Information Technology Specialist

You are the tier-1 ticket queue. The brigade S6 lives and dies by whether the company commander's laptop boots, and right now that is your job.

You reimage workstations, reset CAC PINs, plug in CAT-5, and close tickets in Remedy or ServiceNow. You will be sent to set up VTC equipment for an O-6 briefing and you will rerun a cable nine times. You support SIPR and NIPR side by side and you learn the difference between "users said it was working yesterday" and "the WSUS server is broken." Find the staff sergeant who actually runs the S6 shop — not the one whose name is on the door — and shadow him.

• 01CAC enrollment, PIN reset, and DEERS lookup workflow in your sleep — this is 30% of your weekly tickets.
• 02Image a workstation off the Army Gold Master (AGM) image and rejoin it to the domain without breaking GPOs.
• 03Read and trace a CAT-5 run from the wall jack to the patch panel to the switch port — punch down a 568B if you have to.
• 04Operate the unit's VTC stack — DVS-G, Cisco TelePresence, Polycom — and run pre-brief checks 30 minutes early, every time.
• 05Open, work, and close a Remedy/ServiceNow ticket cleanly — categorization, resolution notes, customer signoff.
• 06Lock down a workstation per the DISA STIG checklist before you push it to a user.

• —AR 25-1 — Army Information Technology; AR 25-2 — Army Cybersecurity (read both, even if you only ever read them once).
• —DoD 8570.01-M / DoDM 8140 — Cyberspace Workforce Management (this is the chart that gates your IAT-II/III billet).
• —DISA STIGs for Windows / Active Directory / Cisco IOS (public.cyber.mil).
• —CompTIA Security+ exam objectives — the SY0-701 study set, even if you have not sat the test yet.
• —ATP 6-02.71 — Techniques for Department of the Army Information Network Operations.
• —Unit SOPs for the local enclave — read them once, screenshot them, refer to them weekly.

• —CompTIA Security+ certification by your one-year mark in the unit (the IAT-II floor for 25B jobs).
• —A+ and Network+ if you do not arrive with them — the Army Credentialing Assistance program pays for the voucher.
• —Ticket SLA: tier-1 issues closed inside 24 hours, escalations documented with the time, action, and outcome.
• —Zero "lost laptops." Every device you touch is signed in and signed out of the property book.
• —Annual cyber awareness training (DoD CYBER AWARENESS) completed before the deadline. You will be the person whose lapse locks the brigade out.

• —Plugging a personal USB into a government workstation. You will be in the SAC commander's office that afternoon.
• —Sharing a CAC PIN over the phone or in chat. Even once. The OPSEC office runs spot checks.
• —Closing a ticket as "resolved" without confirming with the user. The next morning the senior officer reopens it as "you did nothing," with cc to your 1SG.
• —Imaging a machine off a personal USB stick instead of the AGM. The trust-level mismatch causes a STIG failure on the next IAVA audit.
• —Telling a senior officer "I cannot do that" without offering the workaround. Always have the next step ready.

The good 25B cherry is the soldier the staff sergeant sends to the brigade CO's laptop problem because they know it will come back fixed and the CO will not bring it up at the BUB. By month nine they have Sec+ done; by month eighteen they are running a help-desk rotation and have started the CCNA path on their own time.

You are the technical lead nobody calls a technical lead. You inherit the broken project and the help-desk queue at the same time.

You run the WSUS / SCCM patch cycle, you administer AD users and groups inside your delegated OU, you push GPOs that touch every workstation in the brigade, and you build the JBC-P / FBCB2 / VSAT comm package in the field. You train new privates on the help-desk SOP. You are also the one the platoon sergeant sends to a TDY for new system fielding — JCR, Win-T-equivalent, MR2C2 — because he can trust you not to embarrass the brigade.

