Cyber Threat Analyst Intern is a role people hire badly more often than they hire slowly. The fix is upstream of the interview: a named deliverable, a named reviewer and a stipend you have actually benchmarked.
Screen for whether the candidate can explain risk to someone who controls a budget. Technical depth without that translation stalls at the first funding conversation.
People searching for cyber threat analyst intern often also look at threat intelligence intern. The skills overlap heavily; what differs is emphasis — this brief leans on the cyber and analyst side of the work. If your requirement genuinely spans both, say so in the listing rather than picking one title and hoping.
Below: the skills worth testing, the work a student can genuinely finish in a term, 2026 stipend bands, and questions that have a wrong answer. Posting is free and takes about two minutes.
What a single Threat Intelligence intern actually does in the first 90 days
Each of these is work a team member would otherwise do. That is the test of a good intern brief: real work already on someone's list, not a project invented to keep the intern busy.
- Present one risk to a non-technical stakeholder and get a decision out of the conversation
- Answer one open business question end to end and present it on a single page
- Produce one intelligence brief relevant to our actual sector
- Enrich and operationalise the current IOC feed into detections
- Build the source-reliability rating nobody has written down
Threat Intelligence skills worth screening for
Screen on the first three. The rest are teachable inside a term, and treating them as entry requirements shrinks your pool for no gain.
- 1Explaining risk in business terms
- 2Explaining a finding in three sentences to someone who will not read the appendix
- 3IOC handling and enrichment
- 4Actor and campaign tracking
- 5MITRE ATT&CK mapping
- 6Writing an intelligence report with confidence levels
- 7Feeding detection engineering
- 8Separating noise from relevance
The tools column is where CV inflation happens. Pick two and ask what went wrong the last time they used them; the answer is unfakeable.
Screening questions for cyber threat analyst intern
These separate practice from theory. Ask two, listen for a specific example, then follow the example rather than moving to the next question.
Tell me about an analysis where the answer surprised you.
What a good answer shows: Whether they follow evidence or confirm what was expected
How do you decide if a threat report matters to us?
What a good answer shows: Relevance filtering rather than forwarding everything
What confidence would you put on this claim, and why?
What a good answer shows: Analytical discipline
Score every candidate on the same questions. Comparing free-form conversations across a shortlist is where inconsistency, and bias, get in.
Where the Threat Intelligence candidates come from
You are hiring from a verified pool of students and recent graduates across India: premium institutes and strong regional colleges both, with projects, skill tags and availability already on the profile. Every employer is verified before a listing goes live, which is why candidates here actually reply.
- Skill tags — filter directly on Threat-intel platforms, MISP, MITRE ATT&CK and the rest of the Threat Intelligence stack
- City and willingness to relocate, or remote-only if the role is remote
- Institute tier, if a specific campus cohort matters for this role
- Portfolio and project evidence attached to the profile, rather than a résumé alone
- Graduation year and current semester, so you only see candidates free when you need them
Skill tags come from the candidate’s own projects and verified profile, so filtering on Threat-intel platforms or MISP returns people who have used them rather than people who listed them.
What to pay a single Threat Intelligence intern in 2026
₹15,000–₹36,000 a month is the band we see for this role across India. The spread is mostly city and company stage, not candidate quality.
Add the reviewer’s hours, tooling access and a laptop if the role needs one. That is the true cost — and it is still far below a lateral hire.
Six-month commitments generally command more per month than six-week ones, because the candidate is giving up other options. Price the commitment, not just the hours.
Listings that state a stipend get noticeably more qualified applications than "as per industry standards", which candidates read as low or undecided.
Bengaluru, Hyderabad, Pune, Mumbai, Gurugram and Noida sit at the top of the band. Tier-2 cities typically run 25–40% lower for the same skills and the same output.
Getting one Threat Intelligence intern to actually produce something
The difference between an intern who ships and one who does not is almost never talent. It is whether the work was ready on their first day and whether someone read it on their second week.
Laptop, accounts, repository or dataset access, and a task small enough to finish in two days. Interns who spend week one waiting for access rarely recover the momentum.
Read their work in the first week, not the fourth. Early correction on a small piece of Threat Intelligence work is cheap; late correction on a term’s work is not.
Someone who wants the output and will complain if it is wrong. Work with no audience is the fastest route to a disengaged intern.
Write down what a successful term would produce. Otherwise the end-of-term assessment becomes a memory of impressions, and that helps nobody.
