Skip to content

Cyber Effects · Work role code 463

Host Analyst

A Host Analyst (HA) will have knowledge of various system configurations encountered. This work role also performs analysis using built-in tools and capabilities. A Host Analyst will have knowledge of system services and the security and configuration of them, as well as knowledge of file systems, permissions, and operation system configurations. The Host Analyst conducts analysis using built-in tools and capabilities.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 461Confer with systems analysts, engineers, programmers, and others to design application and to obtain information on project limitations and capabilities, performance requirements, and interfaces.Unassigned
  • 868Extract data using data carving techniques (e.g., Forensic Tool Kit [FTK], Foremost).Unassigned
  • 880AWork with stakeholders to resolve computer security incidents and vulnerability compliance.Unassigned
  • 958Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.Unassigned
  • 959Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.Unassigned
  • 972ADetermine and document software patches or the extent of releases that would leave software vulnerable.Unassigned
  • 1110Isolate and remove malware.Unassigned
  • 1111Identify applications and operating systems of a network device based on network traffic.Unassigned
  • 1113Identify network mapping and operating system (OS) fingerprinting activities.Unassigned
  • 2062Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the NE or enclave.Unassigned
  • 2119Conduct network scouting/scanning and vulnerability analyses of systems within a network.Unassigned
  • 2205Deploy tools to a target and utilize them once deployed (e.g., backdoors, sniffers).Unassigned
  • 2226Detect exploits against targeted networks and hosts and react accordingly.Unassigned
  • 2232Determine course of action for addressing changes to objectives, guidance, and operational environment.Unassigned
  • 2353Edit or execute simple scripts (e.g., PERL, VBS) on Windows and UNIX systems.Unassigned
  • 2379BIdentify threats to Blue Force vulnerabilities.Unassigned
  • 2429Generate requests for information.Unassigned
  • 2603Monitor operational environment and report on adversarial activities which fulfill leadership’s priority information requirements.Unassigned
  • 2611Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan.Unassigned
  • 8036Conduct open source research via various online tools.Unassigned
  • 8111Identify potential points of strength and vulnerability among segments of a network map.Unassigned
  • 8115Identify tools/hardware used to extract/analyze/capture memory and disk images.Unassigned
  • 8151Perform security reviews and identify gaps in security architecture that can be used in the development of a security risk management plan.Unassigned
  • 8161Provide and maintain documentation for TTPs as inputs to training programs.Unassigned
  • 8212Validate intrusion detection system (IDS) alerts.Unassigned

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 15Knowledge of capabilities and applications of network equipment including hubs, routers, switches, bridges, servers, transmission media, and related hardware.Unassigned
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 27AKnowledge of cryptology.Unassigned
  • 34Knowledge of database systems.Unassigned
  • 43AKnowledge of embedded systems.Unassigned
  • 46Knowledge of fault tolerance.Unassigned
  • 49Knowledge of host/network access control mechanisms (e.g., access control list).Unassigned
  • 51Knowledge of how system components are installed, integrated, and optimized.Unassigned
  • 52Knowledge of human-computer interaction principles.Unassigned
  • 53Knowledge of the Security Assessment and Authorization process.Unassigned
  • 61Knowledge of incident response and handling methodologies.Unassigned
  • 62Knowledge of industry-standard and organizationally accepted analysis principles and methods.Unassigned
  • 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Unassigned
  • 65AKnowledge of Information Theory (e.g., source coding, channel coding, algorithm complexity theory, and data compression).Unassigned
  • 66Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.Unassigned
  • 69Knowledge of Risk Management Framework (RMF) requirements.Unassigned
  • 70AKnowledge of cybersecurity methods, such as firewalls, demilitarized zones, and encryption.Unassigned
  • 78Knowledge of microprocessors.Unassigned
  • 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Unassigned
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Unassigned
  • 82AKnowledge of network design processes, to include understanding of security objectives, operational objectives, and tradeoffs.Unassigned
  • 88Knowledge of new and emerging information technology (IT) and cybersecurity technologies.Unassigned
