Lesson 1.4

OSINT Careers and Skills

Learning Objectives

Identify job roles that use OSINT daily and what OSINT looks like in each
List the technical and non-technical skills that make a strong OSINT practitioner
Compare current OSINT-related training and certification options
Find legitimate communities, CTFs, and practice opportunities to build experience and a portfolio

OSINT Is a Skill, Not Just a Job Title

Very few job postings say “OSINT Analyst” and nothing else. More often, OSINT is a core skill inside another role. Students who can research effectively, verify what they find, and write it up clearly have an advantage in almost every security job.

Roles That Use OSINT

Role	How OSINT is used	Typical employers
Cyber threat intelligence (CTI) analyst	Tracks threat actors, their infrastructure, and their tactics; monitors underground sources; writes intelligence reports	Security vendors, large companies, banks, government
SOC analyst	Investigates alerts: looks up suspicious IPs, domains, and file hashes; researches phishing campaigns	Almost any organization with a security team; managed security providers
Penetration tester / red teamer	Performs reconnaissance before testing; builds phishing pretexts; maps attack surfaces	Security consulting firms, internal red teams
Social engineering specialist	Researches targets for authorized phishing, phone (vishing), and physical tests	Security consulting firms
Attack surface management / digital risk analyst	Continuously finds exposed assets, leaked credentials, and brand impersonation	Security vendors, large enterprises
Incident responder / digital forensics analyst	Researches attacker infrastructure and context during investigations	Consulting firms, internal security teams, law enforcement
Fraud / trust and safety analyst	Finds fake accounts, scam networks, and fraudulent transactions	Banks, marketplaces, social media platforms, payment companies
Corporate / due diligence investigator	Researches companies and people before deals; finds hidden ownership and risks	Investigation firms, law firms, consulting firms
Physical / executive security intelligence analyst	Monitors threats to people, offices, and events; often works in a global security operations center (GSOC)	Large companies, security firms
Law enforcement intelligence analyst / investigator	Develops leads, finds missing people, supports cases	Police departments, federal agencies
Government intelligence analyst	Produces open source intelligence on foreign events and threats	Intelligence agencies, military, contractors
Investigative journalist / researcher	Verifies media, investigates events, fact-checks claims	Newsrooms, research organizations, nonprofits
Brand protection analyst	Finds counterfeit goods, fake sites, and trademark abuse	Retail and consumer brands

Teaching point: a student interested in any of these paths benefits from OSINT skills. Point students toward the roles that match their interests (technical vs. investigative vs. writing-focused).

Core Skills

Technical skills

Search mastery: advanced search operators across multiple search engines (Module 4)
Networking and web fundamentals: DNS, IP addresses, HTTP, how websites and certificates work (needed for infrastructure research)
Metadata and file analysis: understanding what’s hidden in photos and documents
Image and video analysis: geolocation, chronolocation, and spotting manipulation
Basic scripting (Python is the usual choice): automating repetitive searches and processing large datasets
Data handling: spreadsheets, parsing formats like JSON and CSV, and basic data visualization
Linux comfort: many OSINT tools run on the command line
OPSEC: keeping your research environment and identity separate (Module 8)

Analytical skills

Critical thinking: questioning sources and assumptions
Verification discipline: confirming findings with independent sources (Module 7)
Pattern recognition: noticing connections across unrelated-looking data
Awareness of bias: avoiding confirmation bias and tunnel vision
Confidence assessment: expressing how sure you are, and why

Communication and professional skills

Clear writing: turning findings into reports that decision-makers can act on (Module 7)
Documentation habits: recording sources and steps as you go
Ethical judgment: knowing when to stop, what’s out of scope, and how to handle sensitive data (Module 2)
Patience and persistence: most leads go nowhere; good investigators keep going
Curiosity: the most common trait among strong OSINT practitioners

Helpful extras

Foreign languages: a major advantage, especially in threat intelligence and geopolitical work
Geography and cultural knowledge: helps with geolocation and understanding context
Knowledge of a domain: finance, aviation, shipping, or a specific region can make you the go-to expert

Training and Certifications

Certifications are not required to start, but they can help with job applications. Always check current details and prices before recommending one — they change often.

OSINT-specific certifications

Certification	Provider	Format (as of 2026)	Notes
GIAC Open Source Intelligence (GOSI)	GIAC, aligned with SANS SEC497: Practical Open-Source Intelligence	SEC497 is a 6-day instructor-led course (or 36 hours self-paced) with 29 hands-on labs	Covers OSINT and OPSEC fundamentals, search, metadata and image analysis, investigating people, website and infrastructure analysis, automation, dark web, and AI tools, ending with a capture-the-flag capstone. Expensive; often employer-funded
Practical OSINT Research Professional (PORP)	TCM Security	Hands-on practical exam: 72 hours to solve challenges and submit a professional report; 80/100 to pass	$399 voucher includes training access, labs, and one free retake. Renamed from “Practical Junior OSINT Researcher” in November 2024. Budget-friendly and practical
Certified in Open Source Intelligence (C\|OSINT)	McAfee Institute	Online certification program	Marketed toward investigators; McAfee Institute is accredited by ACCET, and its certifications are listed in military Credentialing Opportunities On-Line (COOL) catalogs. McAfee Institute also offers an Advanced OSINT (AOSINT) certification

Note for the intro script: the SANS OSINT course is currently SEC497 (aligned with GIAC GOSI).

