Beyond CTI: Building Practical Skills Across Security Teams
Meet Steven Goff, a Senior CTI Analyst at a Tier 1 Global Financial Institution with an MSc in Applied Cyber Security and 4.5 years of experience.
Building Practical Skills Beyond CTI
BTL1 was initially recommended to me by a fellow Cyber Threat Intelligence (CTI) analyst at a peer organisation. We had been discussing some of the knowledge gaps I'd identified through my day-to-day work, particularly around security operations and incident response, and I was keen to develop a more practical, hands-on understanding of those areas.
After reviewing the course content, I realised it offered a good balance of topics that would reinforce my existing knowledge and others that would help me better understand the roles, processes, and tools used by the security teams I regularly collaborate with.
That was exactly what I got from the course. It helped strengthen my existing foundations while giving me a much clearer understanding of how other security functions operate and how their work connects with my own.
"It helped strengthen my existing foundations while giving me a much clearer understanding of how other security functions operate and how their work connects with my own."
Applying Practical Skills to Real-World Security Work
I found BTL1 to be a very practical and relevant training experience. The material was concise, focused and heavily geared towards hands-on application, which made it easy to relate back to real-world security work.
A number of the modules mapped closely to my day-to-day role, particularly phishing analysis and threat intelligence. The phishing analysis module reflected the techniques I already use professionally when analysing suspicious emails, URLs and indicators.
Even in an area I was already familiar with, I still picked up new tools, including URL2PNG and Wannabrowser, which gave me additional options for safely analysing suspicious web content.
The threat intelligence content was also highly relevant to my role, particularly around indicators, research and platforms such as MISP. These sections reinforced existing knowledge while showing how those skills fit into a wider investigation.
Broadening Knowledge Across Security Teams
The Digital Forensics and Incident Response content gave me a different perspective. DFIR is not something I work with to the same depth day to day, so using tools such as FTK Imager, KAPE, Autopsy and Volatility helped me better understand how forensic investigations are carried out in practice.
Working through areas such as Windows artefacts, file systems and data acquisition gave me a clearer view of how evidence is collected, preserved and analysed following an incident.
The SIEM and Splunk content was also valuable. While SIEM investigation is not the main focus of my role, the labs helped me better understand how SOC analysts search, correlate and investigate activity.
One of the most useful parts for me was getting hands-on experience with Splunk, particularly learning how to write queries and use them to investigate security events. It's helped me build my understanding of the platform and have more informed conversations with analysts who use it regularly, both within my organisation and across the wider cybersecurity community.
"The labs helped me understand how SOC analysts search, correlate and investigate activity, and how that translates into real security investigations."
Improving Cross-Functional Collaboration
Practical, hands-on training like BTL1 helps bridge the gap between theoretical knowledge and how it’s applied in real-world scenarios, particularly in areas such as Digital Forensics and Incident Response (DFIR).
From my perspective as a CTI analyst, one of the biggest benefits has been gaining a better understanding of what colleagues working in the SOC, Incident Response (IR), and other security functions may be looking for when we share intelligence or collaborate on investigations.
Having that shared understanding helps improve communication and collaboration across different security disciplines, reducing the time spent clarifying information or resolving misunderstandings between teams. In an environment where time can be critical, that can make a real difference to how effectively a team operates.
"Having that shared understanding helps improve communication and collaboration across different security disciplines."
Who Can Benefit from BTL1?
I would recommend BTL1 to anyone from graduates looking to break into cybersecurity and junior analysts working across different security disciplines, to more experienced professionals looking to broaden their understanding of blue team operations and gain hands-on exposure to incident response scenarios.
For graduates and junior analysts in particular, I think BTL1 is exactly the kind of certification that can help take them to the next level. It provides practical exposure to the tools, techniques, and investigative workflows they are likely to encounter in a real security role, which can be difficult to gain through academic study alone. The hands-on labs also give candidates valuable experience they can draw on during interviews and, more importantly, help them understand how security investigations work in practice.
BTL1 offers an opportunity to reinforce existing knowledge, address gaps outside their primary area of expertise, and develop a broader understanding of how different security functions operate and collaborate.
Advice for Experienced Cybersecurity Professionals
I'd absolutely encourage them to go for it. One of the things I appreciate most about working in cybersecurity is that the more you learn, the more you realise how much there is still to discover.
While BTL1 covered topics I was already familiar with, it also introduced me to new tools, techniques, and investigative workflows across security disciplines outside my primary area of expertise. It has helped me better understand the work of other security teams and communicate more effectively with colleagues and professionals across the industry.
I also think BTL1 offers excellent value for money compared to many other cybersecurity certifications. Considering the breadth of course material, the quality of the hands-on labs, and the practical experience you gain, I think the price is more than justified.
Regardless of your experience, there's real value in stepping outside your area of expertise and broadening your understanding of the security landscape. BTL1 has been a brilliant learning experience and has provided an excellent foundation for BTL2, which I'm currently studying towards.
“Go for it. There's always something new to learn, and for the price, I think you'd be hard-pressed to find better value in practical cybersecurity training.”
