Cyber Warfare Operations

What does the Cyber Warfare Operations career field do?

Performs duties to develop, sustain, and enhance cyberspace capabilities to defend national interests from attack and to create effects in cyberspace to achieve national objectives. Plans and conducts Cyber Network Operations (CNO)/cryptologic activities, Offensive Cyberspace Operations (OCO), Defensive Cyberspace Operations (DCO), and Department of Defense (DoD) Information Network (DoDIN) Operations using established tactics, techniques, and procedures to achieve Service, Combatant Command (CCMD), Cyber Mission Force (CMF) and national objectives. Executes command and control (C2) synchronization of assigned cyberspace forces and de-conflicts cyberspace operations across the kinetic and non-kinetic spectrum. Supports cyberspace capability development, testing, and implementation. Partners with Joint, Interagency, Intergovernmental, and Multinational forces to detect, deny, degrade, disrupt, destroy, manipulate, and mitigate adversarial access to sovereign national or partner cyberspace systems. Related DoD Occupational Subgroup: 127000.

Duties and responsibilities

• Conducts OCO. Plans and/or performs OCO actions to project power by application of force in, from, and through cyberspace. OCO may include targeting adversary functions through cyberspace or using first-order effects through cyberspace to initiate cascading effects into the physical domain. These effects may include a variety of valid military targets such as weapon systems, C2 processes, and critical infrastructure/key resources. Integrates OCO actions into CCMD or warfighting boards, bureaus, cells, centers, and working groups as required for inclusion into operational and strategic planning efforts. 1B4X1 CMF OCO work roles include but are not limited to: Cyberspace Operator, Planner, and Cyber Capability Developer.
• Conducts DCO. Plans and/or conducts DCO actions to defend the DoDIN and other friendly cyberspace. DCO includes threatinformed cyberspace defense operations to preserve the ability to utilize friendly cyberspace capabilities and protect data, networks, net-centric capabilities, and other designated systems. Cyber warfare operators conduct both DCO-Internal Defense Measures (DCO-IDM) and DCO-Response Actions (DCO-RA). DCO-IDM duties performed by cyber warfare operators do not include passive defense measures intended to maintain and operate the DODIN such as configuration control, patching, or firewall operations. Cyber warfare operator missions conducted as part of DCO-IDM should utilize the workforce’s highly specialized skills such as pro-active and aggressive internal threat hunting for advanced and/or persistent threats, reverse engineering, and malware analysis. Integrates DCO actions into CCMD, warfighting and/or service boards, bureaus, cells, centers, and working groups as required for inclusion into operational and strategic planning efforts. 1B4X1 CMF DCO work roles include but are not limited to: Host Analyst, Network Analyst, Cyber Crew Lead, Mission Element Lead, Planner, Non-commissioned Officer In Charge (NCOIC), Data Engineer, and Analytic Support Officer.
• Conducts CNO/cryptologic activities. Aids planning and conducts operations in support of CNO/cryptologic activities. Employs techniques to collect, identify, and exploit appropriate communications and artifacts of potential intelligence value. Performs data analysis to help judge relevant cyber intelligence information value, provides risk assessments to aid operational decision-making, de-conflicts threats to cryptologic system employment, and issues guidance for service and joint partners.
• Performs cyberspace mission planning and execution. Provides tailored planning, threat analysis, and cyber expertise necessary to synchronize cyberspace operations capabilities and functions into the Joint Planning Process. Supports integration and collection of combat assessment indicators. Develops operational tasks and orders, evaluates mission feedback, and aligns strategic intent.
• Develops and executes tactics, techniques, and procedures (TTPs) for cyberspace operations. Analyzes national defense guidance and strategic objectives to create operational policies and plans. Implements policies through the development of TTPs in support of assigned cyber capability execution. Applies forensic, malware analysis, and reverse engineering TTPs to determine the extent of battle damage sustained during cyberspace attacks. These efforts may require partnering with other Joint, Interagency, Intergovernmental, and Multinational forces.
• Performs research and development in order to integrate cyber warfare operations into information warfare plans and programs. This may include developmental testing and evaluation or operational testing and evaluation to support new capability development or to support modifications of existing capabilities. Assesses and reverse engineers network nodes and infrastructure devices (to include operating systems and software applications) to determine capabilities, functionalities, limitations, and vulnerabilities.
• Establishes performance standards, trains, and conducts evaluations to ensure personnel are proficient, qualified, and certified. Plans, conducts, and evaluates exercises to enhance operational readiness and ensure adherence to operational procedures.
• Duties and responsibilities of a 1B4X1 do not include contract management, oversight and/or Contractor Officer Representative (COR) responsibilities.