How to post cyber threat analyst intern on MyInternships.in
You do not need a prepared job description. Answer a few questions in the chat and the assistant drafts the listing, title and skill tags for you.
Say what you need — "Cyber Threat Analyst Intern for a three-month project, Threat-intel platforms and MISP" — and answer a few short questions. No forms.
The draft comes back complete — description, responsibilities and Threat Intelligence skill tags — with a live preview of exactly how candidates will see it.
Verification happens before publication and usually takes under two working days on the free plan, or instantly on a paid plan.
Usually within a couple of hours. Shortlist using the screening questions above, or let the AI matcher rank the pool against your brief.
Free plan: one listing, live after verification. Starter ₹499: five listings a month, published instantly, full applicant contact and résumé access. Growth ₹999: fifteen listings with AI candidate matching.
Mistakes that cost you the good Threat Intelligence candidates
Each is fixable before you post, and expensive after.
A Threat Intelligence listing with fourteen required tools reads as a company that does not know what it needs. Strong candidates self-select out; the ones who apply anyway have inflated their CVs to match.
Analyst framing draws people who want to answer questions rather than run pipelines. Make sure there is a real question waiting, and a person who cares about the answer.
Interviews reward confidence, and confidence in early-career candidates is distributed unevenly by background rather than by ability. Score the answers, not the delivery.
Definition questions test revision, not ability. Ask about something they built and follow their answer — the depth appears within two follow-ups.
Cyber Threat Analyst Intern — frequently asked questions
How much Threat Intelligence experience should we expect?+
None professionally, and that is the point. What you should expect is evidence: something built, run or fixed involving Threat-intel platforms or MISP, that they can talk about in depth. Screen on explaining risk in business terms and explaining a finding in three sentences to someone who will not read the appendix; treat everything else on the list as trainable during the term.
What should we set as the goal for the term?+
One finished thing. Present one risk to a non-technical stakeholder and get a decision out of the conversation is the right size: real work someone on the team would otherwise do, small enough to finish, visible enough to assess. If they move quickly, answer one open business question end to end and present it on a single page is the natural second piece. A term with three half-finished projects assesses nothing and teaches less.
What stipend should we pay cyber threat analyst intern in India?+
₹15,000 to ₹36,000 a month covers most of the market for this role. Metro product companies pay at the top of the band; tier-2 cities and services firms 25–40% lower. An unpaid listing filters for who can afford to work free rather than who is good, and roughly halves the applications you receive.
What is the fastest way to tell a strong Threat Intelligence candidate from a weak one?+
Ask about something that went wrong. "How do you decide if a threat report matters to us?" gets you relevance filtering rather than forwarding everything, and two follow-up questions on their own example will tell you the depth. Candidates who have only studied the topic run out of specifics almost immediately.
What does it cost us in time to supervise one Threat Intelligence intern?+
Realistically two to four hours a week of a competent person: a longer session early on, then short daily availability and a weekly review. Below that, the intern stalls and produces nothing you can use. Above it, you are doing the work yourself. That time is the true cost of the hire, and it is what the stipend line in your budget does not show.
Does the "Cyber" in Cyber Threat Analyst Intern change who we should hire?+
Screen for whether the candidate can explain risk to someone who controls a budget. Technical depth without that translation stalls at the first funding conversation. In screening terms, that means adding one specific check: explaining risk in business terms.
What should an analyst intern deliver that a developer intern would not?+
A decision. An analyst’s output is a recommendation someone acts on, not a working artefact. Judge them on whether a real question got answered and whether the answer changed anything — the dashboard or the deck is just the delivery mechanism.
What documents does a Threat Intelligence intern usually need at the end?+
Most Indian colleges ask for a completion or experience certificate, and many also require a mentor evaluation on the institution's own form. Ask which format the candidate's college needs during onboarding rather than in the final week — it takes two minutes then and becomes a scramble later.
How quickly do applications arrive?+
First applications typically arrive within about two hours of the listing going live, and most employers hiring a Threat Intelligence intern have a workable shortlist inside a week. Speed depends more on how specific the brief is than on the stipend — a listing with a named project and named tools consistently outperforms a generic one at the same money.
Related roles employers hire alongside cyber threat analyst intern
Tools and pages for your hiring
Hire cyber threat analyst intern — post in about two minutes
Answer a few questions and our AI writes the description, suggests the title and tags the Threat Intelligence skills. Your company is verified, the listing goes live, and applications start arriving.