Skip to content

Cyber Effects · Work role code 322

Cyberspace Operator

Cyberspace Operators use a wide range of software applications for network navigation, tactical forensic analysis, surveillance and reconnaissance, and executing on-net operations in support of offensive cyberspace operations when directed.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 2020Analyze internal operational architecture, tools, and procedures for ways to improve performance.Unassigned
  • 2020AAnalyze target operational architecture for ways to gain access.Unassigned
  • 2088Collaborate with development organizations to create and deploy the tools needed to achieve objectives.Unassigned
  • 2119Conduct network scouting/scanning and vulnerability analyses of systems within a network.Unassigned
  • 2122Conduct on-net activities to control and exfiltrate data from deployed technologies.Unassigned
  • 2123Conduct on-net and off-net activities to control, and exfiltrate data from deployed, automated technologies.Unassigned
  • 2124Conduct open source data collection via various online tools.Unassigned
  • 2133Conduct survey of computer and digital networks.Unassigned
  • 2205Deploy tools to a target and utilize them once deployed (e.g., backdoors, sniffers).Unassigned
  • 2226Detect exploits against targeted networks and hosts and react accordingly.Unassigned
  • 2353Edit or execute simple scripts (e.g., PERL, VBS) on Windows and UNIX systems.Unassigned
  • 2477Identify potential points of strength and vulnerability within a network.Unassigned
  • 2559Maintain situational awareness and functionality of organic operational infrastructure.Unassigned
  • 2660Conduct cyber activities to degrade/remove information resident in computers and computer networks.Unassigned
  • 2708Process exfiltrated data for analysis and/or dissemination to customers.Unassigned
  • 8001Advise leadership on operational tradecraft, emerging technology, and technical health of the force.Unassigned
  • 8015Approve remediation actions.Unassigned
  • 8017As authorized, train cyberspace operators at one’s certification level or below.Unassigned
  • 8020Assess the technical health of the cyberspace operator work role.Unassigned
  • 8021Assess, recommend, and evaluate remediation actions.Unassigned
  • 8030Conduct cyber activities to deny, degrade, disrupt, destroy, manipulate, (D4M).Unassigned
  • 8037Conduct post-mission actions.Unassigned
  • 8039Conduct pre-mission actions.Unassigned
  • 8040Conduct pre-operation research and prep.Unassigned
  • 8052Create/normalize/document/evaluate TTPs in cyberspace operations.Unassigned
  • 8067Develop and/or inform risk assessments.Unassigned
  • 8071Develop Operational Training Solutions.Unassigned
  • 8073Develop remediation actions.Unassigned
  • 8074Develop risk assessments for non-standard events and ad hoc tradecraft.Unassigned
  • 8083Employ collection TTPs in cyberspace operations.Unassigned
  • 8084Employ credential access TTPs in cyberspace operations.Unassigned
  • 8086Employ discovery TTPs in cyberspace operations.Unassigned
  • 8087Employ exfiltration TTPs in cyberspace operations.Unassigned
  • 8088Employ lateral movement TTPs in cyberspace operations.Unassigned
  • 8089Employ TTPs in categories at one’s certification level or below.Unassigned
  • 8097Evaluate cyberspace operator performance at one’s certification level or below.Unassigned
  • 8112Identify targets of opportunity in order to influence operational planning.Unassigned
  • 8113Identify the appropriate operating authorities and guidance.Unassigned
  • 8130Maintain operational and technical situational awareness during operations.Unassigned
  • 8158Produce strategy to inform commander's decision making process.Unassigned
  • 8167Provide input to mission debrief.Unassigned
  • 8168Provide input to operational policy.Unassigned
  • 8169Provide input to post mission planning.Unassigned
  • 8170Provide input to pre-mission planning.Unassigned
  • 8175Provide quality control of operations and cyberspace operator products at one’s certification level or below.Unassigned
  • 8181Recognize and respond to indicators of compromise (IOC).Unassigned
  • 8183Recognize and respond to events that change risk.Unassigned
  • 8184Record and document activities during cyberspace operations.Unassigned
  • 8192Steward the cyberspace operator work role.Unassigned
  • 8197Train cyberspace operators at their certified level or below.Unassigned

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 49Knowledge of host/network access control mechanisms (e.g., access control list).Unassigned
