Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 35L Counter Intelligence Agent — overview, pay, training, civilian translation, reviews
35LE6

Counter Intelligence Agent

E-6 (Staff Sergeant) · Army

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

You are the team chief. Every operation the team runs starts with your authority and ends with your name on the case file. The junior agents copy your tradecraft — your legal precision, your source handling discipline, your report quality — whether you intend for them to or not. The SSG who is sloppy on authority documentation once establishes the team's standard for the next two years.

The Honest MOS Read
Staff Sergeant is the load-bearing rank in the CI enlisted community. The SSG is the senior CI professional in the team room — the team chief who holds operational authority for initial and developmental contacts, runs the source validation cycle, briefs the G2 or CDR on the team's operations, and manages 3-6 agents who are looking to the team chief for the standard. The captain runs the staff; you run the operations. Your operational authority at SSG is real and bounded in specific ways by DoD 5240.1-R and AR 381-20. You approve initial contacts. You approve developmental contacts. You authorize preliminary investigations within your granted authority. For activities requiring higher authority — sensitive collection, specific categories of foreign liaison, extended operations — you prepare the mission package and submit for theater or INSCOM approval. The team chief who does not understand exactly where their authority ends is the team chief who creates the legal-authority gap that surfaces in the next INSCOM Inspector General visit. The case file is your responsibility entirely at this rank. Every contact report, every source validation record, every authority document, every debrief summary — your name is on the case. When INSCOM staff reviews your team's product, the quality of your documentation is what they are evaluating, not your agents' raw reporting ability. The SSG who has every case file audit-ready on day one of an inspection has built the right culture. The SSG who has to scramble to fill gaps has demonstrated what the team learned from him. The promotion path to E-7 SFC marks the structural transition from the semi-centralized point system to the fully centralized HRC board under AR 600-8-19. The board reads your full ERB/SRB packet — every NCOER written for you, every school, every Foundry qualification, every award, every flag, every Article 15 if any — and makes a single up-or-down promotion decision. There is no promotion-point cutoff to study to. The board reads paper. Your paper either earns it or it does not. The Senior Leader Course (SLC) is the E-7 STEP gate — without it you cannot pin SFC. For the 35-series MOS, SLC is the Intelligence Senior Leader Course run at the USAICoE NCO Academy at Fort Huachuca. Seats are nationally allocated and the pipeline compresses when multiple SSGs in the INSCOM enterprise are moving toward SFC simultaneously. Lock the slot 6-12 months before you need it through the brigade S3 and the section SFC. The 350L Warrant Officer program is the career arc conversation the SSG team chief should be having with every strong SGT in the section. The most capable CI track in the Army runs through the 350L pipeline. The SSG who denies that conversation to strong performers because the team needs bodies is making a talent management error the section pays for over the next decade.
Career Arc
  • 01Team chief authority granted — operational authority packages signed, source validation cycle owned, case files under full SSG accountability.
  • 02ALC complete; SLC packet submitted through brigade S3 and section SFC 6-12 months before SFC board eligibility.
  • 03First INSCOM quality review passed with zero case file flags — the inspection result the section SFC names in the endorsement.
  • 04Multi-agency liaison established or expanded — FBI field office, DCSA field activity, DIA element — purpose documented, deconfliction active.
  • 05NCOERs produced for 3-4 agents per cycle; at least one SGT per cycle identified as SFC-board material.
  • 06350L WO referral memo signed for at least one strong performer per 24-month cycle.
  • 07Advanced CI course or JCITA qualification added; polygraph-examiner pipeline considered if selected.
Common Screwups
  • ×Approving an operational phase without the legal-review document in the file before the authority signature — the missing legal review is the first thing the INSCOM IG cites when the case is pulled.
  • ×NCOER inflation — writing a bullet for a SGT that claims more than the classified record supports. The SFC board reads NCOERs across the INSCOM enterprise and the SSG who inflated a marginal performer is visible against the peer population.
  • ×Failing to deconflict operations with the supported unit's HUMINT collection manager (35M or J2X) — parallel source contact by two elements against the same target without coordination is a double-agent exposure vector and an INSCOM incident report.
  • ×Allowing the team's source validation cycle to lapse — unvalidated sources are non-compliant with ICD 304 standards and the theater J2X notices within one reporting cycle.
  • ×DUI or Article 15 at SSG — the clearance reinvestigation, the relief-for-cause potential, and the permanent record impact are career-ending in a community where the security file is read at every promotion.

