Skip to content

Cyber Effects · Work role code 121

Exploitation Analyst

Partners with cyberspace operations customers to identify access and collection gaps that can be satisfied through cyberspace exploitation. Develops detailed plans that are executed by cyber operators. Functions as navigator in cyber operations. Uses all source data to understand cyberspace targets. Employs all available techniques against targeted networks. Identifies capability gaps and submits cyberspace capability requirements to capability development organizations.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 1032Continuously validate the organization against policies/guidelines/procedures/regulations/laws to ensure compliance.Unassigned
  • 2029AApply and utilize authorized cyber capabilities to enable access to targeted networks.Unassigned
  • 2033Apply cyber collection, environment preparation and engagement expertise to enable new exploitation and/or continued collection operations, or in support of customer requirements.Unassigned
  • 2040Apply and obey applicable statutes, laws, regulations and policies.Unassigned
  • 2063Assist in the coordination, validation, and management of all-source collection requirements, plans, and/or activities.Unassigned
  • 2072Perform analysis for target infrastructure exploitation activities.Unassigned
  • 2087Collaborate with intelligence analysts/targeting organizations involved in related areas.Unassigned
  • 2089Collaborate with other customer, Intelligence and targeting organizations involved in related cyber areas.Unassigned
  • 2090Collaborate with other internal and external partner organizations on target access and operational issues.Unassigned
  • 2095Communicate new developments, breakthroughs, challenges and lessons learned to leadership, and internal and external customers.Unassigned
  • 2102Conduct analysis of physical and logical digital technologies (e.g., wireless, SCADA, telecom) to identify potential avenues of access.Unassigned
  • 2114Conduct independent in-depth target and technical analysis including target-specific information (e.g., cultural, organizational, political) that results in access.Unassigned
  • 2134Conduct target research and analysis.Unassigned
  • 2194Create comprehensive exploitation strategies that identify exploitable technical or operational vulnerabilities.Unassigned
  • 2400Examine intercept-related metadata and content with an understanding of targeting significance.Unassigned
  • 2419Collaborate with developers, conveying target and technical knowledge in tool requirements submissions, to enhance tool development.Unassigned
  • 2441Identify and evaluate threat critical capabilities, requirements, and vulnerabilities.Unassigned
  • 2461Identify gaps in our understanding of target technology and developing innovative collection approaches.Unassigned
  • 2490Identify, locate, and track targets via geospatial analysis techniques.Unassigned
  • 2534Lead or enable exploitation operations in support of organization objectives and target requirements.Unassigned
  • 2608Monitor target networks to provide indications and warning of target communications changes or processing failures.Unassigned
  • 2714Produce network reconstructions.Unassigned
  • 2718Profile network or system administrators and their activities.Unassigned
  • 2905Identify target communications within the global network.Unassigned
  • 2906Maintain awareness of target communication tools, techniques, and the characteristics of target communication networks (e.g., capacity, functionality, paths, critical nodes) and their potential implications for targeting, collection, and analysis.Unassigned
  • 2922Tip critical or time-sensitive information to appropriate customers.Unassigned
  • 5210Determine the extent of threats and recommend courses of action and countermeasures to mitigate risks.Unassigned
  • 8026Build and maintain operational and mission data in a target tracker.Unassigned
  • 8028Collaborate with analysts to ensure collected data is available to customers.Unassigned
  • 8031Conduct foreignness checks.Unassigned
  • 8035Conduct network target development in order to execute cyberspace operations.Unassigned
  • 8047Contribute to Joint Cyber Tactics Manual or other required TTP documentation.Unassigned
  • 8051Create respective Tactical level plans for cyberspace attack actions.Unassigned
  • 8075Develop target access opportunities in support of cyberspace operations.Unassigned
