PECB Certified Cyber Threat Analyst study plan
PECB Certified Cyber Threat Analyst · Give each week a clear focus.
8 weeks · About 7 hours per week
Fundamental concepts of cyber threat analyst and threat hunting
Define threat hunting and distinguish it from detection engineering, incident response, and threat intelligence in writing
Map the threat hunting maturity levels and place a sample organization on the scale with justification
Explain the analyst's role across the intelligence cycle and hunting loop
Build a glossary of 25 core terms with your own definitions
Your checkpoint
A two-page concept map linking hunting, IR, threat intel, and detection, plus a 25-term glossary
Fundamental concepts of cyber threat analyst and threat hunting
Formulate three hypothesis-driven hunt questions from a stated threat scenario
Apply the MITRE ATT&CK matrix to select relevant tactics and techniques for those hypotheses
Identify data sources needed to test each hypothesis
Document assumptions and blind spots for each hunt
Your checkpoint
Three written hunt hypotheses each with ATT&CK mapping, required data sources, and success criteria
Preparation and execution phase of threat hunting programs and incident management plans
Draft the components of a threat hunting program charter including scope, roles, and cadence
Design a hunt execution workflow from hypothesis to reporting
Compare hunting models such as structured, unstructured, and intel-driven approaches
Specify evidence handling and documentation requirements for a hunt
Your checkpoint
A one-page hunting program charter and a swimlane workflow diagram of the hunt lifecycle
Preparation and execution phase of threat hunting programs and incident management plans
Outline the phases of an incident management plan and how hunting findings feed escalation
Define severity classification and escalation triggers
Identify communication and notification obligations during an incident
Map hunt outputs to incident response playbooks
Your checkpoint
An incident management plan outline with severity matrix and escalation triggers
Analysis and knowledge phase of threat hunting frameworks
Apply an analysis framework to convert raw hunt data into findings
Build a knowledge base entry template capturing indicators, TTPs, and lessons
Practice writing an intelligence product for a technical and a management audience
Assess data quality and confidence levels in analytic conclusions
Your checkpoint
Two completed knowledge base entries and one executive summary of a hunt finding
Operational aspects of information security controls, incident management, and change management
Map security controls to the threats identified in earlier hunts
Explain how change management applies to detection content and hunting tooling
Describe how control effectiveness is validated through hunting
Draft a change request for deploying a new detection rule
Your checkpoint
A control-to-threat mapping table and a sample change request for a detection rule
Building a cybersecurity culture, monitoring and measurement, and continual improvement
Design metrics that measure hunting program effectiveness, not just activity
Propose a mechanism for building security awareness around hunting outcomes
Draft a continual improvement loop using hunt findings and post-incident reviews
Define a reporting cadence to leadership
Your checkpoint
A metrics dashboard specification with at least six metrics, definitions, and targets
Fundamental concepts of cyber threat analyst and threat hunting & Preparation and execution phase of threat hunting programs and incident management plans & Analysis and knowledge phase of threat hunting frameworks & Operational aspects of information security controls, incident management, and change management & Building a cybersecurity culture, monitoring and measurement, and continual improvement
Consolidate notes into a single review sheet across all five domains
Complete timed practice questions and analyze error patterns by domain
Revisit weakest areas identified in practice results
Rehearse explaining key concepts aloud to test recall
Your checkpoint
A consolidated review sheet and a written error-analysis log from practice testing
Milestones
Week 2: Can articulate the difference between hunting, monitoring, and incident response without notes, and can map a scenario to ATT&CK techniques
Week 4: Has a complete program charter and incident plan outline reviewed against a self-made checklist of required components
Week 6: Can explain how a hunt finding becomes a control change, including approval and rollback considerations
Week 8: Scores consistently above target on practice questions across all domains with documented error trends