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Unassigned
  • 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Unassigned
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 264Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).Unassigned
  • 286Knowledge of file extensions (e.g., .dll, .bat, .zip, .pcap, .gzip).Unassigned
  • 287Knowledge of file system implementations (e.g., New Technology File System [NTFS], File Allocation Table [FAT], Extended File System [EXT]).Unassigned
  • 344Knowledge of virtualization technologies and virtual machine development and maintenance.Unassigned
  • 1033Knowledge of basic system administration, network, and operating system hardening techniques.Unassigned
  • 1063AKnowledge of operating system structures and internals (e.g., process management, directory structure, installed applications).Unassigned
  • 1064Knowledge of Extensible Markup Language (XML) schemas.Unassigned
  • 1094Knowledge of debugging procedures and tools.Unassigned
  • 1128AKnowledge of database access application programming interfaces (APIs) (e.g., Java Database Connectivity [JDBC]).Unassigned
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3125Knowledge of assembly code.Unassigned
  • 3130Knowledge of auditing and logging procedures (including server-based logging).Unassigned
  • 3133Knowledge of basic back-up and recovery procedures including different types of backups (e.g., full, incremental).Unassigned
  • 3140Knowledge of basic programming concepts (e.g., levels, structures, compiled vs. interpreted languages).Unassigned
  • 3141Knowledge of basic software applications (e.g., data storage and backup, database applications) and their vulnerabilities.Unassigned
  • 3144Knowledge of basic wireless applications, including vulnerabilities in various types of wireless applications.Unassigned
  • 3206Knowledge of current software and methodologies for active defense and system hardening.Unassigned
  • 3235Knowledge of deconfliction processes and procedures.Unassigned
  • 3253Knowledge of encryption algorithms and cyber capabilities/tools (e.g., SSL, PGP).Unassigned
  • 3259Knowledge of enterprise-wide information management.Unassigned
  • 3261Knowledge of evasion strategies and techniques.Unassigned
  • 3267Knowledge of deconfliction reporting to include external organization interaction.Unassigned
  • 3267AKnowledge of internal and external partner reporting.Unassigned
  • 3270Knowledge of forensic implications of operating system structure and operations.Unassigned
  • 3286Knowledge of host-based security products and how they affect exploitation and vulnerability.Unassigned
  • 3317Knowledge of implementing Unix and Windows systems that provide radius authentication and logging, DNS, mail, web service, FTP server, DHCP, firewall, and SNMP.Unassigned
  • 3346Knowledge of Internet and routing protocols.Unassigned
  • 3374Knowledge of malware.Unassigned
  • 3378Knowledge of methods and techniques used to detect various exploitation activities.Unassigned
  • 3399Knowledge of network administration.Unassigned
  • 3402Knowledge of network construction and topology.Unassigned
  • 3441Knowledge of physical and logical network devices and infrastructure to include hubs, switches, routers, firewalls, etc.Unassigned
  • 3454Knowledge of products and nomenclature of major vendors (e.g., security suites - Trend Micro, Symantec, McAfee, Outpost, Panda, Kaspersky) and how differences affect exploitation/vulnerabilities.Unassigned
  • 3473Knowledge of satellite-based communication systems.Unassigned
  • 3479Knowledge of security hardware and software options, including the network artifacts they induce and their effects on exploitation.Unassigned
  • 3480Knowledge of security implications of software configurations.Unassigned
  • 3508Knowledge of structure, approach, and strategy of exploitation tools (e.g., sniffers, keyloggers) and techniques (e.g., gaining backdoor access, collecting/exfiltrating data, conducting vulnerability analysis of other systems in the network).Unassigned
  • 3513Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.Unassigned
  • 3525Knowledge of organizational and partner policies, tools, capabilities, and procedures.Unassigned
  • 3534Knowledge of target, including related current events, communication profile, actors, and history (language, culture) and/or frame of reference.Unassigned
  • 3543Knowledge of the basic structure, architecture, and design of modern communication networks.Unassigned