Specialty qualifications

Knowledge. Mandatory knowledge includes knowledge of cyber warfare operations fundamentals, laws and ethics, intelligence, cyberspace systems and platforms, cyber warfare operations, planning, networking fundamentals, operating systems, Air Force basic cyber operations, defensive cyber operations, and offensive cyber operations.

Education. For entry into this specialty, prior coursework in Science, Technology, Engineering, and Mathematics (STEM) is desirable. An Associate’s degree or higher in related STEM fields and/or an Information Technology (IT) certification are also desirable.

Training. For award of AFSC 1B431, completion of the Cyber Warfare Operations initial skills course is mandatory unless specifically waived by the 1B Career Field Manager

Experience. The following experience is mandatory for award of the AFSC indicated:

• 1B431. Completion of the Cyber Warfare Operations Apprentice Course (E3ALR1B431 0A1A; PDS Code: 02S)
• 1B451. Qualification in and possession of AFSC 1B431 and experience performing functions such as CNO/cryptologic activities, OCO, DCO, or DoDIN Operations.
• 1B471. Qualification in and possession of AFSC 1B451 and experience performing and supervising functions such as CNO/cryptologic activities, OCO, DCO, or DoDIN Operations.
• 1B491. Qualification in and possession of AFSC 1B471 and experience performing and supervising functions such as CNO/cryptologic activities, OCO, DCO, or DoDIN Operations.

Other. The following are mandatory as indicated:

• For entry into this specialty:
• A minimum score of 70 on the Air Force Electronic Data Processing Test (EDPT).
• Armed Services Vocational Aptitude Battery (ASVAB) or Armed Forces Classification Test (AFCT) must have been taken within 2 years from date retraining application is submitted.
• See attachment 4 for additional entry requirements.
• For award and retention of these AFSCs:
• Must attain and maintain foundational qualification IAW DAFMAN 17-1303, Cybersecurity Workforce Improvement as specified by AFSC and/or work role SEI.
• Must maintain local network access IAW AFI 17-130, Cybersecurity Program Management, and AFMAN 17-1301, Computer Security (COMPUSEC)
• This specialty requires routine access to Top Secret material or similar environments. For award and retention of 1B431, completion of a current Tier 5 (T5) investigation IAW DoDM 5200.02_AFMAN 16-1405, Air Force Personnel Security Program Management is mandatory. Initial attendance in the 1B431 AFSC awarding course without a completed T5 is authorized, provided that interim Sensitive Compartmented Information (SCI) eligibility has been granted IAW Investigation IAW DoDM 5200.02_AFMAN 16-1405 and Intelligence Community Directive (ICD) 704. Airmen who cannot obtain at least an interim SCI in advance of their programmed class graduation are not eligible for entry into the 1B431 AFSC awarding course.

Civilian career paths

Comparable civilian careers for this field pay roughly $77,420–$151,150 per year (median salaries; varies by role and location):

• Business Continuity Planners: $77,420
• Computer and Information Systems Managers: $151,150
• Computer Network Architects: $116,780
• Computer Network Support Specialists: $65,450
• Computer Systems Analysts: $93,730
• Financial Risk Specialists: $83,660
• Information Security Analysts: $103,590
• Intelligence Analysts: $86,940
• Network and Computer Systems Administrators: $84,810
• Security Management Specialists: $77,420
• Software Quality Assurance Analysts and Testers: $110,140
• Web Administrators: $92,870