Cable and Antenna Operations

You are training to be a Cyberspace Defense Analyst — a network security specialist responsible for monitoring, detecting, and responding to cyber threats against Air Force networks. You are on the front line of a domain that operates continuously and that adversaries probe every day without pause.

Complete the 1D7X3 initial skills training pipeline at Keesler AFB, MS. Learn network defense fundamentals — intrusion detection, security information and event management (SIEM) tools, network traffic analysis, log review, and the indicators of compromise that signal malicious activity. Study the Air Force and DoD network architecture you will be defending. Learn to use the tools deployed at Cyberspace Defense (CD) units — SIEMs, packet capture tools, endpoint detection platforms, and vulnerability management systems. Develop the analytical habits that distinguish an effective defender from one who generates alerts without understanding them.

• 01Network intrusion detection, SIEM tool operation, log analysis, packet capture and traffic analysis, indicators of compromise identification, endpoint security monitoring, Air Force network architecture knowledge

• —AFMAN 17-1303 (Cyberspace Defense), NIST publications applicable to federal network defense, DISA STIGs for Air Force networks, Air Forces Cyber (AFCYBER) tactics publications

• —Pass 1D7X3 initial training; network analysis demonstrated to standard; SIEM tool operations proficient; IOC identification accurate; all classified system access rules observed

• —Responding to every alert as an isolated event without building the pattern recognition that identifies coordinated campaigns — the defender who responds to individual alerts without asking "is this part of something larger?" will always be behind a sophisticated adversary.

An apprentice 1D7X3 who treats every shift as an opportunity to understand the adversary's methods, not just to clear the alert queue — who reads threat intelligence products, asks senior analysts about the campaigns behind recent alerts, and builds a mental model of the threat environment rather than just the tool procedures.

You are a qualified Cyberspace Defense Analyst defending Air Force networks during operational shifts, building the threat awareness and technical depth that effective network defense demands.

Operate as a qualified CD analyst during shift operations at a Cyber Protection Team, Air Forces Cyber unit, or AFNET operations center. Monitor assigned network segments for anomalous activity, investigate potential intrusions, and respond to confirmed incidents. Produce accurate incident reports and escalate appropriately. Develop threat hunting skills — proactively searching for adversary activity that has not yet triggered automated detection. Contribute to sensor tuning to reduce false positives without creating detection gaps. Begin working toward advanced certifications and the upgrade path to the Cyber Protection Team (CPT) hunt and defend roles.

• 01Network shift operations, incident investigation and reporting, threat hunting methodology, sensor tuning, escalation procedures, incident response coordination, advanced certification pursuit

• —AFMAN 17-1303, AFCYBER operational publications, CISA and NSA cybersecurity advisories for current threat environment, unit incident response plans

• —Detection quality accurate with low false negative rate; incident reports clear and actionable; escalation decisions appropriate; threat hunting producing findings; sensor tuning improvements documented

• —Tuning detection sensors to eliminate noise without documenting what was removed and why — every suppression rule creates a potential blind spot, and the analyst who cannot explain why a specific signature was tuned out is a liability during the next investigation that involves similar activity.

A SrA analyst who maintains a personal log of every significant detection event and the investigation that followed — building a personal case study library that improves their threat hunting skills over time and that provides training material for more junior analysts.

You are a senior 1D7X3 analyst, building toward advanced technical qualifications and developing the ability to lead incident response and train junior analysts.

Operate as a senior CD analyst, lead incident response investigations, and pursue advanced technical qualifications — CompTIA CySA+, GCIH (GIAC Certified Incident Handler), or similar certifications that deepen technical capability. Train junior analysts on detection, investigation, and incident response procedures. Lead shift-level incident coordination. Contribute to SOC procedure development and playbook improvement. Develop specializations in specific threat types, network segments, or detection technologies. Represent the section at cyber threat intelligence sharing events.

• 01Senior analyst operations, incident response leadership, advanced technical certifications, junior analyst mentoring, SOC procedure development, threat intelligence integration, technical specialization development

• —AFMAN 17-1303, AFCYBER tactics publications, MITRE ATT&CK framework, threat intelligence sharing platforms (SIPR/JWICS), unit SOC playbooks

• —Advanced certifications current; incident response leadership effective; junior analysts trained to standard; SOC procedures improved through contributions; threat intelligence applied in detection improvements

• —Becoming technically deep in one area of network defense without maintaining breadth — the analyst who can only work specific tool environments or threat types becomes a scheduling dependency rather than a force multiplier.

An SSgt analyst who has contributed at least one documented improvement to the unit's detection capability — a new detection rule, an updated playbook, a sensor tuning change that improved true positive rates — and who can describe the specific adversary technique it was designed to catch.

You are the senior 1D7X3 NCO within your unit, responsible for the training program, technical standards, and operational readiness of the cyberspace defense analyst section.

Serve as the CD section NCOIC or shift lead supervisor. Own the technical training program — manage analyst qualification, certification tracking, and skills development. Brief the section commander on analyst readiness and detection capability. Lead complex incident response investigations. Interface with mission defense team (MDT) leads and cyber protection team (CPT) leads on network security posture. Represent the section at cyber threat sharing forums. Advise the commander on technical capability gaps and required investments.

• 01Section NCOIC duties, technical training program management, incident response leadership, MDT/CPT coordination, cyber threat community engagement, capability gap assessment, readiness reporting

• —AFMAN 17-1303, AFCYBER management publications, DISA network security publications, unit incident response plans

• —All analysts maintaining required certifications; detection effectiveness meeting AFCYBER standards; section training documentation audit-ready; incident response capability demonstrated in exercises

• —Managing analyst certifications as a compliance requirement rather than a technical capability indicator — certifications that have expired but whose underlying skills are still practiced are less of a risk than certifications that are current but whose skills are not regularly exercised.

A TSgt who evaluates section readiness against actual detection performance — false negative rates, mean time to detect, incident investigation quality — rather than against certification expiration dates, and who can brief the commander on both.

You are the senior 1D7X3 functional at the group or command level, advising commanders on cyberspace defense capability and managing the analyst force.

Serve as the wing or AFCYBER group cyber defense superintendent. Advise commanders on network defense capability, analyst readiness, and emerging threat trends. Interface with AFCYBER and JFHQ-DODIN on career field management and mission requirements. Manage complex personnel actions for cyber analysts. Contribute to cyber defense doctrine and AFMAN updates. Represent the 1D7X3 community at AFCYBER standardization forums. As 1stSgt, own the welfare and discipline of the cyber operations formation.

• 01Group/wing cyber defense oversight, AFCYBER and JFHQ-DODIN interface, career field management, doctrine contribution, complex personnel management, senior enlisted advisory

• —AFCYBER directives, AFMAN 17-1303, JFHQ-DODIN publications, DoD cyber operations publications

• —Wing cyber defense capability meeting AFCYBER standards; analyst force technically current; doctrine contributions accurate; personnel actions appropriate

• —Allowing the cyber defense section to operate as a compliance-reporting function rather than an active threat-hunting team — MSgts who measure their section by audit findings rather than threat detection effectiveness are optimizing for inspection performance rather than mission performance.

An MSgt who briefs the wing commander on the section's actual detection effectiveness — what threats were hunted and found, what near-misses occurred, what the current adversary activity pattern looks like — not just on certification status and inspection compliance.

You are the most senior 1D7X3 enlisted leader, shaping cyberspace defense career field policy and Air Force network defense capability at the command level.

Serve as the AFCYBER or 16th Air Force cyberspace defense career field functional manager or senior enlisted cyber advisor. Shape analyst training standards, certification requirements, and the pipeline producing network defenders for the Air Force and joint cyber community. Advise four-star commanders on network defense posture, adversary trends, and the implications of network architecture changes on defensive capability. Interface with NSA, CISA, JFHQ-DODIN, and Cyber Command on defense standards and threat sharing. Ensure the career field evolves to address near-peer adversary capabilities.

• 01Career field functional management, four-star command advisory, NSA/CISA/JFHQ-DODIN engagement, near-peer threat assessment, network defense doctrine, pipeline oversight

• —AFCYBER career field publications, DoD cyber operations doctrine, NSA and CISA technical guidance, joint cyber publications

• —Career field pipeline producing technically current defenders; near-peer defense doctrine realistic; four-star commanders have accurate network defense posture assessments; training keeps pace with adversary capability evolution

• —Allowing training pipelines and certification programs to lag adversary capability evolution by 12-18 months — in cyberspace, a defender who was trained on last year's threat techniques is defending against this year's threat with outdated tools.

A CMSgt who has established a mechanism for incorporating current NSA and CISA threat intelligence into 1D7X3 training within 60 days of publication — so that the pipeline produces analysts who are trained against the threats that are actually active, not the ones that were active 18 months ago when the training was written.