• 01Manage Active Directory users, groups, and OUs at the delegated level — no domain-admin shortcuts, no sloppy group nesting.
• 02Run a SCCM / Tanium / WSUS patch deployment cycle on a published schedule with reporting back to S6.
• 03Stand up a tactical network in the field: VSAT or commercial SATCOM uplink, Cisco router, DHCP, internal DNS, switch VLAN config, with a printed diagram you can hand the platoon sergeant.
• 04Operate JBC-P / Joint Battle Command-Platform — set up server, push the COP, troubleshoot a downed track in under 15 minutes.
• 05Run a PowerShell script that you wrote, not copied. Even one. The brigade S6 will notice.
• 06Walk a senior staff officer through a phishing remediation without making him feel stupid — and document the IR ticket cleanly.

• —AR 25-2 — Army Cybersecurity (own it, do not just read it).
• —CJCSI 6510.01F — Information Assurance and Support to Computer Network Defense.
• —DISA STIGs you actually administer: Windows 10/11, Server, AD, Cisco IOS, Office 365.
• —NIST SP 800-53 — Security and Privacy Controls (the parent document under every Army cyber reg).
• —ATP 6-02.71 — Army Information Network Operations Techniques.
• —CompTIA Network+, CCNA, and the IT Fundamentals (ITIL 4) tracks via Army CA.

• —IAT Level II compliance maintained at all times (Sec+ continuing education or CCNA-Security).
• —CCNA before E-5 board if you are signal-side; Microsoft Azure Fundamentals (AZ-900) or AZ-104 if you are cloud-side.
• —BLC graduate; promotion points stacked through credentials, schools, and college (CompTIA Linux+, ITIL 4 Foundation count).
• —Zero CAT-1 STIG findings on systems you administer during the BCT cyber inspection.
• —Take the JCU / 17C reclass conversation seriously if the talent and the slot align — the cyber path is the highest-ceiling option in this MOS.

• —Using shared admin accounts. Every action on a domain controller is logged; ownership-by-shared-account ends careers.
• —Patching outside a maintenance window. You will brick the brigade in the middle of a live BUB.
• —Building a tactical network without printing the diagram and the IP plan. When you take leave, the relief cannot inherit your stack.
• —Treating cyber-incident response as a help-desk ticket. A phishing campaign is reported to ARCYBER inside the timelines or your S6 is on the phone with brigade in the worst possible meeting.
• —Bypassing the change-management process because "it is just a quick fix." The S6 audit catches it; the IG catches what the S6 misses.

The good Specialist 25B is the soldier the S6 puts on the brigade CG's laptop problem and the rotation's tactical satellite uplink in the same week, because both come back working and the SGM does not have to ask twice. He has CCNA on the wall, a 17C reclass packet in his folder if he wants it, and a job offer from the contractor sitting next to him on the deployment.

You are the senior tech on the help-desk floor or the field NCOIC of a 3-5 soldier comm team. The S6 OIC briefs the BN CDR off the data you produced.

You own a slice of the brigade IT enterprise — the help-desk floor, the systems administration cell, or the tactical comm node. You write the OPORD annex for S6 in the field, you sign for hundreds of thousands of dollars of comm gear, and you train your two specialists into the next ALC-ready NCO. You sit at the BUB when the CO needs the network read; you go to the CIO/G-6 working group when the brigade S6 OIC cannot.

• 01Lead a 3-5 soldier section through a tactical comms package — site survey, install, validate, sustain — to the unit Mission Essential Task List standard.
• 02Brief a network status update to the BN/BDE commander in five slides — uptime, ticket SLAs, IAVA compliance, incidents, ongoing risk.
• 03Run an Information Assurance Vulnerability Alert (IAVA) closure cycle inside the timeline — track, patch, validate, report.
• 04Conduct a real change-management board on a tactical network — risk, rollback, validation, sign-off.
• 05Onboard a new specialist or PFC and have them productive on the help desk in two weeks, including STIG familiarity and ticket discipline.
• 06Write an incident response report to ARCYBER standard — timeline, indicators, containment, eradication, recovery, lessons learned.

