Males: 545

Females: 22

Total: 567

Conducts Offensive Cyber Operations (OCO). Plans and/or performs OCO actions to project power by application of force in, from, and through cyberspace.

OCO may include targeting adversary functions through cyberspace or using first-order effects through cyberspace to initiate cascading effects into the physical domain. 

These effects may include a variety of valid military targets such as weapon systems, Command and Control processes, and critical infrastructure/key resources. Integrates OCO actions into Combatant Command or warfighting boards, bureaus, cells, centers, and working groups as required for inclusion into operational and strategic planning efforts.

1B4X1 Cyber Mission Force OCO work roles include but are not limited to:

• Interactive Operator.
• Access Operator.
• Cyber Planner.
• Cyber Fires Planner.
• Capability Developer.

Conducts Defensive Cyber Operations (DCO). Plans and/or conducts DCO actions to defend DoD and other friendly cyberspace.

DCO includes passive and active cyberspace defense operations to preserve the ability to utilize friendly cyberspace capabilities and protect data, networks, net-centric capabilities, and other designated systems. Cyber warfare operators conduct both DCO-Internal Defense Measures (DCO-IDM) and DCO-Response Actions (DCO-RA).

DCO-IDM duties performed by cyber warfare operators do not include passive defense measures intended to maintain and operate the DODIN such as configuration control, patching, or firewall operations.

Cyber warfare operator missions conducted as part of DCO-IDM should utilize the workforce’s highly specialized skills such as pro-active and aggressive internal threat hunting for advanced and/or persistent threats, reverse engineering, and malware analysis.

Integrates DCO actions into Combatant Command, warfighting, or service boards, bureaus, cells, centers, and working groups as required for inclusion into operational and strategic planning efforts.

1B4X1 Cyber Mission Force DCO work roles include but are not limited to:

• Operations Planner.
• Host Systems Analyst.
• Network Systems Analyst.
• Network Systems Technician.
• Data Engineer.
• Data Analytics Support.
• Malware Analyst.

Conducts Computer Network Operations (CNO). Aids planning and conducts cryptologic activities to support CNO. Employs techniques to collect, identify, and exploit appropriate communications and artifacts of potential intelligence value.

Performs data analysis to help judge relevant cyber intelligence information value, provides risk assessments to aid operational decision-making, de-conflicts threats to cryptologic system employment, and issues guidance for service and joint partners.

Performs cyberspace mission planning and execution. Provides tailored planning, threat analysis, and cyber expertise necessary to synchronize cyberspace operations capabilities and functions into the Joint Planning Process.

Helps integrate and gather combat assessment indicators. Develops operational tasks and orders, evaluates mission feedback, and aligns with strategic intent.

Develops and executes tactics, techniques, and procedures(TTPs) for cyberspace operations. Analyzes national defense guidance and strategic objectives to create operational policies and plans. Implements policies through the development of TTPs in support of assigned cyber capability execution.

Applies forensic, malware analysis, and reverse engineering TTPs to determine the extent of the battle damage sustained during cyberspace attacks. These efforts may require partnering with other Joint, Interagency, Intergovernmental, and Multinational forces.

Performs research and development in support of information warfare. This may include developmental testing and evaluation or operational testing and evaluation to support new capability development or to support modifications of existing capabilities.

Assesses and reverse engineers network nodes and infrastructure devices (to include operating systems and software applications) to determine capabilities, functionalities, limitations, and vulnerabilities.

Establishes performance standards, trains, and conducts evaluations to ensure personnel are proficient, qualified, and certified. Plans, conducts, and evaluates exercises to enhance operational readiness and ensure adherence to operational procedures.

Duties and responsibilities of a 1B4X1 do not include contract management, oversight and/or Contractor Officer Representative (COR) responsibilities.

Knowledge- 

Knowledge is mandatory of: 

• Computer operating systems.
• Software applications.
• Database concepts.
• Common programming languages.
• Hardware components.
• Networking fundamentals (such as network protocols, Network addressing, Network infrastructure).
• Telecommunications theory.
• Data communications.

Airmen in this specialty must be proficient on wireless technologies and understand cryptography, to include utilization and exploitation techniques. Airmen must also have an understanding of applicable laws governing cyber operations.

Education-
For entry into this specialty, prior coursework in Science, Technology, Engineering, and Mathematics (STEM) is desirable. An Associate’s degree or higher in related STEM fields and/or an Information Technology (IT) certification are also desirable.

Training-
For award of AFSC 1B431, completion of the Cyber Warfare Operations initial skills course is mandatory unless specifically waived by the 1B Career Field Manager

Experience-
The following experience is mandatory for award of the AFSC indicated:

• 1B451. Qualification in and possession of AFSC 1B431 and experience performing functions such as offensive and defensive cyber operations.
• 1B471. Qualification in and possession of AFSC 1B451. Also, experience performing and supervising functions such as offensive and defensive cyber operations.

Other-
The following are mandatory as indicated:

For entry into this specialty:

• A minimum score of 70 on the Air Force Electronic Data Processing Test (EDPT).
• Armed Services Vocational Aptitude Battery (ASVAB) must have been taken within 2 years from date retraining application is submitted.

For award and retention of these AFSCs:

• Must attain and maintain foundational work-role qualification IAW DoDM 8140.01AA, Cyberspace Workforce Qualification and Management Program.
• Currently, the Air Force mandates cybersecurity workforce position qualification by requiring cyber workforce personnel to maintain a minimum Information Assurance Technical Level II certification in accordance with AFMAN 17- 1303, Information Assurance Workforce Improvement Program. Certification will continue to be required until DoDM 8140.01AA publication AND upon modification of Air Force certification requirement via AFMAN 17-1303 modification, supersession, or rescission, if determined applicable. In this context, the term cybersecurity workforce is inclusive of 1B work-roles IAW AFMAN 17- 1303.
• Specialty requires routine access to Tier 5 (T5) information, systems, or similar classified environments.
• Must maintain local network access IAW AFI 17-130, Cybersecurity Program Management, and AFMAN 17-1301, Computer Security (COMPUSEC).
• Completion of a current T5 Investigation IAW DoDM 5200.02_AFMAN 16-1405, Air Force Personnel Security Program Management.
• Award of the entry level without a completed T5 Investigation is authorized provided an interim Top Secret security clearance has been granted according to DoDM 5200.02, AFMAN 16-1405.

NOTE: Initial attendance of 1B431 AFSC-awarding course without a completed SSBI is authorized provided an interim Sensitive Compartmented Information (SCI) eligibility has been granted IAW Intelligence Community Directive (ICD) 704. Airmen who cannot obtain at least an Interim SCI for programmed class start are not eligible for entry into the AFSC. Award of the 3-skill level without a completed SSBI is authorized provided an interim Top-Secret clearance has been granted according to DoDM 5200.02_AFMAN 16-1405.

High Salary: $151,150

Low Salary: $77,420