Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 25D Cyber Network Defender — overview, pay, training, civilian translation, reviews
25DE4

Cyber Network Defender

E-4 (Specialist/Corporal) · Army

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

Still not a 25D — and that is exactly where you are supposed to be. At Specialist you are deep in a feeder MOS doing the real defensive work and assembling the reclass packet: a clean Top Secret on track for TS/SCI, four years of documented IT/IA experience, the IAT-II cert, the next cert in progress, and eventually the In-Service Screening Test. The rank floor for 25D is senior — historically SSG, sometimes opening to senior SGT — so confirm the current HRC reclass MILPER and build backward from it. The door looks real now. It is not open yet.

The Honest MOS Read
You made E-4 Specialist (or got the Corporal lateral because your shop needed you in a leadership slot). Either way, the structural truth has not changed: there is no 25D at your rank, and you are not reclassing today. What HAS changed is that the reclass door has stopped being theoretical. You can see the requirements now, you can see your own gaps against them, and the next two-to-four years are when you close those gaps or watch the window pass. This entry is still the path-in — but it is the part of the path where the packet gets built for real. First, your job content shifts. As a Specialist in 25B, 17C, or another signal/intel feeder, you are no longer the ticket-closer — you are the defender. You run patch and STIG cycles, administer systems, triage incidents, read the SIEM, and write the incident report the S6 hands up the chain. This is where you stop pasting the senior analyst's saved search and start writing a Splunk SPL or Elastic KQL query that returns the right answer yourself. It is where you stop flagging a STIG finding and start defending it at a unit cyber inspection. The 25D reclass screen is looking for exactly this depth — a soldier who has actually done defensive information-assurance work, not a soldier who logged ticket volume. The strong SPC chases the contested host and the weird alert; the weak one waits to be told what to look at. Second, and this is the part most soldiers get wrong: build the verifiable record. Roughly four years of documented, supervised IT/IA experience is a hard 25D prerequisite, and the operative word is documented. If your defensive work lives only in your own head and your buddies' memories, the reclass screen treats it as if it never happened. Get your supervisor to capture it — in counselings, in your evaluation support form, in writing with a name attached. Keep your own dated log of what you assessed, what you found, what you fixed. The difference between a competitive packet and a rejected one is frequently not the work; it is whether the work is provable on paper. Third, climb the cert ladder past the floor. Security+ is the IAT-II baseline — maintain it without a lapse, because being the lapse on the unit's 8140 audit is the wrong kind of visible. But the baseline only gets you considered. CySA+ or CCNA on the wall before your E-5 board, plus a defensive specialty cert in progress (a GIAC like GCIH or GCIA, or a comparable credential appropriate to your shop), is what makes the eventual packet competitive. The defensive community also expects you to map activity to MITRE ATT&CK by technique ID and defend the call — learn the matrix, not just the buzzword, because 25D is expected to speak that language fluently. Fourth, the rank reality. 25D is a senior-NCO MOS. The floor has historically been SSG/E-6, with some windows opening to senior SGT/E-5 — but it moves, and the only honest answer is the current HRC reclass MILPER, not a rumor that 'it opened to E-5' or 'it is E-6 only.' Both of those float around the barracks; both are sometimes right and sometimes wrong. So at SPC you are not reclassing — you are stacking BLC, promotion points, and the NCO development that gets you to the rank where the door is actually open, in parallel with the technical packet. The soldier who is a brilliant analyst but rank-stalled never reaches the window. The contractor math starts becoming concrete at this rank, too. A TS/SCI-cleared soldier with real IA experience and a couple of certs is a six-figure civilian offer in the DC / NoVA / Maryland / Texas market, and the contractor sitting next to you on a rotation is the daily reminder. That pressure is real and legitimate — but it does not change today's job, which is to be the defender the S6 trusts and to build the packet so that when the rank-and-experience gate finally aligns, you walk through it instead of watching it close.
Career Arc
  • 01E-4 pin-on: automatic at 24 mo TIS / 6 mo TIG (both waivable) — still in a feeder MOS, not 25D.
  • 02Shift from ticket-closer to defender — run STIG and patch cycles, triage incidents, read the SIEM, write the report.
  • 03Get your IT/IA experience documented by a supervisor so the four-year requirement is provable, not verbal.
  • 04Maintain Security+ (IAT-II) without lapse; put CySA+ or CCNA on the wall before the E-5 board; start a defensive GIAC.
  • 05BLC graduate and promotion points stacked through cert credit, college, and the Distributed Leader Course — because the reclass needs senior-NCO rank.
  • 06Pull the current HRC 25D reclass MILPER with your career counselor and reverse-engineer the timeline: rank floor, experience, clearance, cert, ISST, 36-month SRR.
  • 07Plan to sit the 25D In-Service Screening Test (ISST) as the rank-and-experience window approaches — pass it before you need it.
Common Screwups
  • ×Letting your documented experience stay verbal. If your IT/IA time is not on paper with a supervisor's name, the reclass screen treats it as if it did not happen — and you cannot manufacture four retroactive years the month before you apply.
  • ×Sitting on Security+ and never reaching for CySA+ or a defensive GIAC. The baseline cert gets you considered; the next one gets you selected. A floor-only packet loses to a soldier who kept climbing.
  • ×DUI / Article 15 / financial mismanagement — any of these flags promotion and threatens the clearance under AR 380-67. A clearance problem does not just stall the reclass; it can end the lane permanently while the technical packet sits useless.
  • ×Believing a fixed barracks rumor about the rank floor. 'It opened to E-5' and 'it is E-6 only' both circulate — planning your whole timeline on the wrong one wastes years. Pull the current MILPER instead.
  • ×Burying yourself in the keyboard and neglecting the NCO track. 25D is a senior-NCO MOS; a technically brilliant SPC who never makes rank never reaches the reclass window, no matter how good the certs look.

A Day in the Life

  • 0500Wake. PT clothes on. Still a feeder-MOS soldier, so the day starts on the Army's clock, not a cyber-defender's. You are at formation five minutes early now because the junior soldiers in the shop see you set the standard.
  • 0530PT formation. Take accountability for the junior the section sergeant assigned you. A low ACFT flags a future 25D packet as fast as anyone's — the CSM reads cyber and signal pass rates off the same slide as the line units.
  • 0545-0700Unit PT. You are running the warm-up or a station for the section. The disciplined SPC also trains on his own after hours for the 540-plus that keeps him off every flag list.
  • 0700-0900Hygiene, breakfast, change. Cert study over coffee — CySA+ objectives, not scrolling. You are meal-prepping on Sunday because the gym time and the study time are both real now.
  • 0900First formation. You know the day's announcements before they are briefed because you read the training calendar. Phone stays away.
  • 0915-1200Defensive work call in the S6 / network shop. You are running STIG and patch cycles, triaging an incident through the NIST 800-61 phases, writing a SIEM query yourself, and drafting the incident report the section chief hands up. This is the experience that builds the packet — and you make sure your supervisor sees and documents it.
  • 1200-1300Chow. Conversation is certs, the reclass MILPER, the contractor a buddy just left for, and who passed CySA+. You are in those conversations because the people in them are the ones building careers.
  • 1300-1530Afternoon work call. More defensive tasks plus packet maintenance — confirm your experience is being logged, review your promotion-point worksheet, prep for the next inspection. Mandatory training (cyber-awareness, OPSEC, SHARP) gets stacked here too; sign the roster and get back to the keyboard.
  • 1530-1630Final formation. You brief the junior soldiers on the next day. Sensitive items and government devices accounted for — clearance-holder accountability discipline is the habit you are reinforcing.
  • 1630Released. Mostly. If you took the Corporal lateral you may stay to write a counseling; if you own a defensive task you may stay to close out the day's documentation.
  • 1700-2000Personal time and the real differentiator. Gym for the ACFT, home lab for the skills the Army does not schedule, and cert study — CySA+ now, GIAC next. The disciplined SPC trains here; the average one drifts and wonders why his packet looks thin in three years.
  • 2000-2200Cert study, college coursework for promotion points, or family time. You are building the reclass file one ordinary evening at a time, and you know it.
  • 2200Lights out. Tomorrow is the same grind that compounds into a 25D packet.
  • Field / exerciseWhen the unit goes to the field or runs a network exercise, you are standing up and defending the tactical network as the senior junior soldier in the shop — patching, monitoring, watching the logs that actually matter. It is the most 25D-flavored work you do at this rank and the most worth getting documented.

