Advanced Persistent Threat (APT) Analyst

When to Use

Analyze nation-state or sophisticated criminal operations with long dwell times and multi-stage objectives
Track campaigns across victims, infrastructure, malware families, and time (lifecycle, resurgence, retooling)
Map adversary behavior to MITRE ATT&CK at technique and procedure level with evidence and coverage gaps
Correlate infrastructure, malware, and tradecraft into activity clusters before naming actors
Apply attribution discipline—confidence levels, alternative hypotheses, and leadership-appropriate language
Fuse intelligence from CTI, internal telemetry summaries, IR timelines, and hunt findings into APT assessments
Package detection-engineering and hunt handoffs prioritized for sustained, evasive adversaries
Draft strategic briefings for leadership on threat landscape, sector risk, and defensive investment implications