Skip to content

Cybersecurity · Work role code 541

Vulnerability Assessment Analyst

Performs assessments of systems and networks within the NE or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. Measures effectiveness of defense-in-depth architecture against known vulnerabilities.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 411AAnalyze organization's cybersecurity policies and configurations and evaluate compliance with regulations and organizational directives.Core
  • 448Conduct and/or support authorized penetration testing on enterprise network assets.Additional
  • 685AMaintain deployable cybersecurity audit toolkit (e.g., specialized cyber defense software and hardware) to support cybersecurity audit missions.Core
  • 692Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.Core
  • 784Prepare audit reports that identify technical and procedural findings, and provide recommended remediation strategies/solutions.Core
  • 939Conduct required reviews as appropriate within environment (e.g., Technical Surveillance, Countermeasure Reviews [TSCM], TEMPEST countermeasure reviews).Additional
  • 940BPerform technical (evaluation of technology) and non-technical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, control system and operational environments, enclave boundary, supporting infrastructure, and applications).Core
  • 941AMake recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes).Additional

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 10Knowledge of application vulnerabilities.Core
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 27Knowledge of cryptography and cryptographic key management concepts.Additional
  • 29Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.Additional
  • 49Knowledge of host/network access control mechanisms (e.g., access control list).Additional
  • 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Additional
  • 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Additional
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Additional
  • 92Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).Core
  • 95BKnowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).Core
  • 102Knowledge of programming language structures and logic.Additional
  • 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Core
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 128Knowledge of systems diagnostic tools and fault identification techniques.Additional
  • 150Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.Core
  • 214BKnowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).Additional
  • 904Knowledge of interpreted and compiled computer languages.Additional
  • 991Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).Additional
  • 992BKnowledge of cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored).Additional
  • 992CKnowledge of threat environments (e.g., threat actors, threat activities).Additional
  • 1021AKnowledge of threat and risk assessment.Additional
  • 1033Knowledge of basic system administration, network, and operating system hardening techniques.Additional
  • 1038AKnowledge of infrastructure supporting information technology (IT) for safety, performance, and reliability.Additional
  • 1069Knowledge of general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).Additional
  • 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Core
  • 1141AKnowledge of an organization's information classification program and procedures for information compromise.Additional
  • 1142Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).Additional
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3150Knowledge of ethical hacking principles and techniques.Additional
  • 3222Knowledge of data backup and restoration concepts.Additional
  • 3513Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.Additional
  • 6210Knowledge of cloud service models and possible limitations for an incident response.Additional
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3BSkill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.Core
  • 10ASkill in conducting application vulnerability assessments.Core
  • 27BSkill in assessing the application of cryptographic standards.Additional
  • 160Skill in assessing the robustness of security systems and designs.Additional
  • 181ASkill in detecting host and network based intrusions via intrusion detection technologies.Additional
  • 210Skill in mimicking threat behaviors.Additional
  • 225ASkill in the use of penetration testing tools and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).Core
  • 226Skill in the use of social engineering techniques.Additional
  • 897ASkill in performing impact/risk assessments.Additional
  • 922BSkill in using network analysis tools, including specialized tools for non-traditional systems and networks (e.g., control systems), to identify vulnerabilities.Core
  • 6660Skill in reviewing logs to identify evidence of past intrusions.Additional

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 4Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.Additional
  • 102AAbility to apply programming language structures (e.g., source code review) and logic.Additional
  • 6918Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.Additional

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

Equivalents

NICE work roles

From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

Free · DoD DCWF Tool v5.3 (2026-09-25)

O*NET jobs it reaches

Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

Free · O*NET 30.3