Protection and Defense · PD-WRL-001 · OPM code 511
Defensive Cybersecurity
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for analyzing data collected from various cybersecurity defense tools to mitigate risks.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T0020 Develop content for cyber defense tools
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0164 Perform cyber defense trend analysis and reporting
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0292 Recommend computing environment vulnerability corrections
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0299 Identify network mapping and operating system (OS) fingerprinting activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1020 Determine the operational and safety impacts of cybersecurity lapses
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1021 Review cyber defense service provider reporting structure
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1084 Identify anomalous network activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1085 Identify potential threats to network resources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1112 Validate network alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1119 Recommend vulnerability remediation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1176 Determine if cybersecurity-enabled products reduce identified risk to acceptable levels
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1177 Determine if security control technologies reduce identified risk to acceptable levels
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1241 Document cybersecurity incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1242 Escalate incidents that may cause ongoing and immediate impact to the environment
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1254 Determine the effectiveness of an observed attack
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1266 Recommend risk mitigation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1278 Recommend system modifications
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1290 Communicate daily network event and activity reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1299 Determine causes of network alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1347 Detect cybersecurity attacks and intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1348 Distinguish between benign and potentially malicious cybersecurity attacks and intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1349 Communicate cybersecurity attacks and intrusions alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1350 Perform continuous monitoring of system activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1351 Determine impact of malicious activity on systems and information
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1384 Establish intrusion set procedures
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1386 Analyze network traffic anomalies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1387 Validate intrusion detection system alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1388 Isolate malware
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1389 Remove malware
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1390 Identify network device applications and operating systems
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1391 Reconstruct malicious attacks
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1406 Construct cyber defense network tool signatures
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1428 Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cybersecurity incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1539 Analyze organizational cybersecurity posture trends
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1540 Develop organizational cybersecurity posture trend reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1541 Develop system security posture trend reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1548 Determine adequacy of access controls
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1582 Maintain currency of cyber defense threat conditions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1583 Determine effectiveness of system implementation and testing processes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1603 Recommend threat and vulnerability risk mitigation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1615 Advise stakeholders on vulnerability compliance
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1616 Resolve computer security incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1618 Advise stakeholders on disaster recovery, contingency, and continuity of operations plans
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0068Knowledge of programming language structures and logic
- K0674Knowledge of computer networking protocols
- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0680Knowledge of cybersecurity principles and practices
- K0681Knowledge of privacy principles and practices
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0685Knowledge of access control principles and practices
- K0686Knowledge of authentication and authorization tools and techniques
- K0689Knowledge of network infrastructure principles and practices
- K0691Knowledge of cyber defense tools and techniques
- K0692Knowledge of vulnerability assessment tools and techniques
- K0694Knowledge of computer algorithm capabilities and applications
- K0698Knowledge of cryptographic key management principles and practices
- K0707Knowledge of database systems and software
- K0710Knowledge of enterprise cybersecurity architecture principles and practices
- K0716Knowledge of host access control (HAC) systems and software
- K0717Knowledge of network access control (NAC) systems and software
- K0718Knowledge of network communications principles and practices
- K0723Knowledge of vulnerability data sources
- K0724Knowledge of incident response principles and practices
- K0725Knowledge of incident response tools and techniques
- K0726Knowledge of incident handling tools and techniques
- K0728Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices
- K0729Knowledge of non-repudiation principles and practices
- K0730Knowledge of cyber safety principles and practices
- K0731Knowledge of systems security engineering (SSE) principles and practices
- K0732Knowledge of intrusion detection tools and techniques
- K0736Knowledge of information technology (IT) security principles and practices
- K0742Knowledge of identity and access management (IAM) principles and practices
- K0743Knowledge of new and emerging technologies
- K0744Knowledge of operating system (OS) systems and software
- K0746Knowledge of policy-based access controls
- K0747Knowledge of Risk Adaptive (Adaptable) Access Controls (RAdAC)
- K0749Knowledge of process engineering principles and practices
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0756Knowledge of security management principles and practices
- K0757Knowledge of system design tools and techniques
- K0758Knowledge of server administration principles and practices
- K0759Knowledge of client and server architecture
- K0765Knowledge of software engineering principles and practices
- K0766Knowledge of data asset management principles and practices
- K0770Knowledge of system administration principles and practices
- K0772Knowledge of systems testing and evaluation tools and techniques
- K0773Knowledge of telecommunications principles and practices
- K0778Knowledge of enterprise information technology (IT) architecture principles and practices
- K0779Knowledge of systems engineering processes
- K0781Knowledge of virtual private network (VPN) systems and software
- K0783Knowledge of network attack characteristics
- K0784Knowledge of insider threat laws and regulations
- K0785Knowledge of insider threat tools and techniques
- K0788Knowledge of adversarial tactics principles and practices
- K0789Knowledge of adversarial tactics tools and techniques
- K0790Knowledge of adversarial tactics policies and procedures
- K0791Knowledge of defense-in-depth principles and practices
- K0792Knowledge of network configurations
- K0793Knowledge of file extensions
- K0805Knowledge of command-line tools and techniques
- K0812Knowledge of digital communication systems and software
- K0813Knowledge of interpreted and compiled programming language characteristics
- K0815Knowledge of intelligence collection management processes
- K0816Knowledge of front-end intelligence collection systems and software
- K0829Knowledge of account creation policies and procedures
- K0830Knowledge of password policies and procedures
- K0831Knowledge of network attack vectors
- K0832Knowledge of cyberattack characteristics
- K0833Knowledge of cyberattack actor characteristics
- K0837Knowledge of hardening tools and techniques
- K0840Knowledge of hardware reverse engineering tools and techniques
- K0842Knowledge of software reverse engineering tools and techniques
- K0844Knowledge of cyber attack stages
- K0845Knowledge of cyber intrusion activity phases
- K0848Knowledge of network systems management principles and practices
- K0849Knowledge of network systems management tools and techniques
- K0851Knowledge of reverse engineering principles and practices
- K0859Knowledge of encryption tools and techniques
- K0860Knowledge of malware signature principles and practices
- K0861Knowledge of network port capabilities and applications
- K0870Knowledge of enterprise architecture (EA) reference models and frameworks
- K0871Knowledge of enterprise architecture (EA) principles and practices
- K0877Knowledge of application firewall principles and practices
- K0878Knowledge of network firewall principles and practices
- K0879Knowledge of industry cybersecurity models and frameworks
- K0880Knowledge of access control models and frameworks
- K0891Knowledge of the Open Systems Interconnect (OSI) reference model
- K0892Knowledge of cyber defense laws and regulations
- K0915Knowledge of network architecture principles and practices
- K0917Knowledge of Personally Identifiable Information (PII) data security standards and best practices
- K0918Knowledge of Payment Card Industry (PCI) data security standards and best practices
- K0919Knowledge of Personal Health Information (PHI) data security standards and best practices
- K0924Knowledge of network analysis tools and techniques
- K0928Knowledge of systems engineering principles and practices
- K0937Knowledge of countermeasure design principles and practices
- K0938Knowledge of network mapping principles and practices
- K0939Knowledge of packet-level analysis tools and techniques
- K0940Knowledge of subnet tools and techniques
- K0942Knowledge of cryptology principles and practices
- K0947Knowledge of computer engineering principles and practices
- K0948Knowledge of embedded systems and software
- K0950Knowledge of Intrusion Detection System (IDS) tools and techniques
- K0951Knowledge of Intrusion Prevention System (IPS) tools and techniques
- K0955Knowledge of penetration testing principles and practices
- K0956Knowledge of penetration testing tools and techniques
- K0962Knowledge of targeting laws and regulations
- K0963Knowledge of exploitation laws and regulations
- K0969Knowledge of cyber-attack tools and techniques
- K0983Knowledge of computer networking principles and practices
- K1014Knowledge of network security principles and practices
- K1079Knowledge of web application security risks
- K1089Knowledge of protocol analyzer tools and techniques
- K1108Knowledge of traceroute tools and techniques
- K1131Knowledge of cyber defense monitoring tools
- K1132Knowledge of cyber defense system analysis tools
- K1144Knowledge of data correlation tools and techniques
- K1168Knowledge of intrusion set tools and techniques
- K1176Knowledge of network topologies
- K1181Knowledge of organizational cybersecurity incident response plans
- K1193Knowledge of packet analysis tools and techniques
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0156Skill in performing packet-level analysis
- S0483Skill in identifying software communications vulnerabilities
- S0490Skill in recreating network topologies
- S0509Skill in evaluating security products
- S0543Skill in scanning for vulnerabilities
- S0544Skill in recognizing vulnerabilities
- S0566Skill in developing signatures
- S0567Skill in deploying signatures
- S0572Skill in detecting host- and network-based intrusions
- S0574Skill in developing security system controls
- S0578Skill in evaluating security designs
- S0593Skill in handling incidents
- S0600Skill in collecting relevant data from a variety of sources
- S0614Skill in categorizing types of vulnerabilities
- S0627Skill in reading signatures
- S0651Skill in performing malware analysis
- S0667Skill in assessing security controls
- S0688Skill in performing network data analysis
- S0712Skill in evaluating data source quality
- S0722Skill in interpreting traceroute results
- S0755Skill in reconstructing a network
- S0809Skill in utilizing cyber defense service provider information
- S0838Skill in identifying anomalous activities
- S0839Skill in identifying exploited system weaknesses
- S0840Skill in identifying misuse activities
- S0846Skill in monitoring system activity
- S0854Skill in performing data analysis
- S0857Skill in performing dynamic analysis
- S0859Skill in performing event correlation
- S0863Skill in performing incident analysis
- S0866Skill in performing log file analysis
- S0867Skill in performing malicious activity analysis
- S0869Skill in performing metadata analysis
- S0872Skill in performing network data flow analysis
- S0874Skill in performing network traffic analysis
- S0875Skill in performing network traffic packet analysis
- S0885Skill in performing system activity analysis
- S0892Skill in performing trend analysis
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Information Security Analysts 15-1212.00DWAs covered10 of 10
- Information Security Engineers 15-1299.05DWAs covered5 of 21
- Penetration Testers 15-1299.04DWAs covered3 of 18
- Digital Forensics Analysts 15-1299.06DWAs covered1 of 20
- Forensic Science Technicians 19-4092.00DWAs covered0 of 20
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Information Security Analysts 15-1212.00
- Information Security Engineers 15-1299.05
- Penetration Testers 15-1299.04
- Digital Forensics Analysts 15-1299.06
- Forensic Science Technicians 19-4092.00
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)- Cyber Defense Analyst 511 · Cybersecurity · linked by DCWF Tool NCWF ID