Skip to content

Cyber Effects · Work role code 551

Red Team Specialist

Leverages tools, systems, and utilities necessary to enhance the security posture of an organization, conducts threat and risk assessments, and performs testing and evaluation in accordance with legal and organizational requirements, policies, and regulations.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 448Conduct and/or support authorized penetration testing on enterprise network assets.Unassigned
  • 767Perform security reviews and identify security gaps in security architecture resulting in recommendations for the inclusion into the risk mitigation strategy.Unassigned
  • 801BProvide cybersecurity and supply chain risk management guidance.Unassigned
  • 806AProvides cybersecurity recommendations to leadership based on significant threats and vulnerabilities.Unassigned
  • 940BPerform technical (evaluation of technology) and non-technical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, control system and operational environments, enclave boundary, supporting infrastructure, and applications).Unassigned
  • 1104Examine network topologies to understand data flows through the network.Unassigned
  • 1111Identify applications and operating systems of a network device based on network traffic.Unassigned
  • 2123Conduct on-net and off-net activities to control, and exfiltrate data from deployed, automated technologies.Unassigned
  • 8189Review requirements to verify mission scope.Unassigned
  • 8194Submit capabilities requirements to developers.Unassigned
  • 8209Utilize multifaceted intelligence resources to develop comprehensive operational strategies.Unassigned
  • 8227Conduct shaping activities in order to scope and execute red team operations.Unassigned
  • 8228Assess access controls based on principles of least privilege and need-to-know.Unassigned
  • 8229Maintain consistent operational logs to facilitate deconfliction and sanitization.Unassigned
  • 8230Conduct red team operations in accordance with organizational policies and regulations.Unassigned
  • 8231Document the execution and results of a red team operation.Unassigned
  • 8232Employ lateral movement TTPs in red team operations.Unassigned
  • 8233Record and document activities during red team operations.Unassigned

