Intelligence Analyst

You are the junior all-source analyst. You have a TS/SCI and zero credibility — your job for the next 18 months is to earn the second one so the first one is worth carrying.

You ran the Foundry / IFPC pipeline at Fort Huachuca and you got dropped into a BCT MICO or a brigade S2 shop where the analyst-of-record is a SSG who has been on three rotations. You read traffic, populate the running estimate, build pattern-of-life baselines on named areas of interest, and feed the BCT S2 sausage that turns into the commander's intel running estimate. You will spend a real percentage of your week doing the unglamorous part — SCIF cleanup, courier runs, classified destruction logs, ANOC / DCGS-A account paperwork, SIPR PKI tokens, and the standing morning brief slide that nobody told you was on you until 0530.

• 01Read SIGINT, IMINT, HUMINT, and OSINT product traffic on JWICS and SIPR and write it up as a one-paragraph BLUF the S2 can put on a slide.
• 02Build a basic pattern-of-life on a named area of interest — events plotted against time and geography, with confidence levels named honestly.
• 03Drive DCGS-A (Distributed Common Ground System-Army) at the analyst workstation level — query, plot, link diagram, product export — without breaking the database.
• 04Use the IPB process (ATP 2-01.3) to populate enemy templates and event templates that the S2 actually puts in the OPORD annex.
• 05Run a classified destruction line — SF 153 / DA 3964 cover sheets, two-person integrity, the burn-bag chain — without leaving a single page floating.
• 06Brief in 30 seconds: who, what, where, when, so-what, source confidence. The S2 captain stops you if you go longer.

• —FM 2-0 — Intelligence (the doctrine spine; read chapters 1-3 your first month).
• —ATP 2-01.3 — Intelligence Preparation of the Battlefield (every analyst at every echelon lives here).
• —ATP 2-19.4 — Brigade Combat Team Intelligence Techniques.
• —AR 380-5 — Department of the Army Information Security Program (you sign for material under this reg every day).
• —AR 381-12 — Threat Awareness and Reporting Program (TARP) — what you report, when, to whom.
• —AR 25-2 — Army Cybersecurity (every system you touch is governed by this).

• —IFPC (Intelligence Fundamentals Professional Certification) attempt window inside your first 18 months — the S2 NCOIC tracks it.
• —Foundry program seats taken on schedule — you are expected to consume the entry-level catalog (DCGS-A, IPB, briefing courses) before the unit picks for the next rotation.
• —ACFT 500+ floor; senior intel NCOs notice analysts who skate on PT — the SCIF gets a reputation fast.
• —SCI access maintained without a flag. One mishandling incident on a SAP or SCI document and you are walking out of the SCIF for the last time.
• —Annual SAEDA / TARP / cyber awareness / OPSEC training complete before the suspense — your name on the brigade non-compliance roll-up is the wrong way to be noticed.

• —Taking a cell phone into the SCIF. Even once. The Special Security Officer (SSO) will pull your access that afternoon and the investigation runs months.
• —Briefing a confidence level you do not actually hold. "The S2 says" is not analysis — the captain finds out, the SSG finds out, and you brief nothing of consequence for six months.
• —Sharing a SIPR or JWICS password. Even to your own NCO. Two-person integrity is two people with their own credentials.
• —Skipping the source citation on a graphic because "everyone knows where it came from." The IG and the SSO do not, and the inspection finding is on your name.
• —Treating destruction logs as a formality. A missing page on the SF 153 turns into a 15-6 investigation that costs the company a month.

The good cherry analyst is the PFC the SSG sends to read overnight traffic without thinking, because the BLUF on the morning slide is right and the slide is on the S2's desk at 0530. By month nine they have IFPC done, by month eighteen they are running a section of the COIST during a CTC rotation, and the warrant in the shop has started asking what they think about the 35F-to-35G / 350F path.

You are the workhorse analyst. The new privates copy how you build a product; the SSG drops the hard target on your desk and asks for it before lunch.