GIAC Cyber Threat Intelligence (GCTI) — aligned with SANS FOR578: Cyber Threat Intelligence, an intermediate 6-day course covering the intelligence lifecycle, adversary profiling, MITRE ATT&CK, pivoting, and intelligence sharing standards. A natural next step for students heading toward CTI.
General security certifications (entry-level networking and security certs) help build the technical foundation that infrastructure OSINT relies on.

Free and low-cost learning

Bellingcat’s Online Investigation Toolkit and Bellingcat’s guides — tools and methods from working investigators
Bellingcat’s “First Steps to Getting Started in Open Source Research” — a beginner-friendly starting guide
Flare Academy — free threat intelligence training and a Discord community, plus the free Darkroom dark web investigation lab (see Module 6)
TryHackMe OSINT rooms (e.g., “OhSINT”, “Sakura Room”) (verify before class that these rooms are still available)
Conference talks — many security and OSINT conference talks are posted free online

Practice Communities and CTFs

Practice is how students build real skill. Every option below uses approved targets or real cases with proper oversight — not random people.

Opportunity	What it is	Why it’s good practice
Trace Labs Search Party CTF	Roughly four-hour events where teams collect OSINT on real missing persons cases; findings are reviewed and passed to law enforcement	Real-world impact, strict rules, and team experience. Better for students with some experience
Bellingcat Volunteer Community	Volunteers contribute to Bellingcat research projects (interest form on Bellingcat’s volunteer site)	Real investigative work with experienced researchers
Bellingcat geolocation challenges	Challenges posted on Bellingcat’s site, with answers released later	Low-pressure practice with explanations
Quiztime	A community that posts “where/when was this taken?” challenges	Short, frequent geolocation and verification practice
GeoGuessr	A geolocation game using street-level imagery	Fun way to build visual geolocation skills; Bellingcat and OSINT Curious have both streamed games
OSINT Curious	A community project sharing OSINT techniques and discussion	Learn from practitioners and ask questions
Security conferences and summits	Talks, workshops, and CTFs (e.g., the SANS CTI Summit; many regional security conferences run OSINT CTFs)	Networking and exposure to current techniques
Flare Academy Discord	Community chat with Flare’s researchers and access to the Darkroom lab	Safe exposure to dark web investigation concepts

Professional associations

OSINT Foundation — a nonprofit (501(c)(3)) professional association launched in 2022 by former intelligence leaders to promote OSINT tradecraft and develop the practitioner community, focused on US national security.

Building a Portfolio (Ethically)

Employers want evidence of skill. Ways to show it without harming anyone:

CTF write-ups: explain your methodology for challenges from purpose-built CTFs — but follow each event’s rules about publishing, and never publish real people’s personal information (Trace Labs cases involve real people).
Blog posts on techniques: demonstrate a technique using yourself, a fictional persona, or a public, non-personal subject (e.g., geolocating your own photo).
Tools and scripts: small automation scripts on GitHub (make sure they don’t contain secrets or personal data).
Research on infrastructure, not people: for example, analyzing a publicly reported phishing campaign’s domains.
Certifications and badges: GOSI, PORP, Flare Academy certification, Trace Labs participation.
Volunteer experience: Trace Labs and Bellingcat volunteer work show real-world commitment.

Red lines for portfolios: no doxxing, no publishing findings about private individuals, no “look what I found about this company’s employees” posts without authorization.

A Suggested Path for Students

Foundations: networking basics, Linux basics, and this OSINT unit
Practice: geolocation challenges, TryHackMe OSINT rooms, OSINT yourself (Module 9 lab)
Community: join a community (OSINT Curious, Flare Academy, Bellingcat volunteers)
Real-world practice with oversight: a Trace Labs Search Party
Specialize: threat intelligence, pentesting, fraud, investigations, or journalism
Credential (optional): a certification that matches your specialty

Key Terms

CTI (Cyber Threat Intelligence): Intelligence about cyber threats, threat actors, and their methods.
GSOC (Global Security Operations Center): A center that monitors physical security threats to an organization’s people and facilities.
Trust and safety: Teams that protect a platform’s users from fraud, abuse, and harmful content.
Due diligence: Researching a company or person before a business decision.
CTF (Capture the Flag): A competition where participants solve challenges to earn points.
GIAC: The certification body associated with SANS training courses.
Portfolio: Public examples of your work that demonstrate your skills.

Key Takeaways

OSINT is a core skill inside many roles: CTI, SOC, pentesting, fraud, investigations, journalism
Strong practitioners combine technical skills, analytical thinking, and clear writing
Curiosity, persistence, and ethical judgment matter as much as tools
Certifications: GIAC GOSI (SANS SEC497), TCM PORP, McAfee Institute C|OSINT; GCTI for threat intel
Practice legally: Trace Labs, Bellingcat challenges, Quiztime, GeoGuessr, TryHackMe, Flare Academy
Build a portfolio without exposing real people

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.