  • 3561Knowledge of the common networking and routing protocols(e.g., TCP/IP), services (e.g., web, mail, DNS), and how they interact to provide network communications.Unassigned
  • 3579Knowledge of the fundamentals of digital forensics in order to extract actionable intelligence.Unassigned
  • 3587Knowledge of targeting cycles.Unassigned
  • 3631Knowledge of internal and external partner organization capabilities and limitations (those with tasking, collection, processing, exploitation and dissemination responsibilities).Unassigned
  • 3637Knowledge of Unix/Linux and Windows operating systems structures and internals (e.g., process management, directory structure, installed applications).Unassigned
  • 3642Knowledge of various types of computer architectures.Unassigned
  • 3644Knowledge of virtual machine technologies.Unassigned
  • 3658Knowledge of network collection procedures to include decryption capabilities/tools, techniques, and procedures.Unassigned
  • 4086Knowledge of relevant laws, regulations, and policies.Unassigned
  • 4388Knowledge of access control models (Role Based Access Control, Attribute Based Access Control).Unassigned
  • 4391Knowledge of advanced redirection techniques.Unassigned
  • 4393Knowledge of appropriate/inappropriate information to include in operational documentation (e.g., OPNOTES, technical summaries, action maps, etc.)Unassigned
  • 4395Knowledge of basic client software applications and their attack surfaces.Unassigned
  • 4396Knowledge of basic cloud based technologies and concepts.Unassigned
  • 4399Knowledge of basic Embedded Systems concepts.Unassigned
  • 4402Knowledge of basic redirection techniques (e.g., IP Tables, SSH Tunneling, netsh)Unassigned
  • 4403Knowledge of basic server software applications and their attack surfaces.Unassigned
  • 4404Knowledge of code injection and its employment in cyberspace operations.Unassigned
  • 4414Knowledge of common network administration best practices and the impact to operations.Unassigned
  • 4419Knowledge of credential sources and restrictions related to credential usageUnassigned
  • 4437Knowledge of device reboots, including when they occur and their impact on tool functionalityUnassigned
  • 4444Knowledge of evolving technologies.Unassigned
  • 4447Knowledge of factors that would suspend or abort an operation.Unassigned
  • 4458Knowledge of historical data relating to particular targets and projects, prior to an operation to include reviewing TECHSUMs, previous OPNOTEs, etc.Unassigned
  • 4463Knowledge of how computer programs are executedUnassigned
  • 4464Knowledge of how host-based security products, logging, and malware may affect tool functionalityUnassigned
  • 4465Knowledge of how other actors may affect operationsUnassigned
  • 4466Knowledge of how race conditions occur and can be employed to compromise shared resourcesUnassigned
  • 4482Knowledge of malware triage.Unassigned
  • 4485Knowledge of methods and procedures for sending a payload via an existing implantUnassigned
  • 4486Knowledge of methods, strategies, and techniques of evading detection while conducting operations, such as noise, stealth, situational awareness, etc.Unassigned
  • 4487Knowledge of methods, tools, and procedures for collecting information, including accessing databases and file systemsUnassigned
  • 4488Knowledge of methods, tools, and procedures for exploiting target systemsUnassigned
  • 4489Knowledge of methods, tools, and techniques used to determine the path to a target host/network (e.g., identify satellite hops).Unassigned
  • 4496Knowledge of models for examining cyber threats (e.g., cyber kill chain, MITRE ATT&CK).Unassigned
  • 4498Knowledge of modes of communication used by a target, such as cable, fiber optic, satellite, microwave, VSAT, or combinations of these.Unassigned
  • 4502Knowledge of open source tactics that enable initial access (e.g., social engineering, phishing)Unassigned
  • 4503Knowledge of operating system command shells, configuration data.Unassigned
  • 4505Knowledge of operational infrastructureUnassigned
  • 4508Knowledge of operational security, logging, admin concepts, and troubleshooting.Unassigned
  • 4510Knowledge of password cracking techniques.Unassigned
  • 4519Knowledge of process migrationUnassigned
  • 4540Knowledge of system administration concepts for distributed or managed operating environments.Unassigned
  • 4541Knowledge of system administration concepts for stand alone operating systems.Unassigned
  • 4542Knowledge of system callsUnassigned