A Day in the Life

  • 0530Unit PT — team chief runs the section's PT plan. Check on the SGT who flagged a family issue last week before the formation starts.
  • 0700SIPR review — INSCOM tasking messages, theater J2X traffic, CE flags referred by supported-unit security managers. Anything requiring team action today is on the operations board by 0730.
  • 0800Operations review with the team — what is on the calendar? Contacts scheduled? Source validation due? Authority packages to complete? Team chief's brief to G2 is Thursday; confirm all products are in pipeline.
  • 0900Authority package review and signature for the contact scheduled this afternoon — legal review document on page one, team chief briefed on the contact plan, SGT executing the contact prepared.
  • 1000CI liaison meeting — FBI field office monthly coordination, DCSA field activity debrief, or partner-nation CI element scheduled liaison. Purpose documented, scope bounded, SITREP to section SFC same afternoon.
  • 1200Lunch. Team room debrief with the SGT who ran the morning contact — what did the source report? What was the motive and access assessment? Contact report due by 1600.
  • 1300Case file audit — monthly review of all active cases. Authority documents current? Source validation dates tracked? Reports filed? Any gaps identified and corrective action assigned to the case agent.
  • 1500NCOER input review for the SGT whose evaluation is due this cycle. Classified bullets reviewed against the ISOO guidance. Impact quantified. Development plan present.
  • 1600G2 brief prep for Thursday — pull all operational status products, confirm classification levels, build the unclassified summary for the brief room.
  • 1700End-of-day security check and release. On-call by SIPR for time-sensitive operations.

Weekly Cadence

Monday through Wednesday is operations — contacts, validation interviews, liaison meetings, preliminary investigation timelines. The G2 brief on Thursday means all products need to be team-chief-reviewed and final-form by Wednesday afternoon. The team chief does not scramble to find the contact report that was supposed to be filed Tuesday; if the case file standard is right, the brief prep takes 30 minutes. Thursday is the brief and the source validation calendar review. The team chief runs the quarterly source validation status check on Thursday afternoon: how many validations due in the next 90 days? Any sources whose reporting pattern has changed in a way that warrants early validation? Polygraph referrals due? Friday is administrative — NCOERs, SLC coordination, Warrant Officer referral memos, BLC roster updates for the section's SPCs. The SSG who keeps the administrative pipeline moving on Fridays is the SSG who does not have the section SFC calling about overdue personnel actions on Monday.

Key Skills — How to Drill Each

  1. 01
    Brief the supported G2 or CDR on CI threat picture, current operations status, and liaison products — specific, unvarnished, calibrated to what the commander can act on.
    The brief structure is: current threat, ongoing operations status (without exposing operational details the room does not have access to), and recommended countermeasure or commander's decision. Rehearse with the section SFC or a senior agent before the first CDR brief. The commander does not need the source profile — they need the indicator, the confidence level, and the recommended action. The SSG who hedges every finding is the one the CDR stops trusting for actionable intel.
  2. 02
    Approve and sign CI operational authority packages at the team-chief level — with full legal review current before the signature.
    The legal review document goes in the case file before the authority signature, not after. Build the case-file checklist for your team's use and run it personally on every new operational phase. The check takes five minutes; the INSCOM IG finding that results from a missing legal review takes five months to close. When in doubt on authority boundaries, call the INSCOM legal advisor before approving, not after.
  3. 03
    Run a CI source validation interview of a long-established source — polygraph referral if appropriate, access verification, motive assessment — and write the recommendation to DIA / INSCOM standard.
    Validation interviews for long-established sources are the most legally sensitive contacts the team runs. The source knows your team's methods, your collection requirements, and in some cases your team's identity. The validation protocol is specific: document the access check, document the motive reassessment, document any anomalies in the source's reporting pattern, and make a clean close or continue recommendation. The validation recommendation that is vague because the SSG did not want to close a source they personally value is the one the theater J2X overturns.