  • 8082Document the execution and results of a cyberspace operation.Unassigned
  • 8085Employ cyberspace capabilities to achieve mission objectives.Unassigned
  • 8093Ensure collected data is properly post-processed.Unassigned
  • 8094Ensure cyber collection and mission management data is properly post processed.Unassigned
  • 8096Evaluate EAs at the same skill level or below against JQR/JQS line items.Unassigned
  • 8103Facilitate target deconfliction.Unassigned
  • 8109Identify new exploitation, collection, or effects opportunities.Unassigned
  • 8141Participate in Operational level planning.Unassigned
  • 8147Perform overwatch of targets before, during, and after a cyberspace operation.Unassigned
  • 8148Perform Project Profile and Mission Profile management.Unassigned
  • 8153Plan network target development in order to execute cyberspace operations.Unassigned
  • 8162Provide information to aid in determining success of cyberspace operation execution.Unassigned
  • 8166Provide input for the development of Cyber Effects Operations plans and targeting requirements.Unassigned
  • 8185Reference and provide input to the Non-standard procedures and databases.Unassigned
  • 8189Review requirements to verify mission scope.Unassigned
  • 8190Sanitize and minimize operational information/TTPs to protect sources and methods.Unassigned
  • 8193Submit automated and interactive cyberspace operations for scheduling.Unassigned
  • 8194Submit capabilities requirements to developers.Unassigned
  • 8196Train and mentor EAs.Unassigned
  • 8209Utilize multifaceted intelligence resources to develop comprehensive operational strategies.Unassigned
  • 8215Submit a target deconfliction request.Unassigned
  • 8216Conduct profile/equity reviews.Unassigned
  • 8217Perform quality controls function to EAs during and post mission.Unassigned
  • 8218Submit well formatted capability requirements to appropriate development teams.Unassigned
  • 8219Provide tactical overwatch of cyber attack actions alongside operators.Unassigned
  • 8220Author/update Joint Cyber Tactics Manual and/or other required TTP documentation in accordance with policy (e.g., the OE/OA process).Unassigned
  • 8221Provide quality control of operational submissions (e.g., CTO, OPID).Unassigned
  • 8222Verify health and status of mission infrastructure at frequency (IAW SOP).Unassigned
  • 8223Write/Draft transition plans/CONOPS to move access from different cover infrastructures.Unassigned
  • 8224Provide tactical overwatch alongside an operator during execution on infrastructure handoffs/transitions.Unassigned
  • 8225Provide operational oversight for all efforts and assigned tactical elements.Unassigned
  • 8226Shape, mold, and improve the EA work role.Unassigned

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 24AKnowledge of basic concepts and practices of processing digital forensic data.Unassigned
  • 102Knowledge of programming language structures and logic.Unassigned
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 912Knowledge of collection management processes, capabilities, and limitations.Unassigned
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3095Knowledge of internet network addressing (IP addresses, classless inter-domain routing, TCP/UDP port numbering).Unassigned
  • 3106Knowledge of a wide range of basic communications media concepts and terminology (e.g., computer and telephone networks, satellite, cable, wireless).Unassigned
  • 3107Knowledge of a wide range of concepts associated with websites (e.g., website types, administration, functions, software systems, etc.).Unassigned
  • 3129Knowledge of attack methods and techniques (DDoS, brute force, spoofing, etc.).Unassigned
  • 3137Knowledge of basic malicious activity concepts (e.g., footprinting, scanning and enumeration).Unassigned
  • 3146Knowledge of both internal and external customers and partner organizations, including information needs, objectives, structure, capabilities, etc.Unassigned
  • 3179Knowledge of common networking devices and their configurations.Unassigned
  • 3191Knowledge of concepts for operating systems (e.g., Linux, Unix).Unassigned
  • 3206Knowledge of current software and methodologies for active defense and system hardening.Unassigned
  • 3225Knowledge of data communications terminology (e.g., networking protocols, Ethernet, IP, encryption, optical devices, removable media).Unassigned
  • 3235Knowledge of deconfliction processes and procedures.Unassigned