You own a piece of the BCT's intel problem — a named area of interest, a threat network, a country desk, a watch shift in the brigade COIST. You build link diagrams, pattern-of-life products, and target packets the S2 puts in front of the BN CDR. You train the newest PFC on DCGS-A and SCIF discipline. You are also the bench when the SSG NCOIC has to leave the shop — you run the watch, you cover the brief, you sign for the SCIF on weekends.

• 01Build a target packet that survives the BN S3 challenge — biographic, associative network, pattern-of-life, NAIs, recommended ISR collection, source confidence, gaps named.
• 02Operate DCGS-A at the section level — query federation, custom dashboards, link analysis, and the data-quality scrub the WO will catch you on if you skip it.
• 03Drive Analyst Notebook / Palantir / chat traffic across enclaves (JWICS, SIPR, NIPR) without cross-domain spillage — one spillage rolls up to Army CI.
• 04Run a Request for Information (RFI) cycle to a theater intel brigade or NSA detail — phrase it so the answer comes back actionable, not a one-line referral.
• 05Brief the BN S2 / S3 in five slides: situation, threat, COA assessment, gaps, recommended PIR adjustments — and defend each line under questioning.
• 06Apply the analytic standards from ICD 203 (Analytic Standards) — sourcing, confidence, alternative analysis — so your product survives the next echelon up.

• —ATP 2-01.3 — Intelligence Preparation of the Battlefield (own it, do not just refer to it).
• —ATP 2-19.4 — Brigade Combat Team Intelligence Techniques.
• —ATP 2-91.3 — Brigade Combat Team Intelligence Techniques (All-Source / fusion focus).
• —ICD 203 — Analytic Standards (the IC-level standard your products are graded against above brigade).
• —AR 380-5 — Information Security Program; AR 381-12 — TARP.
• —JP 2-0 — Joint Intelligence (when you start working with sister-service or theater partners).

• —IFPC complete and on the wall; consider the Foundry advanced catalog (targeting, analytic writing, source evaluation) before the E-5 board.
• —BLC graduate; promotion points stacked through Foundry seats, ACFT, college credit, and credentials (CompTIA Sec+ is increasingly common in the intel community).
• —ACFT 540+ floor; SFC NCOICs notice the SPC who passes the test and brings the same intensity to the SCIF.
• —Section RFI satisfaction rate tracked — your products come back from BN/BCT with the gaps closed, not "needs more work."
• —Source-citation discipline 100%. The SSO inspects on this; ICD 203 grades on this; the next echelon up reads it.

• —Plagiarizing a higher-echelon product into your slide without source citation. The WO catches it, the captain catches it, and the credibility never comes back.
• —Pushing a confidence level the data does not support because the CO wants it. "Likely" becomes "assessed with high confidence" and the BN runs an operation it should not have.
• —Skipping the alternative-analysis line in a target packet because "this one is obvious." The S3 will ask. The S2 OIC will ask in front of the BN CDR.
• —Letting a junior analyst run on a SCIF terminal as you. Account sharing is logged, and the audit at the next quarterly inspection finds it.
• —Taking SCI-derived analysis to the unclassified or SIPR side without the proper sanitization / tear-line. One spillage is a CI investigation.

The good Specialist 35F is the analyst the section sergeant assigns the hardest target packet on Monday because it will come back clean by Wednesday, sourced, and ready for the BN CDR. He has IFPC on the wall, a Foundry advanced course in his folder, a Sec+ voucher in motion, and the warrant has started the 350F technician packet conversation with him.

You are an NCO now and an analyst with a vote in the SCIF. The privates do their counselings off your statements; the SSG NCOIC briefs the BN CDR off products you signed for.

You own a 3-5 soldier analyst section — a watch shift, a country desk, an all-source fusion cell, or a BCT COIST cell. You counsel your soldiers on the 14th and after every product cycle. You write the section's input to the daily INTSUM. You sit at the S2 huddle, you defend the section's confidence levels under BN-CDR questioning, and you are the senior analyst on watch when the SSG is at sick call or in SLC. You will also still be at the terminal pulling traffic — the moment you stop reading is the moment you start lying.

• 01Run a watch as the senior analyst — INTSUM build, threat warning push, RFI triage, escalation chain to the WO and S2 OIC inside published timelines.
• 02Lead a target-development cycle from PIR / EEI through nomination — IPB-aligned, joint-targeting-cycle-compatible (JP 3-60), audit-defensible.
• 03Write the DA 4856 counseling that documents both the technical mistake and the development plan — Plan of Action specific and measurable, not "soldier will improve analytic writing."
• 04Mentor a SPC through their first independent target packet — including the "I am not signing this until you fix the sourcing" conversation.
• 05Run a section RFI dialogue with a theater intel brigade, NSA detail, or DIA element — know who answers what, and when not to go around the brigade S2.
• 06Operate DCGS-A and the federated tools (Palantir, Analyst Notebook, ArcGIS) well enough to teach the section, not just use them.

• —FM 2-0 — Intelligence (own it cover-to-cover at this rank).
• —ATP 2-01.3 — IPB; ATP 2-19.4 — BCT Intelligence Techniques.
• —ATP 2-91.3 — All-Source Intel Techniques; ATP 2-22.2-series — Counterintelligence (you coordinate with CI now).
• —ICD 203 — Analytic Standards; ICD 206 — Sourcing Requirements for Disseminated Analytic Products.
• —JP 2-0 — Joint Intelligence; JP 3-60 — Joint Targeting (when you nominate, this is the playbook).
• —AR 380-5 — Information Security Program; AR 381-12 — TARP; AR 25-2 — Cybersecurity.

• —BLC graduate; ALC slot built and ready when the schedule drops.
• —IFPC complete; Foundry mid-career catalog seats taken (targeting, intel writing, analytic structured techniques).
• —ACFT 560+ as a floor — your soldiers do not respect a NCO who skates on the test they are graded on.
• —Section product quality measurable — RFI rework rate, INTSUM accuracy, target-packet sign-off cycle — and trending the right way under your tenure.
• —Promotion-points stacked: Foundry seats, weapons quals, college (CLEP/DSST/TA), credentials, correspondence (DLC).

• —Briefing a confidence the soldier under you held that you did not personally check. You signed the product; you own it at the BUB.
• —Counseling verbally. If the SPC's sourcing-discipline slip is not in writing, the senior rater cannot defend you and the SSG cannot help you.
• —Letting an RFI rot. Every RFI not closed inside the timeline is a senior commander somewhere making a decision without your input.
• —Skipping the CI / SAEDA reporting line on an indicator of a soldier issue (foreign contact, financial distress, unreported travel). AR 381-12 is not optional; the SSO will find out from someone else.
• —Treating SCIF physical security as the SSO's job. Door propped, badge on the wrong side, classified discussion in the hallway — your name comes up in the next inspection out-brief.

The good SGT 35F is the analyst the S2 OIC trusts with the BN CDR's brief on a Saturday. His section's target packets get nominated up; his soldiers pass IFPC the first time; his SPCs are on the SGT-board slate when their time comes. The WO has him on the short list for the 350F packet, and the brigade S2 SGM knows his name.

You are the section NCOIC — the senior all-source analyst on a BN/BCT S2 staff, a MI company collection cell, or a theater intel brigade analytic line. The captain runs the staff; you run the analysts and the ground truth.

You own a 6-12 soldier section or platoon-equivalent of analysts. You write the section's input to the QTB. You sign for the SCIF and the analytic systems within it. You build two SGTs into ALC-graduate, SLC-ready NCOs. You sit in the BCT S2 huddle and at the brigade targeting working group. You will brief brigade-level threat assessments to an O-6 at least once a quarter, and you will defend the analytic-confidence line to a colonel who wants a different answer.

• 01Run a BCT-level all-source fusion cell during a CTC rotation (NTC, JRTC, JMRC) — INTSUM, threat warning, target-cycle support, BUB inputs, RFI management, all without losing the products.
• 02Defend the section's analytic line to the BCT CDR or S3 under pressure — say "we do not assess that" when the room wants a different answer, and back it up.
• 03Build a six-month training plan that produces one IFPC-instructor-level NCO, two ICD-203-compliant analytic writers, and three certified DCGS-A operators.
• 04Run the Foundry program for the section — slot management, prerequisite tracking, post-course product follow-through. Foundry seats wasted are the SSG's on the next inspection.
• 05Mentor your SGTs on NCOER writing, board prep, and the 350F / 35-series technician conversation honestly.
• 06Translate analytic uncertainty into a recommendation the BCT CDR can act on without losing the uncertainty in translation.

• —FM 2-0 — Intelligence; ATP 2-19.4 — BCT Intelligence Techniques; ATP 2-91.3 — All-Source Intel.
• —ICD 203 — Analytic Standards; ICD 206 — Sourcing; ICD 208 — Maximizing the Utility of Analytic Products.
• —JP 2-0 — Joint Intelligence; JP 3-60 — Joint Targeting; JP 2-01 — Joint and National Intelligence Support to Military Operations.
• —AR 380-5 — Information Security; AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP.
• —ATP 2-22.2-series — Counterintelligence (you coordinate CI / OPSEC at the BCT now).
• —AR 623-3 — Evaluation Reporting; AR 600-8-19 — Enlisted Promotions (you write NCOERs that pick the next slate).

• —ALC graduate; SLC packet built; consider the Strategic Intelligence Course or a Foundry instructor-level seat as the differentiator.
• —IFPC plus advanced Foundry catalog complete; Sec+ / CISSP-Associate if the unit slots are funded.
• —Section IFPC pass rate at or above 90%; Foundry seat utilization at or above 95%; zero analytic-product retractions in your tenure.
• —NCOER bullets on the OFFICIAL achievement list — action-result-impact, measurable, no "demonstrated outstanding analytic performance" filler.
• —Section ACFT pass rate at or above brigade S2 average — the intel guys do not get to skip the test.

• —Letting a junior analyst push a product to the BN CDR without your sign-off. You signed for the section; you own every product that leaves the SCIF.
• —Writing an NCOER as a wish-list. Senior raters at brigade read every 35F NCOER and remember the SSG who inflated the SGT who could not write a target packet.
• —Confusing tactical-BCT analysis with strategic-IC analysis. The skills overlap; the standards do not. Be honest about which one your section is producing.
• —Bypassing the SSO on a physical-security or PERSEC finding. The SSO outranks you on SCIF compliance, and the report goes up the chain you cannot influence.
• —Letting the warrant officer / 350F conversation be transactional. The 350F technician career is one of the most consequential paths in the MOS — mentor it like it is.

The good SSG 35F runs a section the BCT S2 OIC names in the brigade slide as "S2 is solid." His SGTs are SLC-board ready. His section produces target packets that get nominated up to division and theater. His soldiers re-enlist or transition with credentials that the contractor sitting across the SCIF wants on the resume. He has a 350F packet on the table when the WO asks if he is interested in technician school.

You are the senior intel NCO in a Military Intelligence Company, the brigade S2 NCOIC, or a senior watch NCO on a theater intel brigade staff. The BCT S2 OIC briefs the BCT CDR off the readiness picture you produced.

You run the platoon's or staff's entire enlisted intel workforce — training, evaluations, schools, Foundry pipeline, IFPC pipeline, 350F mentorship, retention, discipline. You build the MICO commander or the S2 OIC into the next echelon. You write four-to-five NCOERs per cycle that pick the next SSG / SFC slate across the brigade's intel community. You walk the line during exercises — the BCT S3, the brigade SGM, and the WO senior technician all rely on your read of the analytic readiness. You will also still be the senior analytic voice on a hard problem the BCT CDR wants a second opinion on.