Manuals & References — What Chapters Matter

  • FM 2-22.2 and ATP 2-22.2-1 / 2-22.2-2 — CI doctrine and techniques.
    At SSG you are writing the team's SOP from these documents. The authority framework, the contact protocols, the documentation standards in the SOP should cite the doctrine by chapter and paragraph. When a new SGT arrives from AIT and asks why the team does something a certain way, the answer should be in the SOP with the FM citation visible.
  • DoD 5240.1-R — Procedures Governing the Activities of DoD Intelligence Components.
    The legal authority document for everything the team does. At SSG team chief you are not just aware of the procedures — you are the one certifying to INSCOM that every operation is conducted within them. The sections governing source operations, preliminary investigations, and the boundaries between Army CI and federal law-enforcement authority are the ones you quote when a junior agent asks 'can we do that?'
  • ICD 304 — Human Intelligence, and applicable IC source validation standards.
    The source validation standard the theater J2X grades against is IC-community-wide. The Army's AR 381-20 framework and the IC's ICD 304 framework overlap but are not identical. The SSG who understands both can write validation recommendations that pass review at the Army level and the national level without reformatting. Read ICD 304 alongside the Army's source validation protocols before the first validation cycle.

Standards — How to Hit Each

  • ALC complete; SLC packet submitted well before SFC board eligibility.
    ALC was the SGT-to-SSG gate; SLC is the SSG-to-SFC gate. For 35-series, the Intelligence Senior Leader Course at USAICoE Fort Huachuca is the SLC track. Seats are nationally allocated and the pipeline fills from across the INSCOM enterprise. Work with the brigade S3 and the section SFC to lock the slot 6-12 months before you need it. The SSG who waits until the year of the SFC board to seek the SLC slot is the SSG who misses the first board cycle.
  • Zero case files with unresolved legal-authority gaps — team chief's name is on every file.
    Run a monthly case file audit: every active case has a current authority document on page one, every phase transition has a team-chief approval entry, every source contact has a filed report. Build this as a section standard and train the SGTs to run it on their own files. The SSG who finds gaps in a monthly audit and closes them is the SSG whose INSCOM quality review comes back clean.
  • Source validation cycle current for all active sources — no lapsed validations under team-chief authority.
    Build the validation calendar into the section's quarterly operations plan. Validations due in the next 90 days are flagged at the beginning of each quarter; interview scheduling, polygraph referral if appropriate, and recommendation writing are tracked against the calendar. The source validation that lapses because the team was operationally busy is the one the theater J2X notices and the one the INSCOM staff cites in the program review.

Technical Mistakes — Concrete Consequences

  • Approving an operational phase without personally reading the legal-authority section of the case file.
    When the DoD IG or the INSCOM security staff pulls the case, the first document they check is the authority. An authority signature with no supporting legal review means the team chief approved an operation without knowing whether it was legal. The legal-review document missing from a closed case file is a classified document control violation on top of the authority gap; both get cited in the same finding.
  • Failing to deconflict source operations with the supported unit's HUMINT collection manager before running a contact.
    Parallel contacts against the same target by Army CI and Army HUMINT without deconfliction through the J2X is one of the most common double-agent exposure vectors in joint environments. When the target surfaces the second contact to a foreign intelligence service, both operations are burned and the INSCOM investigation begins with 'who approved both contacts without coordination?' The answer points to two team chiefs who did not talk to each other.
  • Sharing operational details across unclassified channels in an operational emergency because the SIPR was down.
    Operational security on CI case files is absolute. The team chief who routes even a fragment of source identity, case detail, or operational plan through an unclassified channel in a genuine emergency has created a classified spillage on an operational case — both of which require incident reporting, case file suspension, and potentially source notification. The 'SIPR was down' explanation does not close the spillage report.

Career Decisions at This Rank

  • SLC timing and the SFC board preparation.
    SLC is the STEP gate for SFC — no SLC, no pin, no exceptions. For 35-series the Intelligence Senior Leader Course at USAICoE Fort Huachuca runs on a nationally-allocated seat schedule. The pipeline compresses when the year-group is large. Work with the brigade S3 and the section SFC to lock the slot 6-12 months before SFC board eligibility. The supplemental application through ATRRS requires a chain endorsement that the SSG who has been producing clean work for 18 months has no trouble getting.
  • Warrant Officer program — submit the 350L packet at SSG or wait for the SFC slate.
    Most 350L WO packets are submitted at senior SSG or junior SFC. The WORC board is competitive; the packet needs a clean operational record, strong NCOER endorsements from team chiefs and section SFCs who will stand behind the recommendation, and a demonstrated legal-authority discipline that the board can read in the case file history. If the operational record is clean and the team chief's endorsement is strong, submit at SSG. If there are gaps in the school stack or unresolved NCOER development bullets, build those out and submit at SFC. The 350L WO path is worth taking; the civilian CI career that begins at CW3-CW5 retirement is materially stronger than the one that begins at SSG retirement.
  • JCITA or advanced CI qualification — prioritize now vs defer to SFC.
    The Joint Counterintelligence Training Academy (JCITA) runs courses for CI professionals across the DoD community. Advanced CI agent training, CI collection management, and specialized CI techniques courses are available to SSG team chiefs with command endorsement. The SSG who has a JCITA credential alongside the SLC at the SFC board is materially differentiated. Seats require command endorsement and travel approval; work with the section SFC to identify the course, the window, and the budget line. Do not defer indefinitely — the JCITA availability narrows when the operational tempo is high.

How the Seat Varies by Unit Type

  • Brigade/division G2X CI section
    The SSG is the senior CI professional in the G2X, often the only team chief in the section. High visibility with the supported command. The mission set is broad — force protection, source operations, walk-in processing, threat briefing — and the SSG is the face of the CI program to the brigade CDR. Promotion is driven by what the G2 writes in the endorsement. The G2 who names you in the brief is the G2 who writes the endorsement that matters.
  • INSCOM field element / 902nd MI Group
    Multiple teams, senior warrant officers in the building, and an operational case load that is more sensitive and more complex than the BCT CI environment. The SSG team chief here is operating alongside CW3-CW5 350L warrants who set the enterprise standard. The learning is faster. The documentation bar is higher. The endorsement from an INSCOM senior warrant or field activity chief reads differently on the SFC board than the endorsement from a BCT G2.
  • Deployed CI team
    The SSG team chief on a deployed team is the decision authority for contacts and preliminary investigations without a JAG advisor physically present. The legal authority framework has to be internalized, not consulted. The team chief who calls the INSCOM legal advisor by SIPR before approving a sensitive activity in theater is doing the right thing; the one who improvises is the one who creates the case file problem that surfaces at the post-deployment review.
  • FBI/DIA/DCSA agency liaison
    SSG team chiefs detailed to inter-agency assignments work alongside federal GS-13/14 special agents and defense intelligence professionals. The tradecraft bar is civilian-IC standard. The operational exposure is materially different from Army-centric environments. The post-Army career pathway for an SSG who spends 18-24 months in this seat is unusually direct — DCSA GS-12 entry, FBI contract CI, or DIA senior enlisted equivalent are all realistic next steps.

