Threat intelligence analyst interview questions: 22 to prepare for
Each question says why it is likely to come up, from what today’s 115 open threat intelligence analyst postings ask for, and what a good answer shows. Prepare a real example for each, then practise it with the interview answer builder.
Updated Nov 15, 2026, from that day’s open postings.
Practise out loudThe page reads each question aloud and checks your answer. This site keeps nothing.
- Questions to prepare
- 22
- Open threat intelligence analyst jobs today
- 115
- Postings read in full
- 22
- Median advertised pay
- $177K
Questions about the skills threat intelligence analyst postings name
Walk me through a recent project where you used SQL. What did you do yourself?
32% of today’s 115 open threat intelligence analyst postings name SQL.
A good answer shows: Your own hands-on part, the choices you made and a number for the result.
Sample answer: “In my last role I found and fixed 130 vulnerabilities in a year; the median time to fix a critical one fell from 21 days to 4. I did that part myself: I chose how to do it, checked the result and explained it to the team.” Then say what you would do differently.
What is a mistake people often make with Agile, and how do you avoid it?
9% of today’s 115 open threat intelligence analyst postings name Agile.
A good answer shows: That you have used it long enough to know where it goes wrong.
Sample answer: “In my last role I found and fixed 130 vulnerabilities in a year; the median time to fix a critical one fell from 21 days to 4. I did that part myself: I chose how to do it, checked the result and explained it to the team.” Then say what you would do differently.
Technical threat intelligence analyst interview questions and answers
What does len([4, 8, 15]) return?
A Python question (56% of today’s postings name Python). More in the Python skill test.
Answer: 3. len counts the items in a list: there are three.
Which of these is a dictionary?
A Python question (56% of today’s postings name Python). More in the Python skill test.
Answer: {"a": 1, "b": 2}. A dictionary stores pairs of a key and a value, written with curly brackets and colons. {1, 2, 3} is a set.
What is the difference between a list and a tuple?
A Python question (56% of today’s postings name Python). More in the Python skill test.
Answer: A list can be changed after it is made, a tuple cannot. Lists are mutable (changeable); tuples are immutable.
What does this print? for i in range(3): print(i)
A Python question (56% of today’s postings name Python). More in the Python skill test.
Answer: 0 1 2. range(3) counts from 0 up to, but not including, 3.
Which clause keeps only the rows that meet a condition before any grouping happens?
A SQL question (32% of today’s postings name SQL). More in the SQL skill test.
Answer: WHERE. WHERE filters rows first. HAVING filters groups after GROUP BY.
What does an INNER JOIN between customers and orders return?
A SQL question (32% of today’s postings name SQL). More in the SQL skill test.
Answer: Only customers that have at least one matching order. An inner join keeps pairs that match on both sides. A LEFT JOIN is the one that keeps customers without orders.
You need the number of orders for each customer. Which query does it?
A SQL question (32% of today’s postings name SQL). More in the SQL skill test.
Answer: SELECT customer_id, COUNT(*) FROM orders GROUP BY customer_id. GROUP BY makes one row per customer, and COUNT(*) counts the rows inside each group.
What is the result of comparing a value with NULL using = (for example, price = NULL)?
A SQL question (32% of today’s postings name SQL). More in the SQL skill test.
Answer: Unknown, so the row is never returned. NULL means “no known value”. Any comparison with = gives unknown. Write IS NULL to find empty values.
Questions about how you work
Tell me about a time a rule or regulation slowed your work down. What did you do?
50% of today’s 22 open threat intelligence analyst postings with a full description mention compliance or regulation.
A good answer shows: That you followed it and still delivered, not that you went around it.
Tell me about something you owned from the first idea to the result.
45% of today’s 22 open threat intelligence analyst postings with a full description ask for ownership or end-to-end work.
A good answer shows: That you saw it through when it got hard, with a number for the result.
You have three urgent requests and time for one. How do you choose?
32% of today’s 22 open threat intelligence analyst postings with a full description ask you to set priorities.
A good answer shows: A rule you really use (impact, deadline, who is blocked) and how you tell the people who have to wait.
