.
IntelTechniques OSIP
IntelTechniquesMichael Bazzell's certification — gold standard if employer-funded.
SANS GCTI / GIAC
SANSEmployer-funded only. Never self-fund SANS.
Working from Lagos, Abuja, or anywhere.
US-cleared roles are off-limits to non-US persons. Commercial vendors and NGOs are wide open. Lagos timezone aligns with London, partial US East.
The good, the gritty, and who this suits.
- +Closest cyber role to journalism.
- +Strong USD potential.
- +Mission-driven options at Amnesty, Bellingcat, OCCRP.
- −Severe local-vs-remote pay gap.
- −Exposure to disturbing content.
- −Strict OPSEC discipline required.
If you've ever pieced together a story from screenshots and a reverse image search, you already do this work — they just call it something else.
Three to five hours that beat any cert.
Open source intelligence with Bellingcat's Giancarlo Fiorella
Why watch. How Bellingcat actually does the work.
Presenting: The Bellingcat Online Open Source Investigations Toolkit
Why watch. Tool walkthrough — your starter kit.
OSINT: You can't hide
Why watch. Approachable intro to the field.
Do this by Friday.
This weekend: enter the next free Trace Labs CTF (they run roughly monthly). Document your methodology in a public Notion page. That's your portfolio piece.