Intelligence Analyst

Intelligence Analyst prepares and delivers essential services using both skills and systems with 28 detailed tasks listed. Expect plain steps, common terms, and notes on how the work affects outcomes. Each one shows where we found it, and comes with an AI prompt you can copy and use straight away.

28evidenced tasks
28ready prompts
9tools of the trade
33-3021.06O*NET-SOC code
114,430hold this job (US, BLS 2025)
$93,790median pay/yr (US)
Open Intelligence Analyst in the interactive atlas →

What it pays

Government survey numbers — not estimates, not ads.

Half of all Detectives and Criminal Investigators in the U.S. earn more than $93,790 a year — the middle 80% land between $55,390 and $160,540. About 114,430 people in the U.S. do this work. Figures are for the U.S. occupation group “Detectives and Criminal Investigators”. (U.S. Bureau of Labor Statistics survey, published 2025.) In India, Service and sales workers earn about ₹15,575 a month on average — around ₹1.9 lakh a year (government PLFS survey via ILOSTAT, occupation-family figure).
$93,790typical pay / year
114,430people in this work
$160,540+top 10% earn
₹1.9 lakha year in India (family avg)
Think you get this job?Six quick questions on how it really works — with a hint and the reason behind every answer.
Test yourself →

The work, task by task

These are the real jobs-to-be-done, not a wish list. Each task shows where we found it, and the prompt underneath is written for that exact task.

Analysing4

Analyze information to identify threats or vulnerabilities

+
Assess raw reporting and signals about the coastal smuggling route active this month, fuse travel, interview…
Assess raw reporting and signals about the coastal smuggling route active this month, fuse travel, interview and incident records to map likely threat actors and methods, then produce a threat matrix highlighting vulnerabilities to patrol units by Monday.
The tools that do the workESRI ArcGISLinuxESCOjob descriptionsO*NET

Analyze data to support investigations

+
Analyze the seizure and cell-site records linked to the last three burglaries, extract patterns and anomalous…
Analyze the seizure and cell-site records linked to the last three burglaries, extract patterns and anomalous communications, correlate with known subjects, and hand the analytic package with recommended follow-up to the case agent within 48 hours.
The tools that do the workApache Sparkjob descriptionsO*NET

Analyze business processes and requirements

+
Review current intelligence unit workflows, map information handoffs and tools, gather stakeholder needs from…
Review current intelligence unit workflows, map information handoffs and tools, gather stakeholder needs from analysts and case agents, and produce a requirements brief with recommended process changes for the chief next Tuesday.
The tools that do the workApache Hivejob descriptionsWikipedia

Develop and manage BI solutions

+
Design and stand up a business-intelligence dashboard that pulls incident counts, analyst hours, and…
Design and stand up a business-intelligence dashboard that pulls incident counts, analyst hours, and clearance rates, define KPIs with the operations lead, and deliver a prototype dashboard and data pipeline plan for testing in two weeks.
The tools that do the workApache KafkaApache Sparkjob descriptionsO*NET
Keeping the record1

Write reports on their results

+
Draft the intelligence report on the narcotics diversion investigation, summarise key findings, list source…
Draft the intelligence report on the narcotics diversion investigation, summarise key findings, list source reliability and confidence levels, attach interview transcripts and evidence chain, and deliver the finished PDF to Commander Reyes and legal counsel by Thursday noon.
The tools that do the workLinuxESCOjob descriptionsO*NET
The daily work23

Validate known intelligence with data from other sources.

+
Cross-check the lead on Ahmed Khan by matching his travel, phone and transaction traces against police…
Cross-check the lead on Ahmed Khan by matching his travel, phone and transaction traces against police databases, open-source reporting and commercial watchlists, flag contradictions and confidence level, and attach source extracts for the record.
The tools that do the workApache KafkaLinuxO*NET

Identify gaps in information.

+
Map what we know about the Rivera network, list unanswered questions that block prosecution or disruption,…
Map what we know about the Rivera network, list unanswered questions that block prosecution or disruption, prioritise the three highest-risk intelligence gaps and propose where to task surveillance, interviews or records requests next.
The tools that do the workApache HiveO*NET

Study the assets of criminal suspects to determine the flow of money from or to targeted groups.