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 10Knowledge of application vulnerabilities.Unassigned
  • 19Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.Unassigned
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 25Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).Unassigned
  • 27Knowledge of cryptography and cryptographic key management concepts.Unassigned
  • 34Knowledge of database systems.Unassigned
  • 49Knowledge of host/network access control mechanisms (e.g., access control list).Unassigned
  • 58Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.Unassigned
  • 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Unassigned
  • 70Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).Unassigned
  • 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Unassigned
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Unassigned
  • 87Knowledge of network traffic analysis methods.Unassigned
  • 88AKnowledge of current and emerging cyber technologies.Unassigned
  • 92Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).Unassigned
  • 102Knowledge of programming language structures and logic.Unassigned
  • 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Unassigned
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 111Knowledge of security system design tools, methods, and techniques.Unassigned
  • 130AKnowledge of systems security testing and evaluation methods.Unassigned
  • 138Knowledge of the cyber defense Service Provider reporting structure and processes within one’s own organization.Unassigned
  • 148Knowledge of Virtual Private Network (VPN) security.Unassigned
  • 177BKnowledge of countermeasures for identified security risks.Unassigned
  • 212AKnowledge of network mapping and recreating network topologies.Unassigned
  • 214BKnowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).Unassigned
  • 270Knowledge of common adversary tactics, techniques, and procedures in assigned area of responsibility (i.e., historical country-specific tactics, techniques, and procedures; emerging capabilities).Unassigned
  • 904Knowledge of interpreted and compiled computer languages.Unassigned
  • 922AKnowledge of how to use network analysis tools to identify vulnerabilities.Unassigned
  • 991Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).Unassigned
  • 992CKnowledge of threat environments (e.g., threat actors, threat activities).Unassigned
  • 1033Knowledge of basic system administration, network, and operating system hardening techniques.Unassigned
  • 1034AKnowledge of Personally Identifiable Information (PII) data security standards.Unassigned
  • 1036Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.Unassigned
  • 1069Knowledge of general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).Unassigned
  • 1069AKnowledge of general kill chain (e.g., footprinting and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).Unassigned
  • 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Unassigned
  • 1114Knowledge of encryption methodologies.Unassigned
  • 1121Knowledge of Windows/Unix ports and services.Unassigned
  • 1141AKnowledge of an organization's information classification program and procedures for information compromise.Unassigned
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3150Knowledge of ethical hacking principles and techniques.Unassigned
  • 3154Knowledge of classification and control markings standards, policies and procedures.Unassigned
  • 3274Knowledge of fundamental cyber operations concepts, terminology/lexicon (i.e., environment preparation, cyber attack, cyber defense), principles, capabilities, limitations, and effects.Unassigned
  • 3513Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.Unassigned
  • 4097Knowledge of network security implementations (e.g., host-based IDS, IPS, access control lists), including their function and placement in a network.Unassigned
  • 4400Knowledge of basic operational infrastructure.Unassigned
  • 4411Knowledge of command line and GUI interfaces.Unassigned
  • 4450Knowledge of Friendly Network Forces (FNF) reporting procedures (i.e., deconfliction) to include external organization interaction.Unassigned
  • 4462Knowledge of how authentication and logging systems are implemented within a target network.Unassigned
  • 4483Knowledge of Malware TTPsUnassigned
  • 4512Knowledge of persistence tools and methods (e.g., Implants/Rootkits, Tunneling, Native Actions).Unassigned
  • 4515Knowledge of Post-Exploitation TTPs (e.g., data exfiltration, privilege escalation, operational prep of the environment).Unassigned
  • 4550Knowledge of the structure, architecture, design, and vulnerabilities of digital communications networks.Unassigned
  • 4553Knowledge of the concept of an advanced persistent threat (APT)Unassigned
  • 4575Knowledge of the risks associated with maneuver, capabilities, and TTPs against target systems.Unassigned
  • 4592Knowledge of virtualized and cloud based systems.Unassigned
  • 4709Knowledge of process manipulation (e.g., hollowing, injection, etc.).Unassigned
  • 4710Knowledge of the Trusted Agent Program.Unassigned
  • 4711Knowledge of web application vulnerabilities.Unassigned
  • 4712Knowledge of Active Directory.Unassigned
  • 4713Knowledge of credential cracking techniques.Unassigned
  • 4714Knowledge of Command and Control (C2) frameworks.Unassigned
  • 4715Knowledge of the appropriate authorities, responsibilities, and approval processes that enable red team operations.Unassigned
  • 4716Knowledge of factors that would suspend or abort an operation.Unassigned
  • 4717Knowledge of individual training and certification requirements for the individual members of the mission team.Unassigned
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3BSkill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.Unassigned
  • 10ASkill in conducting application vulnerability assessments.Unassigned
  • 75CSkill in conducting trend analysis.Unassigned
  • 162Skill in conducting capabilities and requirements analysis.Unassigned
  • 179ASkill in assessing security controls based on cybersecurity principles and tenets.Unassigned
  • 210Skill in mimicking threat behaviors.Unassigned
  • 897ASkill in performing impact/risk assessments.Unassigned
  • 3929Skill in using tools, techniques, and procedures to remotely exploit and establish persistence on a target.Unassigned
  • 4602Skill in analyzing network device configurations.Unassigned
  • 4608Skill in assessing target security posture.Unassigned
  • 4644Skill in performing research through open source tools.Unassigned
  • 4682Skill in utilizing network mapping.Unassigned
  • 4704Skill in leading red team operations in support of mission and target requirements.Unassigned
  • 4705Skill in using network analysis tools.Unassigned
  • 4706Skill in leveraging tools, system services, or utilities to laterally move to target systems.Unassigned
  • 4707Skill in exploiting system vulnerabilities to escalate privileges.Unassigned
  • 4708Skill in enumerating a system or network for situational awareness of the target environment and current level of access.Unassigned
  • 6660Skill in reviewing logs to identify evidence of past intrusions.Unassigned

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 4Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.Unassigned
  • 3003Ability to adjust to and operate in a diverse, unpredictable, challenging, and fast-paced work environment.Unassigned
  • 4192Ability to articulate and recommend changes to policies, processes, and procedures.Unassigned
  • 4262Ability to export/enumerate information (e.g., users, groups) from a Domain Controller.Unassigned
  • 4280Ability to identify new and emerging vulnerabilities.Unassigned
  • 4282Ability to identify opportunities for conducting server side and client side exploits.Unassigned
  • 4299Ability to manage implants and deployment strategies.Unassigned
  • 4718Ability to properly identify, coordinate, and remediate a halting condition.Unassigned
  • 4719Ability to conduct technical exchanges and hot washes of assessment findings with non-technical audiences.Unassigned
  • 4720Ability to operate covertly within a target network.Unassigned
  • 4721Ability to leverage implants and/or exploit vulnerabilities on a target system to facilitate initial access.Unassigned
  • 4722Ability to leverage tools for passive and active reconnaissance of target networks and/or systems.Unassigned
  • 4723Ability to recognize and respond to unanticipated events (e.g., identification of information spillage, misuse of government information systems) during Red Team operations, in accordance with organizational policies.Unassigned

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.