Skip to content

Cybersecurity · Work role code 511

Cyber Defense Analyst

Uses data collected from a variety of cyber defense tools (e.g., IDS alerts, firewalls, network traffic logs.) to analyze events that occur within their environments for the purposes of mitigating threats.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 427Develop content for cyber defense tools.Additional
  • 433Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.Core
  • 472Coordinate with enterprise-wide cyber defense staff to validate network alerts.Core
  • 559AAnalyze and report organizational security posture trends.Additional
  • 559BAnalyze and report system security posture trends.Additional
  • 576Ensure cybersecurity-enabled products or other compensating security control technologies reduce identified risk to an acceptable level.Additional
  • 593AAssess adequate access controls based on principles of least privilege and need-to-know.Additional
  • 716AMonitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus) to maintain currency of cyber defense threat condition and determine which security issues may have an impact on the enterprise.Additional
  • 717AAssess and monitor cybersecurity related to system implementation and testing practices.Additional
  • 723Document and escalate incidents (including event’s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.Core
  • 745Perform cyber defense trend analysis and reporting.Core
  • 750Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.Core
  • 767Perform security reviews and identify security gaps in security architecture resulting in recommendations for the inclusion into the risk mitigation strategy.Core
  • 782Plan and recommend modifications or adjustments based on exercise results or system environment.Additional
  • 800Provide daily summary reports of network events and activity relevant to cyber defense practices.Core
  • 806AProvides cybersecurity recommendations to leadership based on significant threats and vulnerabilities.Additional
  • 823Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.Core
  • 880AWork with stakeholders to resolve computer security incidents and vulnerability compliance.Additional
  • 938AProvide advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans.Additional
  • 956Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.Core
  • 958Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.Core
  • 959Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.Core
  • 1103Determine tactics, techniques, and procedures (TTPs) for intrusion sets.Additional
  • 1104Examine network topologies to understand data flows through the network.Additional
  • 1105Recommend computing environment vulnerability corrections.Additional
  • 1107Identify and analyze anomalies in network traffic using metadata (e.g., CENTAUR).Core
  • 1108Conduct research, analysis, and correlation across a wide variety of all source data sets (indications and warnings).Core
  • 1109Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.Additional
  • 1110Isolate and remove malware.Additional
  • 1111Identify applications and operating systems of a network device based on network traffic.Core
  • 1112Reconstruct a malicious attack or activity based off network traffic.Additional
  • 1113Identify network mapping and operating system (OS) fingerprinting activities.Additional
  • 2062Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the NE or enclave.Additional
  • 2611Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan.Additional

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 8Knowledge of authentication, authorization, and access control methods.Additional
  • 19Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.Core
  • 21Knowledge of computer algorithms.Additional
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 25Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).Additional
  • 27Knowledge of cryptography and cryptographic key management concepts.Additional
  • 34Knowledge of database systems.Additional
  • 43AKnowledge of embedded systems.Additional
  • 49Knowledge of host/network access control mechanisms (e.g., access control list).Additional
  • 58Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.Additional
  • 59AKnowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.Core
  • 61Knowledge of incident response and handling methodologies.Additional
  • 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Additional
  • 66Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.Core
  • 70Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).Core
  • 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Additional
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Core
  • 87Knowledge of network traffic analysis methods.Core
  • 88BKnowledge of new and emerging control systems technologies.Core
  • 90Knowledge of operating systems.Additional
  • 92Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).Core
  • 95AKnowledge of penetration testing principles, tools, and techniques.Additional
  • 98Knowledge of policy-based and risk adaptive access controls.Additional
  • 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Additional
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 110Knowledge of key concepts in security management (e.g., Release Management, Patch Management).Additional
  • 111Knowledge of security system design tools, methods, and techniques.Additional
  • 130AKnowledge of systems security testing and evaluation methods.Additional
  • 133Knowledge of key telecommunications concepts (e.g., Routing Algorithms, Fiber Optics Systems Link Budgeting, Add/Drop Multiplexers).Additional
  • 138Knowledge of the cyber defense Service Provider reporting structure and processes within one’s own organization.Additional
  • 139Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.Additional
  • 148Knowledge of Virtual Private Network (VPN) security.Additional
  • 150Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.Core
  • 177BKnowledge of countermeasures for identified security risks.Additional
  • 212AKnowledge of network mapping and recreating network topologies.Additional
  • 234BKnowledge of the use of subnetting tools.Additional
  • 270Knowledge of common adversary tactics, techniques, and procedures in assigned area of responsibility (i.e., historical country-specific tactics, techniques, and procedures; emerging capabilities).Additional
  • 271Knowledge of common network tools (e.g., ping, traceroute, nslookup).Additional
  • 277Knowledge of defense-in-depth principles and network security architecture.Additional
  • 278Knowledge of different types of network communication (e.g., LAN, WAN, MAN, WLAN, WWAN).Additional
  • 286Knowledge of file extensions (e.g., .dll, .bat, .zip, .pcap, .gzip).Additional
  • 342AKnowledge of operating system command line/prompt.Additional
  • 904Knowledge of interpreted and compiled computer languages.Additional
  • 912Knowledge of collection management processes, capabilities, and limitations.Additional
  • 915Knowledge of front-end collection systems, including traffic collection, filtering, and selection.Additional
  • 984Knowledge of cyber defense policies, procedures, and regulations.Core
  • 990Knowledge of the common attack vectors on the network layer.Core
  • 991Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).Core
  • 992CKnowledge of threat environments (e.g., threat actors, threat activities).Core
  • 1033Knowledge of basic system administration, network, and operating system hardening techniques.Additional
  • 1034AKnowledge of Personally Identifiable Information (PII) data security standards.Additional
  • 1034BKnowledge of Payment Card Industry (PCI) data security standards.Additional
  • 1034CKnowledge of Personal Health Information (PHI) data security standards.Additional
  • 1036Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.Additional
  • 1069AKnowledge of general kill chain (e.g., footprinting and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).Core
  • 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Additional
  • 1073Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.Additional
  • 1114Knowledge of encryption methodologies.Additional
  • 1119Knowledge of signature implementation impact.Additional
  • 1121Knowledge of Windows/Unix ports and services.Additional
  • 1142Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).Additional
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3431Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).Additional
  • 3461Knowledge of relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.Additional
  • 6210Knowledge of cloud service models and possible limitations for an incident response.Additional
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3CSkill in recognizing vulnerabilities in information and/or data systems.Additional
  • 75CSkill in conducting trend analysis.Additional
  • 175Skill in developing and deploying signatures.Additional
  • 179ASkill in assessing security controls based on cybersecurity principles and tenets.Additional
  • 181ASkill in detecting host and network based intrusions via intrusion detection technologies.Additional
  • 183Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.Additional
  • 199Skill in evaluating the adequacy of security designs.Additional
  • 214ASkill in performing packet-level analysis.Core
  • 229Skill in using incident handling methodologies.Additional
  • 233Skill in using protocol analyzers.Additional
  • 353Skill in collecting data from a variety of cyber defense resources.Core
  • 895Skill in recognizing and categorizing types of vulnerabilities and associated attacks.Core
  • 922BSkill in using network analysis tools, including specialized tools for non-traditional systems and networks (e.g., control systems), to identify vulnerabilities.Core
  • 1118Skill in reading and interpreting signatures (e.g., snort).Additional

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 1120Ability to interpret and incorporate data from multiple tool sources.Additional
  • 3007Ability to analyze malware.Additional

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

Equivalents

NICE work roles

From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

Free · DoD DCWF Tool v5.3 (2026-09-25)

O*NET jobs it reaches

Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

Free · O*NET 30.3