• 01Run a Military Intelligence Company analytic platoon through a CTC rotation and a real-world contingency mission, back-to-back, without losing the products or the soldiers.
• 02Build the brigade's enlisted intel training plan — Foundry slot allocation, IFPC scheduling, ALC/SLC sequencing, language-program coordination — and defend it at the brigade QTB.
• 03Mentor a 350F (All-Source Intelligence Technician) or 351-series counterintelligence-technician candidate through their packet and selection board.
• 04Operate as senior intel NCO on a JTF, INSCOM unit, theater intel brigade, or NSA / DIA detail — speak the language of the supported staff, not just the home one.
• 05Run a CCRI / IG-style intel inspection from the inside — physical security, ICD 503-aligned IT compliance, ICD 705 SCIF accreditation, AR 380-5 / 381-12 audits — and defend the findings.
• 06Run brigade-level threat warning during a contested event alongside a theater intel brigade or INSCOM detachment.

• —FM 2-0; ATP 2-19.4; ATP 2-91.3; ATP 2-22.2-series — the doctrine you teach now, not just consume.
• —ICD 203 / 206 / 208 — Analytic Standards, Sourcing, Utility.
• —ICD 503 — IC IT Systems Security Risk Management; ICD 705 — SCIF Accreditation (your physical-security and IT compliance plumbing).
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; AR 380-5 — Information Security.
• —JP 2-0; JP 3-60; JP 2-01 — the joint-side reading you brief from at echelons above brigade.
• —INSCOM, ARCYBER, and CIO/G-6 FRAGOs / ALARACTs; SMA-Academy / USA Intelligence School senior leader publications.

• —SLC graduate; MLC packet built — required for E-8 board competitiveness.
• —IFPC plus the Foundry senior catalog or Strategic Intelligence Course on the record brief — the visible differentiator.
• —Brigade IFPC pass rate at or above 90%; Foundry utilization at or above 95%; zero unresolved CAT-1 SCIF accreditation findings during your tenure.
• —350F / 351-series accession pipeline producing at least one selected candidate per year out of your platoon or section.
• —NCOER profile defensible at brigade and division — the rated NCOs you raised are getting selected on the next slate.

• —Letting one team or section drift because the SSG NCOIC is "your guy." The IG and the SSO find it first; the BCT CSM finds it second.
• —Briefing a confidence level you cannot defend at the next echelon up. Theater intel brigades and INSCOM staff read brigade products; they remember who wrote what.
• —Confusing tactical experience with strategic competence. The brigade needs both; senior NCOs who fake the second are exposed the first time they brief the J2.
• —Skipping the family-readiness piece because "the spouses run that." Intel-MOS deployment tempo and clearance-reinvestigation stress is real, and you sign the readiness report.
• —Going around the BCT S2 OIC to division G2. The CSM's door closes; the slate gets read out at the next CSM conference.

The good SFC 35F is the senior intel NCO the BCT CSM and BCT S2 OIC trust to run the brigade's analytic readiness through a CTC rotation and a real-world contingency without surprises. His 350F pipeline is producing accessions; his platoon's NCOERs pick the next SSG-board slate; his SGTs are on the SLC slot list. He is on the short list for First Sergeant of an MI company before he sits MLC.

You are the senior enlisted intel voice on a brigade, theater intel brigade, INSCOM unit, or higher staff — or the 1SG of an MI company. The BCT CDR or the INSCOM CG names you in the slide.