  • 3253Knowledge of encryption algorithms and cyber capabilities/tools (e.g., SSL, PGP).Unassigned
  • 3289Knowledge of how hubs, switches, routers work together in the design of a network.Unassigned
  • 3291Knowledge of how internet applications work (SMTP email, web-based email, chat clients, VOIP).Unassigned
  • 3296Knowledge of how to collect, view, and identify essential information on targets of interest from metadata (e.g., email, http).Unassigned
  • 3297Knowledge of how to establish priorities for resources.Unassigned
  • 3317Knowledge of implementing Unix and Windows systems that provide radius authentication and logging, DNS, mail, web service, FTP server, DHCP, firewall, and SNMP.Unassigned
  • 3346Knowledge of Internet and routing protocols.Unassigned
  • 3378Knowledge of methods and techniques used to detect various exploitation activities.Unassigned
  • 3407Knowledge of network security (e.g., encryption, firewalls, authentication, honey pots, perimeter protection).Unassigned
  • 3410Knowledge of network topology.Unassigned
  • 3454Knowledge of products and nomenclature of major vendors (e.g., security suites - Trend Micro, Symantec, McAfee, Outpost, Panda, Kaspersky) and how differences affect exploitation/vulnerabilities.Unassigned
  • 3479Knowledge of security hardware and software options, including the network artifacts they induce and their effects on exploitation.Unassigned
  • 3480Knowledge of security implications of software configurations.Unassigned
  • 3513Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.Unassigned
  • 3564Knowledge of the data flow from collection origin to repositories and tools.Unassigned
  • 3587Knowledge of targeting cycles.Unassigned
  • 3658Knowledge of network collection procedures to include decryption capabilities/tools, techniques, and procedures.Unassigned
  • 4387Knowledge of a Cyber Tasking Order (CTO).Unassigned
  • 4400Knowledge of basic operational infrastructure.Unassigned
  • 4407Knowledge of collection searching/analyzing techniques and tools.Unassigned
  • 4411Knowledge of command line and GUI interfaces.Unassigned
  • 4417Knowledge of concealing network presence on adversary networksUnassigned
  • 4461Knowledge of how and where to effectively deploy capabilities into target space.Unassigned
  • 4462Knowledge of how authentication and logging systems are implemented within a target network.Unassigned
  • 4483Knowledge of Malware TTPsUnassigned
  • 4494Knowledge of mission required capabilities.Unassigned
  • 4509Knowledge of OPSEC posture in a target environment (e.g., noise, stealth, situational awareness, bandwidth throttling).Unassigned
  • 4549Knowledge of the appropriate authorities, responsibilities, and approval processes that enable cyberspace operations.Unassigned
  • 4550Knowledge of the structure, architecture, design, and vulnerabilities of digital communications networks.Unassigned
  • 4561Knowledge of the JCTM and capability Operational Acceptance (OA) approval process.Unassigned
  • 4575Knowledge of the risks associated with maneuver, capabilities, and TTPs against target systems.Unassigned
  • 4577Knowledge of the SIGINT enterprise and its capabilities, limitations, and contributions to cyberspace operations missions.Unassigned
  • 4592Knowledge of virtualized and cloud based systems.Unassigned
  • 4597Knowledge of wireless network collection TTPs.Unassigned
  • 4685Knowledge of a broad range of malicious activity concepts.Unassigned
  • 4686Knowledge of the capabilities and requirements development lifecycle.Unassigned
  • 4687Knowledge of industry/commercial LoTL TTPs.Unassigned
  • 4688Knowledge of holistic TTP, employment of innovative approaches, and transcending challenges that face the operational mission.Unassigned
  • 4689Knowledge of operational mission capabilities requirements, development, and pipelines.Unassigned
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 230Skill in using knowledge management technologies.Unassigned
  • 363Skill in identifying gaps in technical capabilities.Unassigned
  • 3715Skill in creating and extracting important information from packet captures.Unassigned
  • 3718Skill in creating plans in support of remote operations.Unassigned
  • 3722Skill in data mining techniques (e.g., searching file systems) and analysis.Unassigned
  • 3740Skill in determining installed patches on various operating systems and identifying patch signatures.Unassigned
  • 3778Skill in exploiting/querying organizational and/or partner collection databases.Unassigned
