We analyzed 1,000 CTI & EASM job postings. Here’s what surprised us about the skills employers actually want

We've been looking at cybersecurity job postings at CTI Academy to better understand what companies actually expect from threat intelligence analysts in 2026.

We collected 1,000 listings across 20 country/role searches and took a closer look at 214 CTI and 54 EASM job descriptions.

A few things caught our attention:

* Reporting is everywhere. It appeared in 95% of CTI postings, followed by threat actor and TTP analysis at 90%. For all the attention given to tools and frameworks, employers still seem to place a lot of value on analysts who can explain their findings and make sense of the intelligence they collect.

* MITRE ATT&CK showed up in 49% of CTI postings. I expected that number to be higher, considering how frequently ATT&CK comes up in CTI discussions.

* Detection engineering appeared in 52% of CTI postings. This was another interesting one. It suggests that many organizations expect their CTI analysts to do more than collect and analyze intelligence. They also want them to help turn that intelligence into something useful for defensive teams.

The differences between junior and senior roles were worth looking at too.

* OSINT appeared in 63% of entry-level postings, compared to 26% of advanced postings.

* Python and scripting went from 22% to 63%.

* Detection engineering increased from 15% to 67%.

For EASM, all 54 detailed postings mentioned exposure reporting, remediation workflows, and vulnerability validation.

One thing worth clarifying: these percentages are based on the detailed sample of 214 CTI and 54 EASM descriptions, not the entire set of 1,000 listings. The results show patterns in our sample rather than representing the whole job market.

We included the methodology and full breakdown here:

https://ctiacademy.io/blog/cti-easm-job-market-2026

For those working in CTI, I'm curious how closely this matches your experience.

Are detection engineering and scripting becoming part of the standard CTI analyst role where you work, or are they still handled by separate teams?