As 1SG you run an MI company — 90-130 analysts, linguists, CI specialists, signals soldiers, the SCIF footprint, the orderly room, the supply room, the security clearances, and the readiness reporting. As SGM/CSM on a brigade, theater intel brigade, INSCOM, NSA detail, DIA, or 902nd MI Group staff, you set the standard for the enlisted intel workforce at scale — training, certifications, retention, the 350F / 351-series accession pipeline, language-program governance, command climate inside a closed-access workforce. You sit in the intel-strategy conversation alongside O-5s and O-6s; you advise on enlisted talent slate at echelons above brigade.

• 01Run an MI company / brigade S2 / theater intel brigade enlisted readiness picture — Foundry, IFPC, IAT-II/III, language proficiency (DLPT), 350F accessions — and defend it at the BCT or INSCOM CG level.
• 02Mentor a 350F / 351-series / 35-series technician slate at the brigade or higher staff level.
• 03Brief the BCT, theater intel brigade, INSCOM, or division CG on enlisted intel readiness in language the CG can defend at the next higher echelon.
• 04Run a SCIF accreditation cycle (ICD 705) and an IC IT compliance cycle (ICD 503) end-to-end without senior-NCO-attributable CAT-1 findings.
• 05Translate the Army Intelligence Enterprise / INSCOM / theater strategy into enlisted-talent decisions at the unit — slots, schools, assignments, retention bonuses.
• 06Run a casualty notification or PERSEC / CI compromise response in a closed-access workforce with the dignity and discretion the population requires.

• —AR 600-20 — Command Policy; AR 27-10 — Military Justice (you are in the room).
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; AR 380-5 — Information Security; AR 25-2 — Cybersecurity.
• —ICD 503 — IC IT Risk Management; ICD 705 — SCIF Accreditation; ICD 203 / 206 / 208 — Analytic Standards (you teach these now).
• —JP 2-0 — Joint Intelligence; JP 2-01; INSCOM / ARCYBER / DIA / NSA-issued FRAGOs and ALARACTs.
• —The 1SG Course / USASMA / SGM-A reading list — you are now expected to teach doctrine and translate strategy down.
• —DoDM 8140 — Cyberspace Workforce (your IAT-II/III soldiers ride on it); DoD 5105.21-series — Sensitive Compartmented Information Administrative Security Manual.

• —USASMA / SGM-A completion before competing for command CSM slate.
• —Brigade or higher-staff SCIF accreditation passes without senior-NCO-attributable CAT-1 findings during your tenure.
• —350F / 351-series accession pipeline producing 1+ selected candidate per year from your unit.
• —NCOER profile that the senior rater can defend at brigade, division, and INSCOM-equivalent staff — your rated NCOs are picking up 1SG / SGM chevrons on schedule.
• —Zero senior-NCO-level integrity, financial, fraternization, OPSEC, or CI incidents. One ends the career permanently — and at this rank, in this MOS, also threatens the clearance of everyone you mentored.

• —Pretending to be the senior technical voice on a topic you are out of date on. Senior intel NCOs lose authority by faking depth — the WOs and the GS-13 analysts will catch you the first week.
• —Letting a 1SG-led company drift on SCIF accreditation or CI compliance because "the SSO will catch it." You own it; the SSO is your partner, not your replacement.
• —Treating the 350F / 351-series slate conversation as transactional. The technician path is the highest-leverage technical career in the MI community — mentor it like it is.
• —Going public with disagreement over a CO's analytic call or a J2's targeting decision. Take it in the office. Walk out aligned, or push back in writing through the right echelon.
• —Confusing seniority with current relevance. The intel field moves fast — the soldier briefing today's threat is closer to the truth than the CSM who has not read raw traffic in three years.

The good intel CSM / 1SG / SGM is the senior NCO the brigade, theater intel brigade, INSCOM, or division CG names without thinking. His MI company is the one the BCT pulls forward for the contested rotation. His 350F accession rate is in the upper third of the MI community; his rated NCOs are picking up first sergeant chevrons on schedule. He is the enlisted voice in the room when the J2 and the BCT CDR disagree on what the threat is doing, and the conversation ends with the analytic line intact.