  • 3801Skill in identifying the devices that work at each level of protocol models.Unassigned
  • 3815Skill in interpreting vulnerability scanner results to identify vulnerabilities.Unassigned
  • 3859Skill in reading, interpreting, writing, modifying, and executing simple scripts (e.g., PERL, VBS) on Windows and Unix systems (e.g., those that perform tasks like parsing large data files, automating manual tasks, and fetching/processing remote data).Unassigned
  • 3867Skill in recognizing technical information that may be used for leads to enable remote operations (data includes users, passwords, email addresses, IP ranges of the target, frequency in DNI behavior, mail servers, domain servers, SMTP header information).Unassigned
  • 3948Skill in verifying the integrity of all files.Unassigned
  • 4602Skill in analyzing network device configurations.Unassigned
  • 4604Skill in analyzing target communications.Unassigned
  • 4608Skill in assessing target security posture.Unassigned
  • 4621Skill in developing packet capture filters.Unassigned
  • 4624Skill in documenting the execution and results in conducting a cyber operation.Unassigned
  • 4638Skill in leading cyberspace operations in support of mission and target requirements.Unassigned
  • 4644Skill in performing research through open source tools.Unassigned
  • 4652Skill in providing geolocation information utilizing target infrastructures.Unassigned
  • 4658Skill in recognizing Technical Targeting Data to enable operations under C-S&R authority.Unassigned
  • 4673Skill in using multiple information sources to document and enrich target knowledge.Unassigned
  • 4677Skill in using non-attribution networks to obtain open source data.Unassigned
  • 4682Skill in utilizing network mapping.Unassigned
  • 4690Skill in identifying operational mission gaps within current capabilities.Unassigned

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3021Ability to collaborate effectively with others.Unassigned
  • 3022Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.Unassigned
  • 3024Ability to communicate effectively when writing.Unassigned
  • 3047Ability to function effectively in a dynamic, fast-paced environment.Unassigned
  • 3059Ability to interpret and translate customer requirements into operational action.Unassigned
  • 3101Ability to expand network access by conducting target analysis and collection in order to identify targets of interest.Unassigned
  • 4192Ability to articulate and recommend changes to policies, processes, and procedures.Unassigned
  • 4240Ability to develop, validate, and steward the EA workforceUnassigned
  • 4280Ability to identify new and emerging vulnerabilities.Unassigned
  • 4282Ability to identify opportunities for conducting server side and client side exploits.Unassigned
  • 4299Ability to manage implants and deployment strategies.Unassigned
  • 4300Ability to manage mission profiles at the tactical and operational levelUnassigned
  • 4328Ability to plan and lead interactive operations.Unassigned
  • 4329Ability to plan and manage automated operations.Unassigned
  • 4338Ability to provide instruction on technical cyber capabilities, tools, and methods.Unassigned
  • 4691Ability to utilize LoTL TTP (i.e., pivoting post initial access) in an operational setting.Unassigned
  • 4692Ability to develop and recommend analytic approaches or solutions to problems and situations for which information is incomplete or for which no precedent exists.Unassigned
  • 4693Ability to conduct tool/capability pairing.Unassigned
  • 4694Ability to provide effective project management.Unassigned
  • 4695Ability to effectively manage personnel supporting a project or operation.Unassigned
  • 4696Ability to identify and/or request a need for cyberspace capabilities, tools, or techniques.Unassigned
  • 4697Ability to apply the Hacker Methodology.Unassigned
  • 4698Ability to conduct project and admin oversight.Unassigned
  • 4699Ability to employ access assurance principles.Unassigned
  • 4700Ability to effectively collaborate and communicate the target environment.Unassigned
  • 4701Ability to integrate effective OPSEC measures into operational planning.Unassigned
  • 4702Ability to submit requests for additional capabilities for current operational mission.Unassigned
  • 4703Ability to impart knowledge and advance the mission across the CMF.Unassigned

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.