  • 4552Knowledge of the components of an authentication system.Unassigned
  • 4553Knowledge of the concept of an advanced persistent threat (APT)Unassigned
  • 4563Knowledge of the location and use of tool documentation.Unassigned
  • 4564Knowledge of the methods and procedures for communicating with tools/modules, including the use of listening posts.Unassigned
  • 4565Knowledge of the methods of persistence.Unassigned
  • 4567Knowledge of the Mission Improvement ProcessUnassigned
  • 4571Knowledge of the Plan, Brief, Execute, and Debrief processUnassigned
  • 4581Knowledge of the tactics development processUnassigned
  • 4586Knowledge of threats to OPSEC when installing, using, modifying, and uninstalling tools.Unassigned
  • 4587Knowledge of tool release/testing processUnassigned
  • 4593Knowledge of VPNs, their purpose, and how they can be leveraged.Unassigned
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 350Skill in analyzing memory dumps to extract information.Unassigned
  • 3670Skill in analyzing terminal or environment collection data.Unassigned
  • 3690Skill in assessing current tools to identify needed improvements.Unassigned
  • 3695Skill in auditing firewalls, perimeters, routers, and intrusion detection systems.Unassigned
  • 3722Skill in data mining techniques (e.g., searching file systems) and analysis.Unassigned
  • 3740Skill in determining installed patches on various operating systems and identifying patch signatures.Unassigned
  • 3777Skill in reverse engineering (e.g., hex editing, binary packaging utilities, debugging, and strings analysis) to identify function and ownership of remote tools.Unassigned
  • 3779Skill in extracting information from packet captures.Unassigned
  • 3801Skill in identifying the devices that work at each level of protocol models.Unassigned
  • 3815Skill in interpreting vulnerability scanner results to identify vulnerabilities.Unassigned
  • 3817Skill in knowledge management, including technical documentation techniques (e.g., Wiki page).Unassigned
  • 3859Skill in reading, interpreting, writing, modifying, and executing simple scripts (e.g., PERL, VBS) on Windows and Unix systems (e.g., those that perform tasks like parsing large data files, automating manual tasks, and fetching/processing remote data).Unassigned
  • 3871Skill in remote command line and Graphical User Interface (GUI) tool usage.Unassigned
  • 3883Skill in server administration.Unassigned
  • 3897Skill in technical writing.Unassigned
  • 3899Skill in testing and evaluating tools for implementation.Unassigned
  • 3929Skill in using tools, techniques, and procedures to remotely exploit and establish persistence on a target.Unassigned
  • 3929ASkill in using tools, techniques, and procedures to exploit a target.Unassigned
  • 3948Skill in verifying the integrity of all files.Unassigned
  • 4628Skill in enumerating a host (e.g., file systems, host meta data host characteristics).Unassigned
  • 4641Skill in manipulating firewall/host based security configuration and rulesets.Unassigned
  • 4663Skill in retrieving memory resident data.Unassigned
  • 4670Skill in transferring files to target devices (e.g., scp, tftp, http, ftp).Unassigned
  • 4674Skill in using network enumeration and analysis tools, both active and passive.Unassigned

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3003Ability to adjust to and operate in a diverse, unpredictable, challenging, and fast-paced work environment.Unassigned
  • 3007Ability to analyze malware.Unassigned
  • 3022Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.Unassigned
  • 3059Ability to interpret and translate customer requirements into operational action.Unassigned
  • 3063Ability to monitor system operations and react to events in response to triggers and/or observation of trends or unusual activity.Unassigned
  • 3069Ability to produce technical documentation.Unassigned
  • 3103AAbility to identify/describe target vulnerability.Unassigned
  • 3658BAbility to perform network collection tactics, techniques, and procedures to include decryption capabilities/tools.Unassigned
  • 3859AAbility to read, interpret, write, modify, and execute simple scripts (e.g., PERL, VBS) on Windows and Unix systems (e.g., those that perform tasks like parsing large data files, automating manual tasks, and fetching/processing remote data).Unassigned
  • 4191Ability to apply tradecraft to minimize risk of detection, mitigate risk, and minimize creation of behavioral signatureUnassigned