  • 90Knowledge of operating systems.Unassigned
  • 92BKnowledge of how traffic flows across the network (e.g., Transmission Control Protocol (TCP), Internet Protocol (IP), Open System Interconnection Model (OSI)).Unassigned
  • 95AKnowledge of penetration testing principles, tools, and techniques.Unassigned
  • 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Unassigned
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 109Knowledge of secure configuration management techniques.Unassigned
  • 109AKnowledge of configuration management techniques.Unassigned
  • 110Knowledge of key concepts in security management (e.g., Release Management, Patch Management).Unassigned
  • 110AKnowledge of security management.Unassigned
  • 111Knowledge of security system design tools, methods, and techniques.Unassigned
  • 117Knowledge of software design tools, methods, and techniques.Unassigned
  • 124Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.Unassigned
  • 130Knowledge of systems testing and evaluation methods.Unassigned
  • 139Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.Unassigned
  • 141AKnowledge of the enterprise information technology (IT) architectural concepts and patterns to include baseline and target architectures.Unassigned
  • 143AKnowledge of integrating the organization’s goals and objectives into the architecture.Unassigned
  • 148Knowledge of Virtual Private Network (VPN) security.Unassigned
  • 150Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.Unassigned
  • 183AKnowledge in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.Unassigned
  • 264Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).Unassigned
  • 270Knowledge of common adversary tactics, techniques, and procedures in assigned area of responsibility (i.e., historical country-specific tactics, techniques, and procedures; emerging capabilities).Unassigned
  • 912Knowledge of collection management processes, capabilities, and limitations.Unassigned
  • 915Knowledge of front-end collection systems, including traffic collection, filtering, and selection.Unassigned
  • 1033Knowledge of basic system administration, network, and operating system hardening techniques.Unassigned
  • 1037BKnowledge of program protection planning to include information technology (IT) supply chain security/risk management policies, anti-tampering techniques, and requirements.Unassigned
  • 1038Knowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.Unassigned
  • 1073Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.Unassigned
  • 1141AKnowledge of an organization's information classification program and procedures for information compromise.Unassigned
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3130Knowledge of auditing and logging procedures (including server-based logging).Unassigned
  • 3140Knowledge of basic programming concepts (e.g., levels, structures, compiled vs. interpreted languages).Unassigned
  • 3141Knowledge of basic software applications (e.g., data storage and backup, database applications) and their vulnerabilities.Unassigned
  • 3153Knowledge of circuit analysis.Unassigned
  • 3188Knowledge of computer networking fundamentals (i.e., basic computer components of a network, types of networks, etc.).Unassigned
  • 3201Knowledge of all relevant reporting and dissemination procedures.Unassigned
  • 3206Knowledge of current software and methodologies for active defense and system hardening.Unassigned
  • 3222Knowledge of data backup and restoration concepts.Unassigned
  • 3253Knowledge of encryption algorithms and cyber capabilities/tools (e.g., SSL, PGP).Unassigned
  • 3261Knowledge of evasion strategies and techniques.Unassigned
  • 3270Knowledge of forensic implications of operating system structure and operations.Unassigned
  • 3317Knowledge of implementing Unix and Windows systems that provide radius authentication and logging, DNS, mail, web service, FTP server, DHCP, firewall, and SNMP.Unassigned
  • 3348Knowledge of intrusion detection systems and signature development.Unassigned
  • 3353Knowledge of the Risk Management Framework Assessment Methodology.Unassigned
  • 3378Knowledge of methods and techniques used to detect various exploitation activities.Unassigned
  • 3431Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).Unassigned
  • 3454Knowledge of products and nomenclature of major vendors (e.g., security suites - Trend Micro, Symantec, McAfee, Outpost, Panda, Kaspersky) and how differences affect exploitation/vulnerabilities.Unassigned
  • 3459Knowledge of the functions and capabilities of internal teams that emulate threat activities to benefit the organization.Unassigned
  • 3479Knowledge of security hardware and software options, including the network artifacts they induce and their effects on exploitation.Unassigned
  • 3480Knowledge of security implications of software configurations.Unassigned