What Good Looks Like at This Rank

The good SSG 35L is the team chief the G2 calls when the 15-6 investigation involves a potential foreign intelligence officer contact. Not because the SSG is the most available — because the case files the team has produced over the last 18 months are the cleanest in the G2X section and the G2 trusts the judgment behind them. Every authority document in the file. Every source validation current. Every contact report filed same day. No lapsed validations. No deconfliction gaps. The INSCOM quality review came back with zero findings. His SGTs are producing reports that the theater J2X uses as templates. His SPCs are on track for the SGT board. The 350L WO referral memo for the section's strongest SGT is signed and in the mail. His ALC is done, the SLC slot is locked, and the section SFC has told the battalion CSM that this team chief is worth watching for the SFC slate. The team runs independently on the days he is at the JCITA course because the team's SOP is the FM, the case file checklist is the standard, and the agents know what right looks like because they watched the SSG do it for two years.

Preview — The Next Rank

SFC 35L is the senior CI NCO at the section or platoon level — 2-4 teams, 10-25 agents, covering a theater geographic area or a full range of CI functions. The operational accountability does not shrink; it multiplies. The SFC approves team-level operational authorities that exceed SSG authority. The SFC writes NCOERs for 4-6 SSG team chiefs per cycle. The SFC runs the section's source validation cycle, training program, security program, and personnel pipeline. The structural difference at SFC is that the HRC fully centralized promotion board reads your packet without a point-score floor. Every NCOER ever written for you. Every school. Every flag. Every Article 15 if any. The board does not grade on a curve. The SFC who arrives at the board with a clean record, a strong SLC credential, a documented operational history, and endorsements from senior warrant officers who know their work is competitive. The one who arrives with inflated NCOERs, a lapsed SLC, and a sourced record built on another team chief's case files is not.
FAQ

35L E6 — Frequently Asked Questions

Q01What does a E6 35L (Counter Intelligence Agent) actually do?
You run a CI team of 3-6 agents conducting source operations, liaison operations, CI investigations, CI force protection, and support to HUMINT operations at a G2 CI section, an INSCOM battalion, a DCSA field activity, or a theater special operations CI element.
Q02What's the most important thing to know as a E6 35L?
You are the team chief.
Q03What does a typical day look like for a E6 35L?
Time-blocked day at the E6 35L rank tier: 0530 Unit PT — team chief runs the section's PT plan. Check on the SGT who flagged a family issue last week before the formation starts, 0700 SIPR review — INSCOM tasking messages, theater J2X traffic, CE flags referred by supported-unit security managers. Anything requiring team action today is on the operations board by 0730, 0800 Operations review with the team — what is on the calendar? Contacts scheduled? Source validation due? Authority packages to complete? Team chief's brief to G2 is Thursday; confirm all products are in pipeline,…
Q04What mistakes get E6 35L soldiers fired or relieved?
Approving an operational phase without the legal-review document in the file before the authority signature — the missing legal review is the first thing the INSCOM IG cites when the case is pulled; NCOER inflation — writing a bullet for a SGT that claims more than the classified record supports. The SFC board reads NCOERs across the INSCOM enterprise and the SSG who inflated a marginal performer is visible against the peer population;…
Q05What career decisions matter most at the E6 35L rank tier?
SLC timing and the SFC board preparation — SLC is the STEP gate for SFC — no SLC, no pin, no exceptions. For 35-series the Intelligence Senior Leader Course at USAICoE Fort Huachuca runs on a nationally-allocated seat schedule. The pipeline compresses when the year-group is large. Work with the brigade S3 and the section SFC to lock the slot 6-12 months before SFC board eligibility. The supplemental application through ATRRS requires a chain endorsement that the SSG who has been producing clean work for 18 months has no trouble getting;…
Q06What's next after E6 for a 35L (Counter Intelligence Agent) in the Army?
SFC 35L is the senior CI NCO at the section or platoon level — 2-4 teams, 10-25 agents, covering a theater geographic area or a full range of CI functions.
Q07What manuals and regulations does a E6 35L need to know cold?
FM 2-22.2 and ATP 2-22.2-1 / 2-22.2-2 — you write the team's SOP from these.; AR 381-20 — Army CI Program (your authority document; you brief the CDR on its limits).; DoD 5240.1-R — Procedures Governing DoD Intelligence Components (the legal framework for every operation the team runs).

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards