Cyberspace Defense Operations Specialist

Staff Sergeant in the 1D7X1 community is the first true NCO tier — AFI 36-2618 (The Enlisted Force Structure) defines E-5 as the start of the NCO ranks, and the AF cyber career field treats SSgt as the working-NCO leader on the cyber operations floor. You're now writing EPRs on your SrAs, running an operator position or shift as the senior cyber operator on the watch, and being read by the senior NCOs (TSgts, MSgts, SMSgts) as the next-tier-up candidate. The 7-skill-level (Craftsman) upgrade per the AFSC's CFETP (Career Field Education and Training Plan) is the technical-credibility gate at SSgt. CFETP completion involves on-the-job training task signoffs, the AFSC's Career Development Course (CDC) volumes, the AFSC's Qualification Training Package (QTP), and the unit's certification process per AFI 36-2670 (Total Force Development). Without the 7-level, you're stuck as a working-NCO without the technical-authority signoff the cyber career field requires for senior operator and supervisor positions. With it, you're the certified Craftsman that the unit puts on the senior watch positions. The promotion math under AFI 36-2502 (Enlisted Promotion Management) and the WAPS (Weighted Airman Promotion System): SSgt → TSgt (E-6) runs through WAPS annually — PFE (Promotion Fitness Examination, general AF knowledge), SKT (Specialty Knowledge Test, AFSC-specific technical knowledge from the CDC material), time-in-grade points, time-in-service points, decoration points, and EPR points. The TSgt cutoff for 1D7X1 varies cycle to cycle and is published per the AFPC promotion cycle release; the cyber career field has historically had competitive cutoffs reflecting cyber demand and the AFSC's manning math. Mastery of the SKT is structurally important for cyber NCOs because the test reads technical depth directly. The CDC material for the 1D7X1 AFSC covers cyber defense doctrine, the DoD 8140 Cyberspace Workforce Framework work-role math, the AFSC's technical core (incident response, threat hunting, SIEM operations, forensic analysis, cyber defense network operations depending on shred). SSgts who phone the CDC material take a hit on WAPS that cascades into the TSgt cutoff math. The job content reality at SSgt 1D7X1: depending on shred and unit, you're the senior cyber operator on a CPT mission, the shift lead on a wing MDT's SIEM / threat hunting operations, the senior incident responder on an enterprise cyber defense team, or the senior forensic analyst on a digital forensics unit. The technical work product is the daily output and the senior NCOs read your technical depth as the implicit input on the EPR narrative. The supervisor work — writing EPRs on your SrAs, counseling, training, leading the shift — is the new layer on top. The AF COOL credential stacking opportunity for 1D7X1 SSgts is structurally the strongest in the AFSC. CompTIA CySA+, CompTIA PenTest+, the GIAC certs (GCIH — Certified Incident Handler, GCFA — Certified Forensic Analyst, GREM — Reverse Engineering Malware, GPEN — Penetration Tester, GMOB — Mobile Device Security Analyst, GCFE — Certified Forensic Examiner), CISSP — Certified Information Systems Security Professional (the senior cyber leadership credential, often the IAM Level 2/3 cert under DoD 8140), CCNA / CCNP for network-leaning shreds, the various SANS courses (funded via AF COOL or unit training budget for select airmen), and the vendor-specific certs (Splunk, CrowdStrike, Palo Alto, the various SIEM and SOAR platforms). AF COOL is the named funding source per the AF COOL credential catalog (verify current funded credentials at afvec.us.af.mil / af-cool program portal); the unit's training budget supplements for high-cost SANS courses. The Active Special Reserve (ASR) and Career Crossroad Review (CCR) pathways become relevant at SSgt. ASR is the formal cyber-specific retention / career-management tool for cyber career fields per AFPC messaging — verify current ASR opportunities and the CCR-aligned retention math against current AFPC cyber career-field guidance. The cyber career field's senior leadership has invested in retention tooling at the SSgt / TSgt tier because the post-service market is structurally aggressive. The deployment / operational tempo: CPT and hunt-forward operators at SSgt see continued operational deployment as senior operators or shift leads; wing MDT and enterprise NOSC SSgts see standard AF deployment vulnerability cycles. The deployment profile at SSgt for cyber career field operators is materially distinct from the equivalent rank tiers in the larger services' cyber communities — the AF's cyber operational model is mission-team-deployable. The post-service market for cleared 1D7X1 SSgts with the right cert stack: defense contracting (Booz Allen, Leidos, ManTech, SAIC, Raytheon's cyber, Lockheed Martin's cyber, and the long tail of cyber-defense contractors), federal civil service (CYBERCOM civilian positions at GS-12 to GS-13 entry, NSA civilian positions, CISA, DHS cyber), and private-sector cyber (cleared cyber positions in defense industry, financial services cyber, healthcare cyber, big tech security teams). Senior cleared cyber positions for veterans with the right cert stack, shred experience, and TS/SCI clearance range from $130K-$200K+ depending on metro, role, and clearance polygraph.