• —AR 25-2 — Army Cybersecurity; AR 25-1 — Army IT.
• —DoDI 8530.01 — Cybersecurity Activities Support to DoD Information Network Operations.
• —NIST SP 800-61 — Computer Security Incident Handling Guide (this is the IR playbook the Army quietly maps to).
• —ATP 6-02.71 — Army Information Network Operations; FM 6-02 — Signal Support to Operations.
• —DoDM 8140 — Cyberspace Workforce Qualification (the IAT/IAM chart you sign your soldiers off against).
• —CCNA, Linux+, AZ-104 / AWS SAA — the credentials that win the next slot board.

• —IAT Level III compliance (CCNP-Security, CASP+, or equivalent) tracked in ATAAPS / GTIMS.
• —ALC graduate; SLC packet built.
• —Section ticket SLA at or above 95%; IAVA closure at or above 95% inside the prescribed window.
• —NCOER bullets that match real measurable outcomes — patch compliance %, ticket throughput, training completion %, no "demonstrated outstanding performance" filler.
• —Section ACFT pass rate at or above brigade S6 average — the comm guys do not get to skip the test.

• —Letting a junior soldier act as IAT II/III when they are not certified. The DoDM 8140 audit catches it and the failure is on you.
• —Skipping the after-action on a tactical comms exercise because "it worked." Next rotation it will not, and you will have no record of what changed.
• —Bypassing the brigade S6 to talk to division G-6 directly. The CSM's door closes faster than you think.
• —Accepting a verbal change request from a senior officer without ticketing it. The change blows up at 0200 and there is no paper.
• —Loaning gear without a sub-hand receipt. Property accountability is the line the Army does not let any NCO cross twice.

The good SGT 25B runs a section the brigade CO names without thinking — uptime green, IAVA green, no surprises in the BUB, soldiers getting Sec+, CCNA, and the cyber-reclass packets if they want them. The S6 OIC fights for him on the slate; the contractor on rotation already has a phone call lined up for ETS day.

You are the senior signal NCO in your shop. The S6 captain runs the staff; you run the techs and the daily ground truth.

You manage a 10-15 soldier IT shop or a brigade-level tactical signal node. You write the brigade S6 input to the QTB. You sit on the brigade IA governance board. You build the next two squad-leader-equivalents (the section SGTs) into the SSG slate. You will brief brigade-level cyber posture to a one-star at least once. The contractor on rotation is now asking for your card.

• 01Run a brigade-level network architecture conversation — VLAN scheme, IP plan, redundancy, growth roadmap — without hiding behind the S6 OIC.
• 02Defend a cybersecurity finding at the brigade IG / cyber inspection (CCRI, CORA) — own the gap, present the closure plan, hit the milestone.
• 03Build a six-month training plan that produces a CCNP-grade NCO and two Sec+/CCNA-grade specialists.
• 04Operate as the senior tactical signal NCO on a CTC rotation — JRTC, NTC, JMRC — through the entire force-on-force without losing the network.
• 05Translate cyber risk to a non-technical CO/CSM in language they will repeat without rewording.
• 06Mentor your section sergeants on NCOER writing, board prep, and the cyber-reclass conversation honestly.

• —NIST SP 800-53 / 800-171 — the controls every Army cyber program inherits.
• —DoD CIO RMF — Risk Management Framework workflow (every ATO you support runs through it).
• —ATP 6-02.40 / FM 6-02 — Signal Support to Operations and Information Network Operations.
• —AR 25-2, AR 380-5 — Cybersecurity and Information Security (you own both at the unit level).
• —NIST SP 800-61 — Incident Handling; MITRE ATT&CK (start using the framework in your AARs, the brigade will catch up).
• —IT Service Management — ITIL 4 Managing Professional track; PMP path if you are command-track.

• —SLC graduate; MLC packet built; consider the Cyber Center of Excellence Cyber NCO Course (CCoE CNOC) for the differentiator.
• —CCNP-Security or CCNP-Enterprise; CISSP if you are tracking toward warrant officer or contractor space.
• —Section IAVA compliance over the last 4 quarters at or above 98%; zero CAT-1 unresolved past the window.
• —NCOER profile defensible at brigade — Top Block / Most Qualified rate matching the actual delta in soldiers selected.
• —ACFT 540+ minimum at this rank; brigade S6 senior NCO's fitness is in the brigade slide.

• —Confusing tactical-network expertise with garrison-enterprise expertise. The brigade S6 OIC needs you to be honest about which one you are.
• —Skipping the RMF / cATO conversation because "that is the GS-13's job." Your soldiers fail the next inspection if you do not own the bridge.
• —Treating the SHARP / EO / climate piece as someone else's problem. Senior signal NCOs lose careers over command-climate findings as fast as anyone.
• —Letting one section SGT carry the shop because he is "your guy." The other two SGTs notice; the NCOER profile shows it.
• —Bypassing the warrant officer track conversation if the talent is there. The 255A / 255N path is the highest-impact technical career in the Army.

The good SSG 25B runs the shop the BCT CO names in the slide as "S6 is solid." He turns out two CCNA / Sec+ NCOs per cycle, his cyber-inspection findings are closed before the brigade IG asks, and he has a 255A warrant packet on the table when the company senior signal officer asks if he is interested.

You are the senior signal NCO in a battalion or the SNCO on a brigade S6 staff. The captain and major above you brief; you make sure the slide is true.

You sit at battalion or brigade staff. You build the unit's cybersecurity readiness posture for the CCRI / CORA cycle. You write four-to-five NCOERs per period that will pick the next batch of SSGs and SFCs across the brigade. You mentor warrant officer candidates and run the brigade's cyber-reclass screening conversation. You walk the line during exercises and you are at the BCT-level cyber stand-up briefing every week.

• 01Defend a Command Cyber Readiness Inspection (CCRI / CORA) at the brigade level — months of preparation, zero CAT-1, defensible CAT-2/3.
• 02Own a brigade tactical / garrison hybrid network end-to-end — design, install, sustain, retire — with a 6-month roadmap.
• 03Mentor a warrant officer (255A/255N/255S) candidate through their packet and selection board.
• 04Operate as the senior signal NCO on a JTF / division staff or a forward-deployed brigade comm element.
• 05Build a unit-level cyber training program that produces certified IAT-II/III soldiers at a rate matching brigade demand.
• 06Run brigade-level incident response when the network is contested — alongside ARCYBER teams if it escalates.

• —DoDI 8500.01 — Cybersecurity; DoDI 8510.01 — RMF for DoD IT.
• —NIST SP 800-37 — Risk Management Framework; 800-53 — Controls; 800-171 — CUI in Nonfederal Systems.
• —ATP 6-02.40 / ATP 6-02.71 — Signal Support and Information Network Operations.
• —DoDM 8140 — Cyberspace Workforce Qualification (you are auditing the brigade against it).
• —CJCSI 6510.01F; FRAGOs and ALARACTs published by ARCYBER and CIO/G-6.
• —Cyber Center of Excellence Senior Leader publications; Signal magazine; SANS short courses for currency.

• —MLC graduate; consider the U.S. Army Sergeants Major Academy fellowship if SGM-track.
• —IAT Level III (CCNP-Security, CASP+, or CISSP) maintained, with CCE credentials where they apply.
• —Brigade-level CCRI / CORA inspection passed with no CAT-1 findings during your tenure as senior signal NCO.
• —Warrant officer packet pipeline producing at least one selected candidate per year.
• —ACFT pass at this rank; brigade senior staff fitness is on the slide and the BCT CO reads it.

• —Hiding a CAT-1 finding from the brigade S6 OIC to "fix it before the report." It will surface and the relief is at brigade level.
• —Letting your subordinate SSGs run the IAVA cycle without your sign-off. You sign the unit status; you own the failure.
• —Confusing operational comm expertise with cyber-defense expertise. The brigade needs both, and senior NCOs are increasingly expected to bridge.
• —Skipping the SHARP / EO / climate piece. Senior signal NCOs are not exempt from command-climate accountability — they are the example.
• —Talking the warrant officer track up to soldiers without warning them honestly that the 255A school selection rate runs sub-50% in some cohorts.

The good SFC 25B is the senior signal NCO the brigade S6 OIC and the BCT CO trust to walk into a contested-network exercise and come out with the COP up, the patches done, and the senior soldiers trained. He runs the warrant officer pipeline for the brigade; his NCOERs pick the next SSG-board slate; he is on the short list for First Sergeant of an HHC or a signal company before he sits MLC.

You are the senior enlisted technical voice on a battalion or brigade staff, or the 1SG of a signal company. The BN/BCT CO names you in the slide.

As 1SG you run a signal company or HHC — 90-130 soldiers, a complex equipment footprint, the orderly room, the supply room, and the readiness reporting. As SGM/CSM on a brigade or higher staff, you set the standard for the enlisted signal workforce — training, certifications, retention, reclass pipelines into 17C and warrant. You sit in the cyber-strategy conversation alongside O-5s and you advise on enlisted talent slate at echelons above brigade.

• 01Run a signal company / brigade signal cell command climate that produces certified IAT-II/III soldiers at a rate above the Army average.
• 02Mentor a warrant officer slate (255A/255N/255S/170A) at the brigade or higher staff level.
• 03Brief the BCT/Division CG on enlisted cyber readiness in language the CG can defend at the next higher echelon.
• 04Run a cyber-incident-response posture for an HHC / signal company during a real contested-network event.
• 05Translate the Army Cyberspace Force / 17-series strategy into enlisted-talent decisions at the unit.
• 06Walk the line during the brigade signal exercise and identify the broken systems before the OC/T does.

• —AR 600-20 — Army Command Policy; AR 27-10 — Military Justice (you are in the room).
• —DoDM 8140 — Cyberspace Workforce Qualification (you are accountable at the unit-roll-up level).
• —NIST SP 800-37, 800-53, 800-171 — the RMF triangle every accreditation rides on.
• —Army Cyber strategy / FRAGOs from ARCYBER, INSCOM, and CIO/G-6.
• —The 1SG Course / USASMA / SGM-Academy reading list — you are now expected to teach doctrine, not just consume it.
• —CCRI / CORA, CMMC (where applicable), and DoD CMRS dashboards — the readiness instruments the senior staff watches.

• —USASMA / SGM-A completion before competing for command CSM slate.
• —Brigade-level CCRI / CORA pass without senior-NCO-attributable CAT-1 findings during your tenure.
• —Warrant officer accession pipeline producing 1+ selected per year from your unit.
• —NCOER profile that the senior rater can defend at brigade and division — the rated NCOs you raised are getting selected.
• —Zero senior-NCO-level integrity, financial, fraternization, OPSEC incidents. One ends the career permanently.

• —Pretending to be the senior technical voice on a topic where you are out of date. Senior NCOs lose authority by faking depth.
• —Letting a 1SG-led company drift on cybersecurity readiness because "the S6 OIC will catch it." You own it.
• —Treating the warrant officer slate conversation as transactional. The 255A career is one of the most consequential in the Army; mentor it like it is.
• —Confusing seniority with cyber expertise. Hire / promote / mentor soldiers who are sharper than you and let them shine — that is the senior NCO's job at this rank.
• —Going public with disagreement over a CO's cyber-risk call. Take it in the office. Walk out aligned.

The good signal CSM / 1SG / SGM is the senior NCO the brigade and division CG name without thinking. His signal company is the one the BCT loans to other brigades during rotations. His enlisted talent slate is the one HRC quotes in policy memos. His warrant officer accession rate is in the upper third of the Army; his rated NCOs are picking up first sergeant chevrons on schedule.