+
Trace assets tied to suspect Maria Alvarez by linking property titles, corporate filings, bank payment chains…
Trace assets tied to suspect Maria Alvarez by linking property titles, corporate filings, bank payment chains and cryptocurrency addresses, produce a transaction timeline showing funds into and out of her known fronts and indicate probable beneficiaries.
The tools that do the workApache SparkLinuxO*NET

Study communication code languages or foreign languages to translate intelligence.

+
Translate and annotate intercepted chat logs and coded phrases from the Enrique cell, produce plain-language…
Translate and annotate intercepted chat logs and coded phrases from the Enrique cell, produce plain-language meaning, note uncertain readings and recommend which bilingual witnesses or linguists to task for verification.
The tools that do the workC++O*NET

Operate cameras, radios, or other surveillance equipment to intercept communications or document activities.

+
Collect and catalogue surveillance captures from last week—camera video, bodywire audio and radio…
Collect and catalogue surveillance captures from last week—camera video, bodywire audio and radio logs—time-sync them, redact by policy, extract key frames and radio transcripts, and deliver a packet ready for analyst review.
The tools that do the workLinuxO*NET

Generate intelligence products with significant impact

+
Draft the 8-page intelligence assessment on the Northern Corridor threat, weave HUMINT, signals and financial…
Draft the 8-page intelligence assessment on the Northern Corridor threat, weave HUMINT, signals and financial indicators into a clear judgement, list operational implications and recommendations for the commander.
The tools that do the workDjangojob descriptions

Research and analyze cyber threats

+
Research recent intrusion activity targeting our finance and HR systems, map indicators of compromise from…
Research recent intrusion activity targeting our finance and HR systems, map indicators of compromise from open and classified reporting, prioritise active threats by likelihood and impact, and deliver a written threat brief with recommended mitigations by Thursday noon.
The tools that do the workLinuxjob descriptions

Gather business data through mining and analysis

+
Mine company transaction logs and external commercial feeds to extract customer behaviour and supplier risk…
Mine company transaction logs and external commercial feeds to extract customer behaviour and supplier risk signals, normalise the records, identify three leading business risk trends, and produce a short dataset and one-page summary for the strategy team by Wednesday.
The tools that do the workApache Sparkjob descriptions

Review and validate customer data

+
Validate the new customer roster by cross-checking supplied identities against internal records and…
Validate the new customer roster by cross-checking supplied identities against internal records and third-party verification sources, flag discrepancies with evidence, correct metadata where confirmed, and return a clean list with audit notes before Friday close of business.
The tools that do the workApache Hivejob descriptions

Create projections for company growth

+
Build three growth scenarios using historical sales, pipeline conversions, and macro assumptions, quantify…
Build three growth scenarios using historical sales, pipeline conversions, and macro assumptions, quantify revenue and headcount impact for each scenario, attach key risk drivers and confidence levels, and hand the projection pack to the CFO by next Monday.
The tools that do the workApache Sparkjob descriptions

Present visual data to leadership

+
Create a concise visual package of operational metrics and threat maps for the leadership briefing: convert…
Create a concise visual package of operational metrics and threat maps for the leadership briefing: convert raw indicators into charts, highlight anomalies and hotspot regions, produce a 10-slide deck and printable one-page executive summary for Wednesday morning.
The tools that do the workESRI ArcGISjob descriptions

Conduct research to support operational strategies

+
Conduct targeted research to inform next quarter operations: interview three field contacts, review recent…
Conduct targeted research to inform next quarter operations: interview three field contacts, review recent incident logs and open-source reporting, synthesise findings into proposed operational adjustments with resource estimates, and deliver recommendations by Friday afternoon.
The tools that do the workLinuxjob descriptions

Use cognitive methods to analyze information

+
Produce a structured cognitive analysis of the collected reports, mapping hypotheses, evidence weight,…
Produce a structured cognitive analysis of the collected reports, mapping hypotheses, evidence weight, probable biases, and recommended follow-up lines of inquiry for the briefing tomorrow at 0900, using classified sources only.
The tools that do the workApache SparkWikipedia

Assess risk acceptance levels of opponents

+
Assess and rank likely risk-acceptance levels for the three identified adversary groups, justify each ranking…
Assess and rank likely risk-acceptance levels for the three identified adversary groups, justify each ranking with recent indicators, decision triggers, and recommended monitoring thresholds for the duty officer by 1700.
The tools that do the workApache HiveWikipedia

Interpret deliberately deceptive information

+
Analyze the latest communiqués for signs of deliberate deception, catalog inconsistencies, probable motive…
Analyze the latest communiqués for signs of deliberate deception, catalog inconsistencies, probable motive for concealment, and suggest interrogation angles and technical validations to test the claims before report submission.
The tools that do the workApache HadoopWikipedia

Contact and interview people who may provide intelligence

+
Arrange contact and set up secure interviews with the two named sources, draft the informed-consent script,…
Arrange contact and set up secure interviews with the two named sources, draft the informed-consent script, list validated questions and technical safeguards, and schedule both interviews for next Wednesday afternoon.
The tools that do the workLinuxESCO

Perform administrative duties to ensure records maintenance

+
Update the unit case files: standardise metadata, archive yesterday's raw reports, reconcile discrepancies in…
Update the unit case files: standardise metadata, archive yesterday's raw reports, reconcile discrepancies in source attribution, and produce an audit log of changes for the records officer by close of business.
The tools that do the workDjangoESCO

Support applications, reports, and processes

+
Draft a support packet for the Kabul cyber fusion team: include the intake form, three reproducible reporting…
Draft a support packet for the Kabul cyber fusion team: include the intake form, three reproducible reporting templates, and a checklist for secure handling of source material so analysts can file and archive cases correctly by Friday.
The tools that do the workLinuxjob descriptions

Test and utilize new technology and techniques

+
Design and run a sandbox exercise that evaluates two new collection techniques against our handling rules,…
Design and run a sandbox exercise that evaluates two new collection techniques against our handling rules, document attack/defense steps, and produce a short lessons-learned memo for the training roster next Tuesday.
The tools that do the workApache Sparkjob descriptions

Correlate similarities among deceptions to extract a common truth

+
Compile a dossier comparing five recent deception campaigns, extract recurring narratives and artifact…
Compile a dossier comparing five recent deception campaigns, extract recurring narratives and artifact similarities, and produce a one-page inference map that highlights the most plausible shared tradecraft by Wednesday.
The tools that do the workApache HiveApache HadoopWikipedia

Weigh data and test hypotheses within a secret socio-cultural context

+
Run a cultural-context analysis of interview transcripts from the northern province, test three competing…
Run a cultural-context analysis of interview transcripts from the northern province, test three competing hypotheses against the transcripts and local indicators, and write a ranked-evidence brief for leadership by Monday.
The tools that do the workESRI ArcGISWikipedia

Reduce ambiguity of highly ambiguous situations

+
Take the current week’s ambiguous incident report, list all plausible explanations, eliminate those…
Take the current week’s ambiguous incident report, list all plausible explanations, eliminate those contradicted by validated sources, and deliver a confidence-scored recommendation for action to the chief analyst by close of business today.
The tools that do the workJavaScriptWikipedia

Reject high or low probability explanations in analysis

+
Review the unit’s explanatory models for last month’s events, reject any with unsupported priors or extreme…
Review the unit’s explanatory models for last month’s events, reject any with unsupported priors or extreme odds, and produce a calibrated set of alternative explanations with likelihood weights for the morning briefing.
The tools that do the workC++Wikipedia

Says who?

These are the pages we read to build this. Open any of them and check us.

The logs, files & records this job keeps

Shared with other careers — the same record means something different in each.

Related careers

Same family of work — each with its own tasks and prompts.

The LLOS Work Atlas is the world's largest evidenced task library — a map of human work, with a ready prompt behind every task. 1,774 careers · every task named by the sources that witnessed it — O*NET, ESCO, real job descriptions, Wikipedia — and the deepest tasks by several at once. And it is honest about limits: where AI cannot help, the map says so.

The rest of the map

Same library, five ways in.

Copyright © LLOS.ai · 2026 — original pedagogy, voice, and design — all rights reserved.
Built on public evidence: O*NET®, ESCO, Wikipedia, U.S. Bureau of Labor Statistics, ILOSTAT. All sources & licenses