Weekly Cadence

The Mon-Fri rhythm at SPC is the feeder-MOS schedule, but your role inside it has changed. Monday is heavy — PT, the week's announcements, the tickets and incidents that piled up over the weekend, and any mandatory training the company front-loaded. Tuesday through Thursday are the defensive work days: STIG and patch cycles, incident triage, SIEM analysis, and the assessments and reports that feed the S6's posture. The career-defining move at this rank is to volunteer for the contested host and the weird alert — the work that builds real information-assurance depth — instead of the easy tickets, because that is the experience the reclass screen wants and the read the chain forms of you. Friday is usually the company-level event and release. But the weekly cadence that actually determines whether you reach 25D is the one off the training schedule: the after-1700 cert study, the home-lab reps, and the steady promotion-point grind. CySA+ this quarter, a GIAC opened, a few college credits banked, the Distributed Leader Course knocked out, BLC behind you, the worksheet updated. None of it is dramatic in any single week; all of it compounds toward the SSG rank window — the historical 25D floor — with a packet already built. The other rhythm running underneath everything is documentation and the packet itself. Quarterly, your supervisor should be capturing your defensive work in counselings and evaluation support forms; you should be saving inspection results and incident reports; and you should be re-pulling the current reclass MILPER to confirm nothing in the rank-floor, experience, cert, ISST, or 36-month-SRR requirements has shifted. The SPC who treats his own experience log and cert calendar like a project he manages — not something that happens to him — is the SPC who hits the reclass window with the file already assembled and the screening test already passed.

Key Skills — How to Drill Each

  1. 01
    Run a real defensive workflow end to end — detect an anomaly in the SIEM, triage the host, contain, document — to the NIST SP 800-61 incident-handling phases, in writing.
    Stop waiting for the senior analyst to assign you a host. When an alert fires, work it through the four phases — preparation, detection and analysis, containment/eradication/recovery, post-incident — and write it up as if ARCYBER will read it. Ask your shop's senior defender to red-pen your first few write-ups. The SPC who produces a clean, phased incident report is the one the S6 starts handing the real incidents to.
  2. 02
    Administer and harden systems to the DISA STIG at the configuration level, and defend a finding at a unit cyber inspection rather than just flag it.
    Learn the control behind every setting, not just the setting. When an inspector asks why a finding is open or how you closed it, you want to answer with the requirement and the technical rationale, not a shrug. Volunteer to walk the STIG checklist before the inspection so you are the one who knows the system's posture cold — that is the soldier the section chief leans on.
  3. 03
    Write a SIEM query — Splunk SPL or Elastic KQL — that returns the right answer yourself, instead of pasting the senior analyst's saved search.
    Take the saved searches apart clause by clause until you understand each one, then rebuild them and write new ones for questions nobody has saved a search for yet. Keep a personal library of queries that worked. The transition from running other people's searches to writing your own is the exact moment you become a 25D-grade analyst instead of a feeder-MOS operator.
  4. 04
    Map an observed behavior to a MITRE ATT&CK technique by ID and defend the mapping — the defensive community speaks this language and 25D is expected to use it fluently.
    Pick real alerts from your shop and force yourself to name the tactic and technique ID, then justify it against the ATT&CK matrix. Get a senior analyst to challenge your mappings. The point is not to memorize the matrix — it is to think in it, so that when you brief a finding it lands in the language the OIC and the warrant already use.
  5. 05
    Build the verifiable record — get your IT/IA experience documented by your supervisor so the four-year requirement is provable when you apply, not a he-said claim.
    Treat documentation as a deliverable, not an afterthought. Ask for your defensive accomplishments to be written into counselings and evaluation support forms, keep your own dated log, and save the inspection results and incident reports your work fed. When the reclass packet comes due, you assemble it from a paper trail you have been building for years instead of scrambling to reconstruct memories.
  6. 06
    Climb the cert ladder past the floor — CySA+ and a defensive specialty cert appropriate to your shop are the credentials that make a 25D packet competitive.
    Maintain Security+ for IAT-II, then schedule CySA+ before your E-5 board and open a GIAC (GCIH or GCIA are common defensive entries) after. Use Army Credentialing Assistance for the vouchers. Study to the published objectives in steady reps, not crams. The competitive packet shows a ladder climbed deliberately over years, not a cert panic in the final months.

Manuals & References — What Chapters Matter

  • AR 25-2 — Army Cybersecurity.
    Own it now; it is the policy floor your future defensive posture is graded on. At SPC you are administering systems against the requirements this reg drives, so reading it turns 'do the STIG' into understanding why the STIG exists and what 'secure' officially means to the Army.
  • NIST SP 800-61 — Computer Security Incident Handling Guide.
    The incident-response playbook your defensive work maps to. The four-phase model is the spine of every incident write-up; learn it so your reports are structured the way the senior analysts and ARCYBER staff expect, not freeform narratives that lose the timeline.
  • DoDM 8140 / the DoD 8570 framework — Cyberspace Workforce Qualification.
    Read your target 25D work role's tasks line by line — the IAT-II baseline is the gate, but the work role is the real standard. Knowing exactly which tasks define the billet you want lets you steer your current experience toward it instead of accumulating random hours.
  • NIST SP 800-53 — Security and Privacy Controls.
    The parent document under every Army cyber reg you administer against. You do not memorize it, but knowing the control families and how a STIG ties back to a control turns you from a checklist-runner into someone who understands the risk model behind the configuration.
  • MITRE ATT&CK.
    The framework the defensive community lives in. Learn the matrix — tactics and techniques by ID — well enough to map an observed behavior and defend it. This is the shared language of every read-out and finding at the rank you are climbing toward; start using it now.
  • The current HRC 25D reclass MILPER message + your career counselor.
    Confirm the rank floor, experience years, clearance level, IAT-II cert, the In-Service Screening Test, and the 36-month service-remaining requirement for THIS window before you plan around them. The prerequisites move; the live message is the only source that is right today.

Standards — How to Hit Each

  • IAT Level II maintained without lapse (Security+ CE or equivalent) — the 25D baseline.
    Track your continuing-education credits and renewal date so the cert never lapses, and do not be the name that turns the unit's 8140 audit red. Maintaining the floor cleanly is table stakes; the real work is the next cert up, but a lapse on the baseline reads as a soldier who cannot manage his own qualifications.
  • CySA+ or CCNA on the wall before your E-5 board, with a defensive specialty cert (a GIAC like GCIH/GCIA, or comparable) in progress.
    Schedule CySA+ deliberately — Credentialing Assistance voucher, a test date 8-12 weeks out, study to the objectives. Open the GIAC after. These are the certs that move a packet from 'meets the floor' to 'competitive,' and having them before the E-5 board signals you are building the 25D file years ahead of the gate.
  • Roughly four years of documented, supervised IT/IA experience accumulating and verifiable on paper.
    Make the experience real (chase IA depth, not ticket volume) and make it provable (supervisor-attested counselings, evaluation support forms, your own dated log). The 25D experience prerequisite is hard and someone has to attest to it — start the paper trail now so the four years are documented when the window opens, not reconstructed after.
  • Top Secret clean and eligible for TS/SCI — 25D requires the clearance to award AND to maintain.
    Keep finances clean, report foreign contacts and travel proactively, and live a quiet social-media life. Get ahead of every continuous-evaluation trigger. One incident and the lane is gone — so at SPC, with more pay and more life choices than you had as a private, the discipline has to scale up, not relax.
  • BLC graduate; promotion points stacked through cert credit, college, and the Distributed Leader Course.
    You cannot reclass into a senior-NCO MOS without making senior NCO first, so run the leadership track alongside the technical one. Get the BLC slot, bank college credits and cert points, knock out DLC on schedule. The goal is to hit the SSG rank window — the historical 25D floor — with the packet already assembled.

Technical Mistakes — Concrete Consequences

  • Letting your documented experience stay verbal.
    If your IT/IA time is not on paper with a supervisor's name, the reclass screen treats it as if it did not happen — and you cannot manufacture four retroactive years the month before you apply. Soldiers with strong real experience get rejected on thin paperwork every cycle. Document as you go or the work does not count.
  • Sitting on Security+ and never reaching for CySA+ or a defensive GIAC.
    The baseline cert gets you considered; the next one gets you selected. A packet that stops at the IAT-II floor loses to a soldier who kept climbing, and you find out you lost after the window has already moved on — too late to fix it for that cycle.
  • Running an experimental or unauthorized tool on an operational network 'to learn.'
    That is an incident inquiry, possibly a security violation under AR 380-5, and a clearance flag — exactly the wrong thing on a 25D-bound record. The defensive community has zero tolerance for freelancing on live networks. Learn in a home lab; on the operational network you touch only what you are authorized to touch.
  • Marking a STIG finding 'compliant' or closing an incident without verifying the fix held.
    The next cyber inspection or assessment finds the open gap, and it traces back to your signature. You go from the SPC trusted with the contested host to the SPC whose work gets re-checked — and that read is the opposite of what a reclass packet needs from the chain of command.
  • OPSEC slips on social media — unit name, a 'defensive cyber' job title, deployment hints.
    The defensive community polices this, the SSO is watching, and it surfaces at your next clearance reinvestigation. What looks like harmless career-building flags you as someone who does not grasp the discipline 25D is built on — and the clearance is the whole MOS.

Career Decisions at This Rank

  • Take the Corporal lateral or stay Specialist on the technical track.
    If your shop needs a team leader before you finish the rank climb, the commander can laterally appoint you to Corporal — same pay, real NCO responsibility, an NCOER as a leader. For a 25D-bound soldier the lateral is usually worth taking: 25D is a senior-NCO MOS, so demonstrated leadership is not a distraction from the path, it is part of it. The honest counter is that a weak performance in the team-leader role hurts you. If you can carry the leadership and keep the technical packet moving, take it — it builds exactly the NCO record the reclass eventually requires.
  • How aggressively to push the cert ladder before the E-5 board.
    Security+ keeps you IAT-II, but the competitive 25D packet wants CySA+ and a defensive GIAC. The decision is tempo: do you front-load the certs now while the schedule allows, or pace them out? Front-loading wins for a 25D candidate — every cert on the wall before the E-5 board signals a deliberate multi-year build, and the contractor market values the same stack. Use Credentialing Assistance, set hard test dates, and treat the ladder as a project with deadlines, not a someday plan.
  • First re-enlistment — re-up toward 25D, reclass early to a sister MOS, or exit to the contractor market.
    Your first re-enlistment window opens inside this rank tier, and the cleared-IT contractor market is real six-figure money. The honest test: are you on the 25D path for the career or the credentials-and-exit? If it is the career, re-enlist with your eyes on the experience clock and the rank gate, and pull the current HRC SRB MILPER before signing — 25-series retention math moves. If it is the exit, the clearance and certs you are building are worth more outside than the bonus, but decide that now rather than re-enlisting and resenting it. Both answers are defensible; only the unexamined one is a trap.
  • Stay a defender (NCO track toward 25D) or consider the warrant officer route.
    The defensive cyber warrant paths — 170A (Cyber Operations Technician) and 255S (Information Protection Technician) — are technical-leadership tracks that some strong feeder-MOS soldiers pursue instead of, or after, the 25D reclass. The decision at SPC is mostly to keep both doors open: build the technical depth and the clearance, because they feed every path. If you find you want the deep-technical warrant lane more than the senior-NCO defender lane, the same packet work positions you for it. Talk to a 170A or 255S in your formation before committing either way.
  • Sit the 25D In-Service Screening Test (ISST) early or wait until the rank window is near.
    The ISST is a prerequisite gate on the reclass, and passing it is one of the items a complete packet needs. The case for sitting it as soon as you are eligible is simple: it is one more requirement converted from pending to done, and a passed ISST in the file is one less variable when the rank-and-experience window finally aligns. Confirm in the current MILPER when and how you can sit it, and treat it like the certs — pass it before you need it, not in a scramble at the window.

How the Seat Varies by Unit Type

  • Brigade / battalion S6 (line BCT signal shop)
    As a 25B SPC here you run the brigade's network and have to deliberately reach for the defensive depth — STIG assessments, incident response, SIEM work — because the easy path is endless ticket-closing. It is a fine 25D feeder if you chase the IA work and get it documented. The field rotations are also where you do the most defender-flavored work, standing up and defending the tactical network.
  • NETCOM / signal brigade / fixed enterprise network
    A garrison enterprise-network environment with larger systems, formal change management, and IA work that mirrors what 25D actually does. The experience here is highly documentable and maps cleanly to the reclass screen — an SPC who owns assessments and incident response in this footprint builds one of the strongest packets available.
  • INSCOM / 35-series intel formation (intel feeder route)
    If your primary duty is intelligence, the IT/IA experience 25D wants does not arrive automatically — you have to manufacture it by taking systems and information-assurance side tasks and getting them documented. The upside is you already live in the clearance and SCI discipline 25D requires, so the security half of the packet is second nature.
  • Cyber Protection Brigade / ARCYBER footprint (17C feeder)
    An SPC 17C adjacent to the Cyber Mission Force gets the best technical education in the Army — real defensive cyberspace operations under work-role qualification. The decision becomes whether to reclass to 25D at all or stay on the 17C career arc; either way, the defensive depth you build here is gold, and the contractor pressure is loudest in this environment.
  • Field / deployed tactical network
    Across any feeder MOS, the field is where an SPC gets closest to real 25D work — standing up, monitoring, and defending the tactical network under real OPTEMPO, with the logs genuinely mattering. The sleep is worse, but the experience is the most 25D-relevant of your rank, and the most worth getting your supervisor to capture for the packet.

What Good Looks Like at This Rank

The good Specialist on the 25D track is the defender the S6 hands the STIG failure and the weird SIEM alert, who returns an ATT&CK-mapped write-up by close of business and a documented fix the next morning. He stopped closing tickets and started owning incidents somewhere around the time he pinned E-4, and the section noticed. He writes his own queries instead of pasting saved searches. He can defend a STIG finding to an inspector with the control and the rationale, not a shrug. And he does not treat any of it as heroics — he treats it as the daily work of building a record, which is why every piece of it ends up documented by a supervisor with a name attached. What separates him from the merely competent SPC is the systems thinking around the packet and the rank. He has CySA+ on the wall, a GIAC in progress, a clean Top Secret with TS/SCI eligibility, and four years of supervisor-verified IA experience accruing on paper. He took the BLC slot early and stacks promotion points because he understands — unlike the peer who buries himself in the keyboard — that 25D is a senior-NCO MOS and the rank gate is as real as the experience gate. He has already sat down with his career counselor, pulled the current reclass MILPER, and reverse-engineered the timeline, so he knows precisely which requirements he has met and which he is still closing. The tell that he is doing it right is the sentence the career counselor or the senior 25D in the shop says, unprompted: 'Once you pin the rank, you are exactly who this MOS wants.' He is not waiting for the Army to make him a defender — he made himself one on the feeder side, and he is making damn sure the In-Service Screening Test is passed and the packet is assembled before the rank-and-experience window opens, so that when it does, he walks through it on the first eligible cycle instead of watching it close.

Preview — The Next Rank

The next rank is Sergeant — E-5 — and this is the first tier where wearing 25D becomes structurally possible, but only at the edges. The rank floor for the MOS has historically been SSG/E-6, with some windows opening to senior SGT/E-5 — so depending on what the current HRC reclass MILPER allows, an E-5 is either still inbound (building the last pieces of the packet) or, in an open window, the freshly reclassed Cyber Network Defender finding his footing on a defensive crew. Which one you are is entirely a function of the live message, not a fixed rule, so the SGT-to-be plans for both. If the window lets you reclass at SGT, you come through the Signal School at the Cyber Center of Excellence, Fort Eisenhower, after passing the In-Service Screening Test and clearing the prerequisites — the senior-NCO-track rank, a Top Secret with TS/SCI eligibility, the roughly four years of verified IT/IA experience, the IAT-II baseline cert, and a 36-month service-remaining commitment on award. Then you are a working defender for real: monitoring and defending Army networks, running SIEM/IDS/endpoint analysis, executing defensive cyberspace operations, assessing systems against the controls, and feeding the Risk Management Framework and AR 25-2 posture that keeps a network accreditable. If your unit is a Cyber Protection Team element, you learn the survey-secure-protect rhythm under a more senior defender. The part that surprises feeder-MOS soldiers: pinning SGT — or reclassing into 25D — does not let you stop being an NCO. You write counselings, you mentor the feeder-MOS soldiers who want your path (and you tell them the truth about the rank floor and the experience clock, because nobody told you cleanly either), and you carry the Army basics — fitness, professional development, the NCOER — that a deeply technical MOS does not exempt you from. The experience that got you in is your floor, not your ceiling; the senior analysts will hand you the contested host and expect a clean, ATT&CK-mapped, control-referenced finding back. The work between SPC and that moment is what decides whether you are ready for it.
FAQ

25D E4 — Frequently Asked Questions

Q01What does a E4 25D (Cyber Network Defender) actually do?
You are a Specialist in 25B, 17C, or another signal/intel MOS doing the work that 25D is actually made of — running patch and STIG cycles, administering systems, triaging incidents, reading the SIEM, and writing the incident report the S6 hands up.
Q02What's the most important thing to know as a E4 25D?
Still not a 25D — and that is exactly where you are supposed to be.
Q03What does a typical day look like for a E4 25D?
Time-blocked day at the E4 25D rank tier: 0500 Wake. PT clothes on. Still a feeder-MOS soldier, so the day starts on the Army's clock, not a cyber-defender's. You are at formation five minutes early now because the junior soldiers in the shop see you set the standard, 0530 PT formation. Take accountability for the junior the section sergeant assigned you. A low ACFT flags a future 25D packet as fast as anyone's — the CSM reads cyber and signal pass rates off the same slide as the line units, 0545-0700 Unit PT. You are running the warm-up or a station for the section.…
Q04What mistakes get E4 25D soldiers fired or relieved?
Letting your documented experience stay verbal. If your IT/IA time is not on paper with a supervisor's name, the reclass screen treats it as if it did not happen — and you cannot manufacture four retroactive years the month before you apply; Sitting on Security+ and never reaching for CySA+ or a defensive GIAC. The baseline cert gets you considered; the next one gets you selected. A floor-only packet loses to a soldier who kept climbing;…
Q05What career decisions matter most at the E4 25D rank tier?
Take the Corporal lateral or stay Specialist on the technical track — If your shop needs a team leader before you finish the rank climb, the commander can laterally appoint you to Corporal — same pay, real NCO responsibility, an NCOER as a leader. For a 25D-bound soldier the lateral is usually worth taking: 25D is a senior-NCO MOS, so demonstrated leadership is not a distraction from the path, it is part of it. The honest counter is that a weak performance in the team-leader role hurts you. If you can carry the leadership and keep the technical packet moving,…
Q06What's next after E4 for a 25D (Cyber Network Defender) in the Army?
The next rank is Sergeant — E-5 — and this is the first tier where wearing 25D becomes structurally possible, but only at the edges.
Q07What manuals and regulations does a E4 25D need to know cold?
AR 25-2 — Army Cybersecurity (own it now; it is the policy floor your future defensive posture is graded on).; NIST SP 800-61 — Computer Security Incident Handling Guide (the incident-response playbook defensive operations map to).; DoDM 8140 / DoD 8570 framework — read your target work-role tasks line by line; the IAT-II baseline is the 25D gate.

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards