Cyber Effects · Work role code 443
Network Analyst
The Network Analyst will understand network traffic signatures and discover anomalies through network traffic and packet capture (PCAP) analysis. The Network Analyst will identify, assess, and mitigate intrusions into networks that are vital to cyberspace operations security. Network Analysts also use GUI or command-line based tools and assist in developing network mapping and signatures. Network Analysts will develop advanced network detection rules and alerts, queries and dashboards to gain a holistic view of the network.
From DoD DCWF Tool v5.3 (2026-09-25)
Tasks
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 408Analyze information to determine, recommend, and plan the development of a new application or modification of an existing application.Unassigned
- 427Develop content for cyber defense tools.Unassigned
- 461Confer with systems analysts, engineers, programmers, and others to design application and to obtain information on project limitations and capabilities, performance requirements, and interfaces.Unassigned
- 472Coordinate with enterprise-wide cyber defense staff to validate network alerts.Unassigned
- 718Monitor network capacity and performance.Unassigned
- 765Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.Unassigned
- 782Plan and recommend modifications or adjustments based on exercise results or system environment.Unassigned
- 802Provide feedback on network requirements, including network architecture and infrastructure.Unassigned
- 818Provide technical documents, incident reports, findings from computer examinations, summaries, and other situational awareness information to higher headquarters.Unassigned
- 823Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.Unassigned
- 850Store, retrieve, and manipulate data for analysis of system capabilities and requirements.Unassigned
- 880AWork with stakeholders to resolve computer security incidents and vulnerability compliance.Unassigned
- 958Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.Unassigned
- 959Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.Unassigned
- 971Design countermeasures and mitigations against potential exploitation of programming language weaknesses and vulnerabilities in system and elements.Unassigned
- 1107Identify and analyze anomalies in network traffic using metadata (e.g., CENTAUR).Unassigned
- 1109Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.Unassigned
- 1111Identify applications and operating systems of a network device based on network traffic.Unassigned
- 1113Identify network mapping and operating system (OS) fingerprinting activities.Unassigned
- 2062Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the NE or enclave.Unassigned
- 2087Collaborate with intelligence analysts/targeting organizations involved in related areas.Unassigned
- 2102Conduct analysis of physical and logical digital technologies (e.g., wireless, SCADA, telecom) to identify potential avenues of access.Unassigned
- 2119Conduct network scouting/scanning and vulnerability analyses of systems within a network.Unassigned
- 2124Conduct open source data collection via various online tools.Unassigned
- 2226Detect exploits against targeted networks and hosts and react accordingly.Unassigned
- 2379BIdentify threats to Blue Force vulnerabilities.Unassigned
- 2429Generate requests for information.Unassigned
- 2477Identify potential points of strength and vulnerability within a network.Unassigned
- 2603Monitor operational environment and report on adversarial activities which fulfill leadership’s priority information requirements.Unassigned
- 2611Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan.Unassigned
- 8000Adhere to DCO policies and procedures reflecting applicable laws, policies, procedures, and regulations (such as United States Code Titles 10 and 50).Unassigned
- 8019Assess exploited systems’ potential to provide additional access, target development information, intelligence and/or covert infrastructure.Unassigned
- 8061Determine and document software patches or the extent of releases that would harden vulnerable software.Unassigned
- 8062Determine location of tool(s) deployment and utilize them once deployed (e.g., monitor agent, sensor).Unassigned
- 8066Develop and review cyberspace operations TTPs for integration into strategic, operational and tactical levels of planning.Unassigned
- 8099Evaluate security architecture and its design against cyberspace threats as identified in operational and acquisition documents.Unassigned
- 8136Manage threat or target analysis of DCO information and production of threat information for networks and enclave environments.Unassigned
- 8161Provide and maintain documentation for TTPs as inputs to training programs.Unassigned
- 8171Provide input to the analysis, design, development or acquisition of capabilities used for meeting mission objectives.Unassigned
- 8179Read, write, and interpret simple scripts to collect remote data and automation tasks.Unassigned
- 8180Read, write, and interpret simple scripts to parse large data files.Unassigned
- 8182Recommend Patch network vulnerabilities to ensure information is safeguarded against outside parties via Risk Mitigation Plans.Unassigned
Knowledge
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 12Knowledge of communication methods, principles, and concepts (e.g., crypto, dual hubs, time multiplexers) that support the network infrastructure.Unassigned
- 15Knowledge of capabilities and applications of network equipment including hubs, routers, switches, bridges, servers, transmission media, and related hardware.Unassigned
- 19Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.Unassigned
- 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
- 27AKnowledge of cryptology.Unassigned
- 29Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.Unassigned
- 38Knowledge of organization's enterprise information security architecture system.Unassigned
- 40Knowledge of organization's evaluation and validation requirements.Unassigned
- 49Knowledge of host/network access control mechanisms (e.g., access control list).Unassigned
- 53Knowledge of the Security Assessment and Authorization process.Unassigned
- 61Knowledge of incident response and handling methodologies.Unassigned
- 62Knowledge of industry-standard and organizationally accepted analysis principles and methods.Unassigned
- 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Unassigned
- 70AKnowledge of cybersecurity methods, such as firewalls, demilitarized zones, and encryption.Unassigned
- 72Knowledge of local area and wide area networking principles and concepts including bandwidth management.Unassigned
- 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Unassigned
- 82AKnowledge of network design processes, to include understanding of security objectives, operational objectives, and tradeoffs.Unassigned
- 87Knowledge of network traffic analysis methods.Unassigned
- 88Knowledge of new and emerging information technology (IT) and cybersecurity technologies.Unassigned
- 92Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).Unassigned
- 96Knowledge of performance tuning tools and techniques.Unassigned
- 99AKnowledge of principles and methods for integrating system components.Unassigned
- 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
- 109Knowledge of secure configuration management techniques.Unassigned
- 110Knowledge of key concepts in security management (e.g., Release Management, Patch Management).Unassigned
- 110AKnowledge of security management.Unassigned
- 132Knowledge of technology integration processes.Unassigned
- 133Knowledge of key telecommunications concepts (e.g., Routing Algorithms, Fiber Optics Systems Link Budgeting, Add/Drop Multiplexers).Unassigned
- 139Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.Unassigned
- 143AKnowledge of integrating the organization’s goals and objectives into the architecture.Unassigned
- 145Knowledge of the type and frequency of routine maintenance needed to keep equipment functioning properly.Unassigned
- 148Knowledge of Virtual Private Network (VPN) security.Unassigned
- 150Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.Unassigned
- 177AKnowledge of countermeasure design for identified security risks.Unassigned
- 183AKnowledge in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.Unassigned
- 270Knowledge of common adversary tactics, techniques, and procedures in assigned area of responsibility (i.e., historical country-specific tactics, techniques, and procedures; emerging capabilities).Unassigned
- 912Knowledge of collection management processes, capabilities, and limitations.Unassigned
- 978AKnowledge of root cause analysis techniques.Unassigned
- 986Knowledge of organizational information technology (IT) user security policies (e.g., account creation, password rules, access control).Unassigned
- 1033Knowledge of basic system administration, network, and operating system hardening techniques.Unassigned
- 1037AKnowledge of information technology (IT) risk management policies, requirements, and procedures.Unassigned
- 1037BKnowledge of program protection planning to include information technology (IT) supply chain security/risk management policies, anti-tampering techniques, and requirements.Unassigned
- 1038Knowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.Unassigned
- 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Unassigned
- 1073Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.Unassigned
- 1074AKnowledge of transmission records (e.g., Bluetooth, Radio Frequency Identification (RFID), Infrared Networking (IR), Wireless Fidelity (Wi-Fi). paging, cellular, satellite dishes, Voice over Internet Protocol (VoIP)), and jamming techniques that enable transmission of undesirable information, or prevent installed systems from operating correctly.Unassigned
- 1141AKnowledge of an organization's information classification program and procedures for information compromise.Unassigned
- 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
- 1158* Knowledge of cybersecurity principles.Core
- 1159* Knowledge of cyber threats and vulnerabilities.Core
- 3137Knowledge of basic malicious activity concepts (e.g., footprinting, scanning and enumeration).Unassigned
- 3146Knowledge of both internal and external customers and partner organizations, including information needs, objectives, structure, capabilities, etc.Unassigned
- 3188Knowledge of computer networking fundamentals (i.e., basic computer components of a network, types of networks, etc.).Unassigned
- 3201Knowledge of all relevant reporting and dissemination procedures.Unassigned
- 3206Knowledge of current software and methodologies for active defense and system hardening.Unassigned
- 3261Knowledge of evasion strategies and techniques.Unassigned
- 3277Knowledge of general SCADA system components.Unassigned
- 3346Knowledge of Internet and routing protocols.Unassigned
- 3349Knowledge of intrusion sets.Unassigned
- 3353Knowledge of the Risk Management Framework Assessment Methodology.Unassigned
- 3378Knowledge of methods and techniques used to detect various exploitation activities.Unassigned
- 3399Knowledge of network administration.Unassigned
- 3431Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).Unassigned
- 3454Knowledge of products and nomenclature of major vendors (e.g., security suites - Trend Micro, Symantec, McAfee, Outpost, Panda, Kaspersky) and how differences affect exploitation/vulnerabilities.Unassigned
- 3479Knowledge of security hardware and software options, including the network artifacts they induce and their effects on exploitation.Unassigned
- 3508Knowledge of structure, approach, and strategy of exploitation tools (e.g., sniffers, keyloggers) and techniques (e.g., gaining backdoor access, collecting/exfiltrating data, conducting vulnerability analysis of other systems in the network).Unassigned
- 3627Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations.Unassigned
- 4392Knowledge of anomaly based detection and threat huntingUnassigned
- 4394Knowledge of attack principles, tools, and techniques.Unassigned
- 4396Knowledge of basic cloud based technologies and concepts.Unassigned
- 4398Knowledge of basic Cyber Threat Emulation concepts.Unassigned
- 4399Knowledge of basic Embedded Systems concepts.Unassigned
- 4427Knowledge of cybersecurity and cybersecurity-enabled software products.Unassigned
- 4440Knowledge of DOD Component-level cybersecurity architecture.Unassigned
- 4442Knowledge of encryption algorithms and their implementation.Unassigned
- 4450Knowledge of Friendly Network Forces (FNF) reporting procedures (i.e., deconfliction) to include external organization interaction.Unassigned
- 4455Knowledge of hardware components and architecture including functions and limitations.Unassigned
- 4456Knowledge of hashing algorithms.Unassigned
- 4457Knowledge of Hexadecimal, Octal, Decimal, and binaryUnassigned
- 4467Knowledge of HTML source code and the intelligence that can be derived from it.Unassigned
- 4472Knowledge of IPv6Unassigned
- 4499Knowledge of Network OSs.Unassigned
- 4531Knowledge of security implications of device and software configurations.Unassigned
- 4539Knowledge of structured response frameworks (e.g., MITRE ATT&CK, Lockheed Martin Kill Chain, Diamond Model).Unassigned
- 4547Knowledge of TCP flagsUnassigned
- 4557Knowledge of the differences between distance vector and link-state routing protocolsUnassigned
- 4558Knowledge of the different DNS resource recordsUnassigned
- 4583Knowledge of the U.S. Security System authorities, responsibilities, and contributions to the cyberspace operations mission.Unassigned
- 4591Knowledge of User Agent Strings and the intelligence that can be derived from themUnassigned
- 6330Knowledge of multi-level/security cross domain solutions.Unassigned
- 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
- 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
- 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
- 7111* Knowledge of Zero Trust Security Model Principles.Core
Skills
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 70BSkill in applying cybersecurity methods, such as firewalls, demilitarized zones, and encryption.Unassigned
- 154Skill in analyzing network traffic capacity and performance characteristics.Unassigned
- 155Skill in applying and incorporating information technologies into proposed solutions.Unassigned
- 167ASkill in conducting system/server planning, management, and maintenance.Unassigned
- 171ASkill in correcting physical and technical problems that impact system/server performance.Unassigned
- 177Skill in designing countermeasures to identified security risks.Unassigned
- 191Skill in developing and applying security system access controls.Unassigned
- 193Skill in developing, testing, and implementing network infrastructure contingency and recovery plans.Unassigned
- 194Skill in diagnosing connectivity problems.Unassigned