Tell me about a difficult conversation with a customer and how it ended.
32% of today’s 22 open threat intelligence analyst postings with a full description ask for work with customers.
A good answer shows: That you listened, kept your promise and what the customer did next.
Tell me about a time you had to win over people outside your team who disagreed with you.
23% of today’s 22 open threat intelligence analyst postings with a full description mention stakeholders.
A good answer shows: Who they were, what each side wanted, what you did to reach agreement and how it ended.
Tell me about a time the goal was unclear. What did you do first?
23% of today’s 22 open threat intelligence analyst postings with a full description mention ambiguity.
A good answer shows: That you asked the right questions or took a small first step instead of waiting for clarity.
Questions almost every interview has
Tell me about yourself.
Almost every interview opens with it.
A good answer shows: Under a minute: your current work as a threat intelligence analyst, one result with a number and why this job is the next step. Not your whole resume.
Why do you want to work here?
It tests whether you read about the company.
A good answer shows: Something specific: a product, a goal from the posting or a problem you can help with.
Why are you leaving your current job?
It checks for problems you might bring along.
A good answer shows: What you are moving towards, said briefly, with no criticism of your employer.
What are your salary expectations?
Only 50% of today’s threat intelligence analyst postings state pay, so be ready to name a figure.
A good answer shows: A range you can defend. Today’s 52 threat intelligence analyst postings that state a yearly US-dollar range advertise a median of $177K; the middle half $140K to $230K. Ask for their range first if you can.
What is one of your weaknesses?
A classic, still asked.
A good answer shows: A real weakness that does not block this job, and what you do about it.
Do you have any questions for us?
The last question of almost every interview.
A good answer shows: Two or three questions you prepared; the list below has some.
Questions to ask them
- What would make someone in this role successful in the first six months?
- It shows you think about results, and the answer tells you what the job really is.
- Why is this role open?
- A new role, growth or someone leaving: each tells you something different.
- Which countries and time zones can this role be done from?
- 29% of today’s threat intelligence analyst postings are remote, and many of them still limit the countries.
- What is the pay range for this role?
- Only 50% of today’s threat intelligence analyst postings state one; asking is normal.
- How will my work be measured, and how often will we review it?
- You learn what matters to your manager before you start.
- What are the next steps, and when will you decide?
- You know when to follow up, and you can plan around other offers.
Questions about a threat intelligence analyst interview
- What questions are asked in a threat intelligence analyst interview?
- Questions about the skills the postings name (SQL, Agile), about how you work (compliance and regulation, end-to-end ownership, setting priorities) and the questions almost every interview has, such as “Tell me about yourself” and your salary expectations.
- How should I answer threat intelligence analyst interview questions?
- With a real example: the situation, what you had to do, what you did yourself and the result, with a number. This is the STAR method; aim for 60 to 90 seconds an answer.
- How do I prepare for a threat intelligence analyst interview?
- Prepare three real stories with a number each (a result, a problem you solved, work with other people), practise them out loud for 60 to 90 seconds, and revise the skills the postings name most: SQL, Agile. Read the posting again the day before: the duties it lists are what they will ask about.
- Is a threat intelligence analyst interview hard?
- It depends on the level: today’s threat intelligence analyst postings ask for 5 years of experience at the median. Most interviews mix questions about the skills in the posting with questions about how you work; the technical part is easier with a real example ready for each skill.
- What salary should I ask for as a threat intelligence analyst?
- Today’s 52 threat intelligence analyst postings that state a yearly US-dollar range advertise a median of $177K. Adjust for your experience and the country, and ask for their range first.
Prepare with
Interview answer builder
Turn an example into a 60 to 90 second answer, with checks for a number and for “I”.
The threat intelligence analyst resume example
The results interviewers ask about, written as resume lines.
Thank-you email
Send it on the day of the interview, written from four fields.
115 open threat intelligence analyst jobs
Read from employers’ own careers pages every hour.
Everything about threat intelligence analyst work
Counted from the open postings on Nov 15, 2026, read from employers’ own careers pages and recounted on every update. The questions are ours; no employer’s interview is copied here.