  • 4199Ability to characterize a target admin/user's technical abilities, habits, and skills.Unassigned
  • 4204Ability to communicate operational plans and actions and provide feedback regarding OPSEC and tradecraft during mission pre-briefUnassigned
  • 4213Ability to conduct open source research.Unassigned
  • 4219Ability to construct a COA using available tools and techniques.Unassigned
  • 4222Ability to continually research and develop new tools/techniquesUnassigned
  • 4229Ability to create rules and filters (e.g., Berkeley Packet Filter, Regular Expression).Unassigned
  • 4243Ability to ensure collected data is transferred to the appropriate storage locations.Unassigned
  • 4244Ability to enumerate a network.Unassigned
  • 4248Ability to enumerate user permissions and privileges.Unassigned
  • 4249Ability to evade or counter security products or host based defenses.Unassigned
  • 4261Ability to exploit vulnerabilities to gain additional access.Unassigned
  • 4263Ability to extract credentials from hostsUnassigned
  • 4271Ability to identify capability gaps (e.g., insufficient tools, training, or infrastructure)Unassigned
  • 4276Ability to identify files containing information critical to operational objectives.Unassigned
  • 4278Ability to identify legal, policy, and technical limitations when conducting cyberspace operations.Unassigned
  • 4279Ability to identify logging capabilities on hostUnassigned
  • 4285Ability to identify what tools or Tactics, Techniques, and Procedures (TTPs) are applicable to a given situationUnassigned
  • 4292Ability to improve the performance of cyberspace operators by providing constructive (positive and negative) feedback.Unassigned
  • 4293Ability to install/modify/uninstall tools on target systems in accordance with current policies and procedures.Unassigned
  • 4296Ability to interpret device configurations.Unassigned
  • 4297Ability to interpret cyberspace technical materials and documentation (e.g., CVEs, API).Unassigned
  • 4298Ability to maintain situational awareness of target environmentUnassigned
  • 4305Ability to model a simulated environment to conduct mission rehearsal and mitigate risk of actions taken during operationsUnassigned
  • 4308Ability to operate automated systems to interact with target environmentUnassigned
  • 4324Ability to perform masquerade operations.Unassigned
  • 4325Ability to perform privilege escalationUnassigned
  • 4327Ability to persist access to a target.Unassigned
  • 4330Ability to plan, brief, execute, and debrief a missionUnassigned
  • 4334Ability to promote and enable organizational changeUnassigned
  • 4335Ability to provide advice and guidance to various stakeholders regarding technical issues, capabilities, and approachesUnassigned
  • 4336Ability to provide feedback to developers if a tool requires continued developmentUnassigned
  • 4340Ability to provide technical leadership within an organization.Unassigned
  • 4341Ability to read, write, modify, and execute compiled languages (e.g., C).Unassigned
  • 4342Ability to extract specific information from large data set (e.g., grep, regex).Unassigned
  • 4343Ability to recognize and report mistakes or poor tradecraft to appropriate leadership in accordance with Standard Operating Procedures (SOPs)Unassigned
  • 4344Ability to recognize and respond appropriately to Non-Standard Events.Unassigned
  • 4345Ability to redirect and tunnel through target systemsUnassigned
  • 4346Ability to remediate indicators of compromise.Unassigned
  • 4347Ability to research non-standard within a project.Unassigned
  • 4350Ability to retrieve historical operational data.Unassigned
  • 4359Ability to train other cyberspace operators.Unassigned
  • 4361Ability to troubleshoot technical problemsUnassigned
  • 4367Ability to use core toolset (e.g., implants, remote access tools).Unassigned
  • 4369Ability to use dynamic analysis tools (e.g., process monitor, process explorer, and registry analysis)Unassigned
  • 4370Ability to use enterprise tools to enumerate target informationUnassigned
  • 4378Ability to verify file integrity for both uploads and downloadsUnassigned
  • 4379Ability to weaken a target to facilitate/enable future accessUnassigned
  • 4380Ability to write and modify markup languages (e.g., HTML, XML).Unassigned
  • 4381Ability to write and modify source code (e.g., C).Unassigned
  • 6100Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies, and standards in support of organizational cyber activities.Unassigned

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.