  • 3508Knowledge of structure, approach, and strategy of exploitation tools (e.g., sniffers, keyloggers) and techniques (e.g., gaining backdoor access, collecting/exfiltrating data, conducting vulnerability analysis of other systems in the network).Unassigned
  • 3513Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.Unassigned
  • 3539Knowledge of telecommunications fundamentals.Unassigned
  • 3627Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations.Unassigned
  • 3637Knowledge of Unix/Linux and Windows operating systems structures and internals (e.g., process management, directory structure, installed applications).Unassigned
  • 3642Knowledge of various types of computer architectures.Unassigned
  • 4095Knowledge of concepts related to websites (e.g., web servers/pages, hosting, DNS, registration, web languages such as HTML).Unassigned
  • 4390Knowledge of active directory federated services.Unassigned
  • 4413Knowledge of common information network malware (e.g., viruses, trojans, etc.) and vectors of attack (e.g., ports, attachments, etc.).Unassigned
  • 4415Knowledge of common obfuscation techniques (e.g., command line execution, string substitution, clandestine side channel, Base64).Unassigned
  • 4416Knowledge of common persistence locations within Windows, Unix, or Linux operating systemsUnassigned
  • 4427Knowledge of cybersecurity and cybersecurity-enabled software products.Unassigned
  • 4429Knowledge of cybersecurity controls and design principles and methods (e.g., firewalls, DMZ, and encryption).Unassigned
  • 4430Knowledge of cybersecurity Risk Management Framework (RMF) process.Unassigned
  • 4434Knowledge of DCO capabilities, including open-source tools, and their capabilities.Unassigned
  • 4435Knowledge of Defense-In-Depth principles.Unassigned
  • 4438Knowledge of different types of log subscriptions (e.g., push vs pull, MS Windows event forwarding, winlogbeat, syslog).Unassigned
  • 4443Knowledge of evasion strategies and TTPs (e.g., noise, stealth, situational awareness, bandwidth throttling).Unassigned
  • 4445Knowledge of existing cybersecurity principles, policies, and proceduresUnassigned
  • 4452Knowledge of full-spectrum of cyberspace operations in an intelligence-driven DCO environment.Unassigned
  • 4501Knowledge of non-Active Directory domains (e.g., IDM, LDAP).Unassigned
  • 4522Knowledge of public key infrastructure (PKI) libraries, certificate authorities, certificate management, and encryption functionalities.Unassigned
  • 4537Knowledge of stream providers (e.g., KAFKA).Unassigned
  • 4539Knowledge of structured response frameworks (e.g., MITRE ATT&CK, Lockheed Martin Kill Chain, Diamond Model).Unassigned
  • 4583Knowledge of the U.S. Security System authorities, responsibilities, and contributions to the cyberspace operations mission.Unassigned
  • 4585Knowledge of the Windows registry hive keys and the information contained within each one.Unassigned
  • 4589Knowledge of typical system processes within Windows, Unix, or Linux operating systemsUnassigned
  • 4595Knowledge of web applications and their common attack vectors.Unassigned
  • 6240Knowledge of critical protocols (e.g., IPSEC, AES, GRE, IKE).Unassigned
  • 6330Knowledge of multi-level/security cross domain solutions.Unassigned
  • 6820Knowledge of network architecture concepts including topology, protocols, and components.Unassigned
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 155Skill in applying and incorporating information technologies into proposed solutions.Unassigned
  • 156Skill in applying confidentiality, integrity, and availability principles.Unassigned
  • 202ASkill in identifying and anticipating system/server performance, availability, capacity, or configuration problems.Unassigned
  • 205Skill in implementing, maintaining, and improving established network security practices.Unassigned
  • 233Skill in using protocol analyzers.Unassigned
  • 350Skill in analyzing memory dumps to extract information.Unassigned
  • 892Skill in configuring and utilizing software-based computer protection tools (e.g., software firewalls, anti-virus software, anti-spyware).Unassigned
  • 973ASkill in using code analysis tools.Unassigned
  • 3740Skill in determining installed patches on various operating systems and identifying patch signatures.Unassigned
  • 3777Skill in reverse engineering (e.g., hex editing, binary packaging utilities, debugging, and strings analysis) to identify function and ownership of remote tools.Unassigned
  • 3801Skill in identifying the devices that work at each level of protocol models.Unassigned
  • 3815Skill in interpreting vulnerability scanner results to identify vulnerabilities.Unassigned
  • 3859Skill in reading, interpreting, writing, modifying, and executing simple scripts (e.g., PERL, VBS) on Windows and Unix systems (e.g., those that perform tasks like parsing large data files, automating manual tasks, and fetching/processing remote data).Unassigned
  • 3871Skill in remote command line and Graphical User Interface (GUI) tool usage.Unassigned
  • 3948Skill in verifying the integrity of all files.Unassigned
  • 4599Skill in analyzing endpoint collection data.Unassigned
  • 4655Skill in providing support to intelligence analysts to understand the operational environment and how it ties to intelligence reporting.Unassigned
  • 4660Skill in refining research (e.g., vulnerabilities, TTPs) to assist intelligence analysts’ preparation of products.Unassigned
  • 4665Skill in run level configurations in a Linux or UNIX environmentUnassigned
  • 4679Skill in using various online tools for open-source research (e.g., online trade, DNS, mail, etc.).Unassigned

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 68AAbility to build architectures and frameworks.Unassigned
  • 1072AAbility to apply network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).Unassigned
  • 3002Ability to focus research efforts to meet the customer’s decision-making needs.Unassigned
  • 3063Ability to monitor system operations and react to events in response to triggers and/or observation of trends or unusual activity.Unassigned
  • 3859AAbility to read, interpret, write, modify, and execute simple scripts (e.g., PERL, VBS) on Windows and Unix systems (e.g., those that perform tasks like parsing large data files, automating manual tasks, and fetching/processing remote data).Unassigned
  • 4171Ability to analyze a finding of a compromise and develop a custom signature(s) and/or rule(s) to identify it throughout the networkUnassigned
  • 4172Ability to analyze adversarial avenues of approach on a mission-critical systemUnassigned
  • 4174Ability to analyze Data at Rest and Data in Transit encryption methodologies and assess Data at Rest and Data in Transit policies in support of identifying outliers to delineate possible avenues of approach.Unassigned
  • 4176Ability to analyze how the tools operate to enumerate the systemUnassigned
  • 4179Ability to analyze multiple memory captures, determine anomalous behavior and developed a detailed report that includes timeline of compromiseUnassigned
  • 4182Ability to analyze organizational policies and documentation for appropriate use and user privileges to determine current user access rights policiesUnassigned
  • 4184Ability to analyze potentially malicious processes, libraries and modules on a systemUnassigned
  • 4185Ability to analyze process lists within Windows, Unix, or Linux operating systemsUnassigned
  • 4186Ability to analyze software installed and in use on a system, and on a host machine and compare it to the authorized software list provided by the network ownerUnassigned
  • 4187Ability to analyze tools/hardware used to extract/analyze/capture memory and disk imagesUnassigned
  • 4188Ability to analyze user-mode/kernel mode rootkits and how they function and differUnassigned
  • 4189Ability to analyze vulnerabilities and misconfiguration without Information Assurance artifacts.Unassigned
  • 4195Ability to build a baseline of configuration/state for host machinesUnassigned
  • 4197Ability to capture a memory image from a host workstationUnassigned
  • 4198Ability to capture forensically sound memory and disk images with regard to timeline analysisUnassigned
  • 4206Ability to compare active user accounts on a network to appropriate Standard Operating Procedure (SOP), gather active user accounts on a network and compare to authorized user listUnassigned
  • 4207Ability to compare current state against baselinesUnassigned
  • 4209Ability to compile group policies and access control lists from mission partner networks.Unassigned
  • 4210Ability to compile host-based firewall configurations and host intrusion prevention system through group policy modifications from mission partner networks.Unassigned
  • 4211Ability to conduct disk forensics on multiple imagesUnassigned
  • 4216Ability to configure log aggregationUnassigned
  • 4217Ability to configure, forward and statistically analyze logsUnassigned
  • 4225Ability to correlate indicators of compromiseUnassigned
  • 4232Ability to de-obfuscate (e.g., command line execution, string substitution, clandestine side channel, Base64).Unassigned
  • 4234Ability to develop a risk defense plan (e.g., behavioral development, etc.) and put active measures in place in defense of a network, endpoint, and/or host.Unassigned
  • 4237Ability to develop dashboards to better visualize dataUnassigned
  • 4238Ability to develop host-based IDS/IPS signatures and settingsUnassigned
  • 4239Ability to develop the reporting and recording of discovered potentially malicious processes, libraries, and modules on a compromised systemUnassigned
  • 4245Ability to enumerate domain security groups.Unassigned
  • 4246Ability to enumerate knowledge management applications (e.g., SharePoint) and their service accounts/security groups.Unassigned
  • 4247Ability to enumerate network shares and identify ACLs/security permissions and analyze for vulnerabilities/misconfigurations (e.g., SMB, NFS, ISCSI).Unassigned
  • 4250Ability to evaluate common Tactics, Techniques and Procedures (TTP) used in malware and open-source and Intelligence Community (IC) resources available to identify emerging TTPsUnassigned
  • 4251Ability to evaluate compliance with Security Technical Implementation Guides (STIGs) on host machines by utilizing a compliance scanner in support of identifying outliers in order to delineate possible avenues of approachUnassigned
  • 4252Ability to evaluate if patches are up to date for all hosts, determine current process for updating patches and determine current patch level for all hosts on a network according to NIST Special Publications 800-40 in support of identifying outliers in order to delineate possible avenues of approach.Unassigned
  • 4256Ability to evaluate rogue/unauthorized systems on a networkUnassigned
  • 4257Ability to evaluate security posture shortcomings in group policyUnassigned
  • 4258Ability to evaluate steps taken after host-based IDS/IPS alerts, verify the finding and ensure its volatilityUnassigned
  • 4259Ability to evaluate systems resiliency in adverse conditionsUnassigned
  • 4262Ability to export/enumerate information (e.g., users, groups) from a Domain Controller.Unassigned
  • 4266Ability to identify activity context in log entries to correlate indicators of compromise.Unassigned
  • 4269Ability to identify anomalous network traffic on a host machine.Unassigned
  • 4273Ability to identify critical infrastructure systems with information communication technology that were designed without system security considerations.Unassigned
  • 4281Ability to identify new indicators of compromise through anomalous behavior in log entries.Unassigned
  • 4283Ability to identify security posture shortcomingsUnassigned
  • 4284Ability to identify tools and techniques available for analyzing binary applications and interpreted scripts.Unassigned
  • 4287Ability to identify/select the most appropriate tools and solutions for the specific environment (e.g., disk/memory forensics/capture, host enumeration, application whitelisting, log aggregation and analysis, HIPS/HIDS solutions, etc.).Unassigned
  • 4288Ability to implement and configure host-based firewalls and host intrusion prevention systemsUnassigned
  • 4289Ability to implement Data at Rest and Data in Transit encryption methodologies, Assess Data at Rest and Data in Transit policies.Unassigned
  • 4302Ability to measure known vulnerabilities against known vectors of approach.Unassigned
  • 4306Ability to monitor Active Directory (AD) for creation of unauthorized/potentially malicious accountsUnassigned
  • 4309Ability to operate specified tools to enumerate a system.Unassigned
  • 4312Ability to organize Active Directories (AD) hierarchy structureUnassigned
  • 4313Ability to organize logging and auditing procedures including server-based loggingUnassigned
  • 4315Ability to organize order of the volatility when capturing artifactsUnassigned
  • 4318Ability to perform and analyze situational awareness commands within Windows, Unix, and Linux operating systems (e.g., system info, net stat, ipconfig, task list, ls, ifconfig, etc.)Unassigned
  • 4319Ability to perform and analyze vulnerability scans on host machines in support of identifying outliers in order to delineate possible avenues of approach.Unassigned
  • 4320Ability to perform complex root-cause analysis and recommend mitigations to determine root cause of an intrusionUnassigned
  • 4323Ability to perform dynamic analysis.Unassigned
  • 4326Ability to perform static analysis.Unassigned
  • 4331Ability to prioritize how Operating System (OS) and application patches are distributed in different systemsUnassigned
  • 4332Ability to prioritize Operating Systems (OS) default processes, library, and modules based on boot order, dependencies, or key operations.Unassigned
  • 4337Ability to provide host analysis for Risk Mitigation Plan (RMP) to improve customer security overall postureUnassigned
  • 4339Ability to provide mitigations to recover from a full network compromise.Unassigned
  • 4351Ability to select the best tools to enumerate a given set of host machines in order to validate whether they match known baselines.Unassigned
  • 4363Ability to use and integrate a Security Information and Event Management (SIEM) platform.Unassigned
  • 4371Ability to use host volatile data to compare active processes, libraries and modules against databases of known good/bad.Unassigned
  • 4375Ability to utilize Defense Information Systems Agency (DISA)/ Department of Defense (DoD) system configuration guidelinesUnassigned

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.