Cyber Intelligence

What does the Cyber Intelligence career field do?

: Responsible for discovering and analyzing computer network data, recognizing and assessing usable intelligence from a variety of sources, and influencing offensive and defensive cyber operations. Conducts research and analysis on potential cyber targets, including foreign nations, terrorist groups, and other entities that pose a threat to the United States. Develops offensive cyber operations to deny, degrade, disrupt, or destroy enemy networks and systems, including identifying vulnerabilities and developing exploit strategies. Ensures that all offensive cyber operations are conducted in accordance with applicable laws, regulations, and military rules of engagement. Conducts penetration testing and vulnerability assessments to identify potential weaknesses in Air Force networks and information or weapons systems. Cyber Intelligence Analysts assist and advise leaders across the Air Force, United States Cyber Command, the National Security Agency, and other partners within the Intelligence Community to plan, initiate, guide, and execute cyber operations. Related DoD Occupational Subgroups: 123200 and 124300.

Duties and responsibilities

• General duties: Provides cyber intelligence planning and operations support to cyberspace and computer network operations. Supports analytical aspects of various Air Force and Joint intelligence, surveillance, and reconnaissance operations by collating, analyzing, evaluating, and disseminating cyber intelligence information. Produces cyber technical products to include target assessments, adversary studies of the cyberspace operational environment, situation reports, and other intelligence products as required. Utilizes all- source intelligence information to produce and present topical high-interest technical and operational intelligence briefings to all levels of command. Creates and maintains technical and operational databases using diverse computer hardware and software applications.
• Computer Network Operations: Conducts global collection, exploitation, and signals analysis critical to cryptologic and cyber operations missions. Counters emerging target technologies and gains new access to adversary communications. Exploits and maintains access to worldwide networks. Delivers information in compliance with legal, policy, formatting, and timeliness requirements. Utilizes digital network analysis to conduct computer network exploitation operations on foreign targets that directly enable computer network defense of critical US systems and infrastructure. Provides projection of power capabilities to commanders across US major commands.
• Cyberspace Operations: Provides key intelligence enabling offensive and defensive cyberspace operations for US Cyber Command. Conducts analysis of metadata, target analysis, and target research. Identifies target communications within global networks and conducts target technology trends research. Performs global network analysis and mapping, to include technology, activities, and communications, in order to determine target traffic behavior patterns. Analyzes exploitation opportunities for information systems and infrastructure. Utilizes methods and applications of tools used for exploitation and analysis of computer systems and network vulnerabilities. Provides intelligence planning and operations support for target delivery, development, and reporting for cyberspace operations.
• Intelligence Training Supporting Cyber Operations: Instructs military personnel on cyber intelligence collection, analysis, and reporting requirements and procedures. Collates intelligence and operations materials to impart proper tradecraft supporting air, space, and cyberspace signals intelligence analysis. Drives development of discovery and tradecraft to broadly enable cryptologic, DoD, and Air Force missions. Integrates information assurance, cyber, cryptologic authorities, and data to evolve development of tradecraft and generate measurable mission outcomes.
• Processes, exploits, and disseminates intelligence products and conducts analysis concerning threat countries or targets of interest via written and/or verbal means. These products provide specificity and knowledge to commanders and national leaders to impact tactical through strategic level decision making processes.
• Cyber Network Defense and Malware Analysis: Utilizes various analytical tools and techniques to identify and track potential cyber threats, malware, and malicious cyber actors. Collaborates with intelligence analysts, network defenders, and information technology professionals to ensure timely and accurate discovery and reporting of cyber threats to Department of Defense and Intelligence Community stakeholders

Specialty qualifications

Knowledge. Must gain and maintain knowledge of global communications procedures; analytical techniques; organization of the national intelligence structure; intelligence organizations and systems; Information Operations; organization of designated military forces; geography; collection and reporting, systems, principles, methods, and procedures; effective writing principles; oral and written intelligence information presentation; and directives for handling, disseminating, and safeguarding classified information.

Education. For entry into this specialty, award of high school diploma General Education Development equivalency required. Courses in composition, speech, English, geography, world history, statistics, algebra, geometry, critical thinking, and computer applications is desirable.

Training. The following training is mandatory for award of the AFSC indicated:

• 1N431A. Completion of the Joint Cyber Analysis Course and Cyber Intelligence Analysis Apprentice Course.
• For U.S. Space Force, completion of the Joint Cyber Analysis Course, Cyber Intelligence Analysis Apprentice Course, and Space Warfighter Intelligence Formal Training Unit is mandatory until replaced by new courses as determined by US Space Force.

Experience. The following experience is mandatory for award and retention of the AFSC indicated:

• 1N451A. Qualification in and possession of AFSC 1N431A and experience performing cryptologic activities.
• 1N471A. Qualification in and possession of AFSC 1N451A and experience performing or supervising cryptologic activities.

Other. The following are mandatory as indicated:

• For entry into this specialty:
• No speech disorders or noticeable communications deficiencies as defined by AFI 48-123, Medical Examinations and Standards.
• Must obtain a minimum score of 46 required on the Tailored Adaptive Personality Assessment System (TAPAS)/ Armed Services Vocational Aptitude Battery (ASVAB) selection model.
• See attachment 4 for additional entry requirements.
• For award and retention of AFSC 1N4X1X, the following are mandatory:
• When required for a current or future assignment, Airmen must successfully complete a Counterintelligence (CI) polygraph or meet all customer access eligibility requirements. After 12 months from the date of requirement, Airmen who fail to successfully complete a polygraph or do not meet mission, system, and/or facility access eligibility requirements should be considered for retraining or separation.
• Maintain local network access IAW AFI 17-130, Cybersecurity Program Management and AFMAN 17-1301, Computer Security.
• 1N451A and 1N471A. Completion of the Joint Cyber Analysis course for RegAF (effective 1 Aug 2019 for Air Force Reserve component) airmen is mandatory for those in grades TSgt (E-6) and below with less than 15 years of time in service.
• Specialty requires routine access to Tier 5 (T5) information, systems, or similar classified environment.
• Completion and favorable adjudication of a current T5 Investigation IAW DoDM 5200.02, AFMAN 16-1405, Air Force Personnel Security Program, is mandatory. NOTE: Initial attendance in 1N4X1A AFSC awarding course without a completed T5 clearance is authorized provided an interim T5 clearance eligibility has been granted IAW Intelligence Community Directive (ICD) 704. Airmen who cannot obtain at least an Interim T5 clearance for programmed class-start are not eligible for entry into the AFSC.

Civilian career paths

Comparable civilian careers for this field pay roughly $74,650–$151,150 per year (median salaries; varies by role and location):

• Cartographers and Photogrammetrists: $68,380
• Computer and Information Systems Managers: $151,150
• Computer Systems Analysts: $93,730
• Database Administrators   $98,860
• Detectives and Criminal Investigators: $86,940
• Information Security Analysts: $103,590
• Intelligence Analysts: $86,940
• Management Analysts: $87,660
• Network and Computer Systems Administrators: $84,810
• Operations Research Analysts: $86,200
• Technical Writers: $74,650