- 197Skill in discerning the protection needs (i.e., security controls) of information systems and networks.Unassigned
- 198Skill in establishing a routing schema.Unassigned
- 202ASkill in identifying and anticipating system/server performance, availability, capacity, or configuration problems.Unassigned
- 206ASkill in installing system and component upgrades.Unassigned
- 207Skill in installing, configuring, and troubleshooting LAN and WAN components such as routers, hubs, and switches.Unassigned
- 211ASkill in monitoring and optimizing system/server performance.Unassigned
- 231Skill in using network management tools to analyze network traffic patterns (e.g., simple network management protocol).Unassigned
- 1020ASkill in secure test plan design (e. g. unit, integration, system, acceptance).Unassigned
- 1073ASkill in network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.Unassigned
- 1091Skill in one way hash functions (e.g., Secure Hash Algorithm [SHA], Message Digest Algorithm [MD5]).Unassigned
- 3695Skill in auditing firewalls, perimeters, routers, and intrusion detection systems.Unassigned
- 3740Skill in determining installed patches on various operating systems and identifying patch signatures.Unassigned
- 3779Skill in extracting information from packet captures.Unassigned
- 3801Skill in identifying the devices that work at each level of protocol models.Unassigned
- 3815Skill in interpreting vulnerability scanner results to identify vulnerabilities.Unassigned
- 3871Skill in remote command line and Graphical User Interface (GUI) tool usage.Unassigned
- 3910Skill in using Boolean operators to construct simple and complex queries.Unassigned
- 3931Skill in using various open source data collection tools (online trade, DNS, mail, etc.).Unassigned
- 3948Skill in verifying the integrity of all files.Unassigned
- 4603Skill in analyzing PCAP dataUnassigned
- 4614Skill in conducting system planning, management, and maintenance.Unassigned
- 4623Skill in discerning the protection requirements (i.e., security controls) of IS and networks.Unassigned
- 4636Skill in implementing encryption algorithms.Unassigned
- 4637Skill in intrusion detection methodologies and techniques for detecting host and network-based intrusions for utilizing intrusion detection systems and signature development.Unassigned
- 4642Skill in network operating system administration.Unassigned
- 4650Skill in providing an understanding of the adversary through the identification and link analysis of physical, functional, or behavioral relationships within an operational environment.Unassigned
- 4661Skill in regular expressionsUnassigned
- 4671Skill in understanding cybersecurity architecture, its implementation, and its expected behaviors and how changes in conditions affect outcomes.Unassigned
- 4672Skill in using Berkeley Packet filtersUnassigned
- 4675Skill in using network mapping tools to analyze identify and enumerate a networkUnassigned
- 4680Skill in utilizing a network traffic packet analyzer in order to detect anomalies in protocol utilizationUnassigned
- 6590Skill in interfacing with customers.Unassigned
Abilities
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 244Ability to determine the validity of technology trend data.Unassigned
- 993AAbility to apply the methods, standards, and approaches for describing, analyzing, and documenting an organization's enterprise information technology (IT) architecture (e.g., Open Group Architecture Framework [TOGAF], Department of Defense Architecture Framework [DoDAF], Federal Enterprise Architecture Framework [FEAF]).Unassigned
- 3030Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.Unassigned
- 4170Ability to accurately document resultsUnassigned
- 4171Ability to analyze a finding of a compromise and develop a custom signature(s) and/or rule(s) to identify it throughout the networkUnassigned
- 4173Ability to analyze Data at Rest and Data in Transit encryption methodologies and assess Data at Rest and Data in Transit policiesUnassigned
- 4175Ability to analyze device/protocol discovery tool outputUnassigned
- 4177Ability to analyze interior and exterior routing protocols (e.g., RIP, EIGRP, OSPF, IS-IS, etc.)Unassigned
- 4178Ability to analyze mitigations to recover from a full network compromiseUnassigned
- 4180Ability to analyze network infrastructure to identify and recommend key terrain or critical infrastructure.Unassigned
- 4181Ability to analyze organizational policies and documentation for appropriate use and user privileges as they apply to networking devices.Unassigned
- 4183Ability to analyze potential adversarial attack vectors on a mission-critical system.Unassigned
- 4193Ability to assess Data in Transit encryption policies.Unassigned
- 4201Ability to characterize network traffic for trends and patterns.Unassigned
- 4205Ability to communicate with Sr Leaders of an Org. to ensure shared responsibility for supporting Org. mission/business functions using external providers of systems, services and apps receive visibility and is elevated to the appropriate decisionmaking authorities.Unassigned
- 4208Ability to compile access control lists and firewall configurations.Unassigned
- 4212Ability to Conduct flow data analysisUnassigned
- 4214Ability to conduct research on vulnerabilities found and correlate current versions to known vulnerable releasesUnassigned
- 4217Ability to configure, forward and statistically analyze logsUnassigned
- 4218Ability to configure, place, and maintain a distributed sensor grid.Unassigned
- 4220Ability to construct accurate maps of the network devicesUnassigned
- 4221Ability to construct log aggregation solutions and analysis platformsUnassigned
- 4225Ability to correlate indicators of compromiseUnassigned
- 4226Ability to create baselines/PPS documents and to compare current state against documentation.Unassigned
- 4230Ability to create rules/alerts for traffic validation.Unassigned
- 4231Ability to define caching and analyze the information contained withinUnassigned
- 4233Ability to detect mismatched port-application trafficUnassigned
- 4235Ability to develop a risk defense plan to put active measure in place in defense of a networkUnassigned
- 4237Ability to develop dashboards to better visualize dataUnassigned
- 4241Ability to dissect and analyze a packet headerUnassigned
- 4242Ability to document findings of any anomalous connectionsUnassigned
- 4250Ability to evaluate common Tactics, Techniques and Procedures (TTP) used in malware and open-source and Intelligence Community (IC) resources available to identify emerging TTPsUnassigned
- 4253Ability to evaluate information (e.g., trust relationships and security policies) from a domain to identify vulnerabilities/misconfigurationUnassigned
- 4254Ability to evaluate mitigations to recover from a full-network compromise.Unassigned
- 4255Ability to evaluate network diagramUnassigned
- 4256Ability to evaluate rogue/unauthorized systems on a networkUnassigned
- 4259Ability to evaluate systems resiliency in adverse conditionsUnassigned
- 4267Ability to identify activity in log entries to correlate indicators of compromise.Unassigned
- 4268Ability to identify anomalous activity based off of known trends and patterns.Unassigned
- 4270Ability to identify C2 Beaconing in normal network traffic.Unassigned
- 4272Ability to identify complex root-cause analysis and recommend mitigationsUnassigned
- 4274Ability to identify Data in Transit encryption methodologies.Unassigned
- 4275Ability to identify exfiltration of data in normal network trafficUnassigned
- 4277Ability to identify IPv6 and differentiate between Link Local, Multicast, Unicast, and Anycast.Unassigned
- 4286Ability to identify wireless encryption and differentiate between WEP, WPA (all versions) and WAPIUnassigned
- 4290Ability to implement network TAP configurationUnassigned
- 4295Ability to integrate information security requirements into the acquisition process, using applicable baseline security controls as one of the sources for security requirements, and ensuring a robust software quality control process.Unassigned
- 4301Ability to measure application whitelisting/blacklisting solutionsUnassigned
- 4303Ability to measure principles of vulnerability exploitationUnassigned
- 4304Ability to measure the effectiveness of white/blacklisting solutions on network devices.Unassigned
- 4307Ability to monitor network data and perform triage on triggered events.Unassigned
- 4310Ability to operate the tools to enumerate a systemUnassigned
- 4311Ability to organize a list of mission infrastructure to identify which dependent systems are key terrainUnassigned
- 4314Ability to organize Network System Architecture and the dependencies formed from relationships between systemsUnassigned
- 4321Ability to perform conversion calculations across Hexadecimal, Octal, Decimal, and binary.Unassigned
- 4322Ability to perform device discoveryUnassigned
- 4348Ability to research protocol utilization and determine anomalous useUnassigned
- 4357Ability to test tools within sensor gridUnassigned
- 4364Ability to use and integrate Security Information and Event Management (SIEM) capabilities in the analysis process.Unassigned
- 4375Ability to utilize Defense Information Systems Agency (DISA)/ Department of Defense (DoD) system configuration guidelinesUnassigned
- 6030Ability to apply an organization's goals and objectives to develop and maintain architecture.Unassigned
- 6150Ability to optimize systems to meet enterprise performance requirements.Unassigned
Workforce Automation analysis, not part of the source
O*NET jobs
WFA · Part of the paid plan when accounts openJobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.
No O*NET jobs reach this role.
Equivalents
NICE work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles
Free · DoD DCWF Tool v5.3 (2026-09-25)No published NICE equivalent.
O*NET jobs it reaches
Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3No O*NET job reaches this role.