Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 35L Counter Intelligence Agent — overview, pay, training, civilian translation, reviews
35LE7

Counter Intelligence Agent

E-7 (Sergeant First Class) · Army

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

You are the senior CI NCO in the section. The SSG team chiefs ask you how to handle the operation that just went sideways at 0200, and the answer you give is what the team does. That is not metaphor — it is the actual call. Be certain of the legal framework before you pick up the SIPR.

The Honest MOS Read
Sergeant First Class is the rank where the individual case file gives way to the program. You are no longer running a single team — you are running the CI section or CI platoon of a G2X, an INSCOM battalion, or a theater CI element. Two to four teams. Ten to twenty-five agents. Multiple geographic areas or mission sets covered simultaneously. The SSG team chiefs report to you; you are the person they call when the operation is too sensitive for the team chief to handle alone, when the source is showing signs that warrant escalation, and when the preliminary investigation has produced evidence that needs to go to the CID or the FBI. Your operational authority at SFC includes endorsing senior-level CI operational requests from team chiefs — developmental-phase contacts, preliminary investigations above the SSG approval threshold, sensitive liaison activities that require more than team-chief authority. You review the legal-authority package before you endorse, not after. The SFC who rubber-stamps a team chief's package without reading the legal section is the SFC whose endorsement is invalid when the INSCOM IG pulls the file. The personnel load is real and consistent. Four to six NCOERs per cycle for SSG team chiefs whose careers depend on what you write. Monthly counselings. Leave management. Clearance reinvestigation tracking — the section with three SSGs whose SF-86 CEs are simultaneously in adjudication is a section with an operational gap problem, and the SFC who did not track the CE timelines created it. The Warrant Officer referral conversation runs quarterly with the strongest performers; the SFC who stops having that conversation because the section needs bodies is the SFC making a talent management error the Army pays for downstream. The fully centralized HRC promotion board for E-8 (1SG/MSG) reads your packet in its entirety — every NCOER written for you at every rank, every school, every documented operational achievement, every flag. The Master Leader Course (MLC) is the E-8 STEP gate; without it you cannot pin MSG. For senior NCOs in the MI/CI community the MLC is run through Sergeant Major of the Army's NCOES pipeline and seats are competitively allocated. Get the packet in motion through the brigade S3 and the battalion SGM well before the MSG board opens. The section's operational tempo is not an acceptable reason to miss the MLC window; if anything, it is the reason to be more deliberate about scheduling it early. The 1SG path versus the SGM/staff path is the career conversation that begins seriously at SFC. The 1SG track puts you in a company-level command team managing a mixed-MOS population and contributing to unit readiness beyond the CI mission. The SGM/staff track keeps you in the intelligence community as a senior advisor. Both are legitimate; both require deliberate cultivation of the right endorsements and assignment history. The SFC who has not had an honest conversation with the battalion CSM or section SGM about which track is right for them is the SFC who will be assigned to whichever one has an opening.
Career Arc
  • 01CI section or platoon assumed — 2-4 teams, multi-mission coverage, SFC as the approving authority for senior-level operational endorsements.
  • 02MLC packet submitted through brigade S3 and battalion SGM well before MSG board eligibility.
  • 03First HRC E-8 board preparation — every NCOER, every school, every flag reviewed and addressed 18 months out.
  • 04Warrant Officer referral memos for at least one strong SSG per 24-month cycle; 350L pipeline feeding the CI enterprise.
  • 05JCITA advanced course or joint school assignment completed; cross-community CI coordination at the SFC level with FBI, DCSA, DIA.
  • 061SG vs SGM/staff path conversation with the battalion CSM or section SGM — deliberate, honest, early.
  • 07Post-Army bridge building begins at 36 months out: federal civilian CI pipeline, DCSA GS-13 hiring timeline, TS/SCI reinvestigation currency maintained.
Common Screwups
  • ×Endorsing a team chief's operational request without personally reading the legal-authority section — the SFC who defers the review to the SSG team chief is the SFC whose endorsement is invalid when the DoD IG arrives and asks who read the file.
  • ×Letting two teams run parallel contacts against the same target without documented J2X deconfliction — the double-agent exposure vector that surfaces at the INSCOM post-operation review names the SFC who approved both.
  • ×NCOER inflation at the SFC level for SSG team chiefs — the MSG/SGM board reads NCOERs across the INSCOM enterprise and the SFC whose team chiefs are uniformly rated 'Among the Best' when the operational record shows average performance is visible.
  • ×Stopping the 350L WO referral conversation for strong performers because the section cannot afford to lose the SSG — the talent pipeline for Army CI is a long-term force health issue and the SFC who blocks it is named in the INSCOM talent management review.
  • ×Letting the section training program drift because the operational tempo is high — CI tradecraft degrades faster than most MI skills and the SFC who stops training is the SFC whose team makes a legal-authority error in the next deployment.

A Day in the Life

  • 0530Unit PT — SFC runs the section's PT plan or runs with the platoon. Check in on the SSG who flagged a soldier welfare issue before the formation.
  • 0700SIPR review — INSCOM and theater J2X traffic, any CE flags for section personnel, operational tasking messages requiring SFC-level action today.
  • 0800Section operations review — all active operations status from the team chiefs, any endorsement requests requiring SFC review today, any source validation reports due this week. Legal-authority review of the one contact package submitted yesterday.
  • 0900Team chief one-on-one — monthly mentoring session with one of the four SSGs. Operational review, NCOER development, WO candidacy status, personal life check. Forty-five minutes, honest.
  • 1000G2 or BN CDR brief prep — review all team products for the weekly or bi-weekly program brief. Source validation status, operational activity, threat indicators, risk flag if one exists.
  • 1130INSCOM or theater J2X coordination call — program status update, any joint operational deconfliction required, CE flag coordination with supported unit security managers.
  • 1200Lunch. Section climate check — who is not eating with the team? Follow up.
  • 1300Program document quarterly update — operational status current, source validation calendar updated, training completion rates recorded, school pipeline status for all personnel.
  • 1500NCOER draft review for the SSG whose evaluation window closes next week. Senior rater narrative written by the SFC, not delegated to the team chief.
  • 1630MLC and post-Army administrative window — ATRRS packet coordination with battalion SGM, federal resume update if retirement is within 36 months.
  • 1700End-of-day security check and release. SIPR on-call for the team chiefs running active operations.

Weekly Cadence

Monday through Wednesday is operational — endorsement reviews, G2 brief prep, J2X coordination, source validation protocol execution when a validation is due. The SFC who runs the section's operations review first thing Monday morning is the SFC whose team chiefs do not make uncoordinated calls on Tuesday afternoon. Tuesday is typically the G2 brief day; the SFC's section products need to be in the brief prep package by Monday afternoon. Wednesday is often the INSCOM or theater coordination call window. Thursday and Friday shift to section development. Thursday is team chief one-on-ones, personnel pipeline review, and WO referral status. Friday is the legal-authority audit: every active case file in every team audit-ready, every source validation current, every CE flag addressed. The SFC who runs the Friday audit consistently is the SFC whose INSCOM inspection is not a surprise. The last Friday of the month is the program document update — operational status, training completion, source validation calendar — so Monday morning is always current.

Key Skills — How to Drill Each

  1. 01
    Run a multi-team CI program with synchronized mission packages, deconflicted collection, and reporting that contributes to the G2 PIR cycle.
    Build the section's operational calendar at the beginning of each quarter: contacts scheduled by team, source validation dates flagged, liaison meetings on the calendar, reporting timelines aligned to the G2 PIR update cycle. The SFC who runs the section from a whiteboard in the team room is the SFC whose teams deconflict on a SIPR message rather than in a coordination meeting. Hold the weekly operations review; run the deconfliction check before approving any team's new contact against a target already in the system.
  2. 02
    Brief the BN CDR or G2 on CI threat picture, ongoing operations status, and risk — including the honest call when an operation should be suspended.
    The CDR brief from the SFC is different from the brief the SSG team chief gives the G2. The SFC is the one who names the risk honestly — 'this source's reliability is declining and I recommend we begin the validation protocol now' — when the operations pressure is to keep the source running. The CDR who gets an honest risk assessment from the SFC may make a harder operational decision, but the one who gets a sanitized brief is making the harder decision without the information. Be the honest voice.
  3. 03
    Mentor 4-6 SSG team chiefs simultaneously — operational guidance, case file standards, legal discipline, and leadership under ambiguity.
    Monthly one-on-ones with every team chief: case file status, upcoming operational phases, team personnel issues, school pipeline, WO candidacy progress. The mentoring is not the counseling; the counseling is administrative. The mentoring is the 45-minute conversation where you tell the SSG what you actually see in the team's work and what the SFC board is going to read in their NCOER. That conversation, run honestly monthly, is how team chiefs get better.

Manuals & References — What Chapters Matter

  • FM 2-22.2 + ATP 2-22.2-1 / 2-22.2-2 — CI doctrine.
    At SFC you quote from memory. When a team chief calls at 0200 with a sensitive-activity question, the answer comes from the authority framework you carry — not from the SFC flipping through the manual. The SFC who cannot cite the applicable AR 381-20 and FM 2-22.2 authority boundaries from memory is the SFC who tells the team chief to wait while they look it up, and CI operations at 0200 do not always wait.
  • ICD 304 and applicable Intelligence Community Directives.
    Army CI operates in a joint and IC-community environment at the SFC level — INSCOM units, theater J2X, national agency partners. The IC-community source validation and reporting standards (ICD 304, ICD 203, ICD 206) bind the section's products at these levels. The SFC who knows only AR 381-20 is the SFC whose section's products get reformatted at the theater J2X before they go up. Learn the IC standards alongside the Army standards.
  • AR 623-3 + DA PAM 623-3 — Evaluation Reporting System.
    At SFC you write 4-6 NCOERs per cycle for SSG team chiefs whose SFC board competitiveness depends on what you produce. The AR 623-3 standard for senior raters is different from the standard for raters; the senior rater narrative carries the weight the promotion board reads most carefully. Know the difference between a well-written rater bullet and a well-written senior rater narrative; one supports the board, the other is what the board actually makes the decision on.

Standards — How to Hit Each

  • SLC graduate; MLC packet in motion; CW3-CW5 350L WO program recommended to the strongest SSG per cycle.
    SLC was the SSG-to-SFC gate; MLC is the SFC-to-MSG gate. The MLC packet goes through the brigade S3 and the battalion SGM — the coordination needs to start well before the MSG board opens. The 350L WO referral requires a written recommendation from the SFC with operational specifics that the WORC board reads. Do not produce a generic recommendation memo; describe the specific legal precision, source handling quality, and reporting standard that makes this SSG a strong WO candidate. The board can tell the difference.
  • Section CI program documented and briefable to the G2 or BN CDR at any time — operations active, reports produced, source validation current.
    The section program document is not a binder that lives on the shelf. It is updated quarterly: operations active with status, sources in the validation cycle with due dates, reports produced in the last 90 days with disposition, training completion rates, school pipeline status. If the G2 calls on a Tuesday afternoon and asks for the program status brief, the SFC should be able to walk in at 0800 Wednesday with a current brief, not a scramble.
  • NCOER profile producing at least one SFC selectee per 24-month cycle from the SSG team chief bench.
    The SFC who does not have a single SSG team chief selected for the SFC board in two years either has a weak bench or is not developing the bench. Both are the SFC's responsibility. Review the SSG team chiefs' operational records against the SFC board criteria annually — school stack, NCOER quality, operational depth, WO candidacy decision. The SSG who is not on track for the SFC board in two years needs a development plan this year, not next.

Technical Mistakes — Concrete Consequences

  • Approving a team operational request without reading the legal-authority section of the case file personally.
    At SFC the endorsement carries the legal authority weight the SSG's approval cannot provide. An SFC endorsement on an undocumented operation is an invalid authority at the next level up — it does not create legal authority, it creates the appearance of it. When the INSCOM IG pulls the case and finds a SFC endorsement with no supporting legal review, the explanation is not 'I trusted the team chief.' The explanation is 'I failed to perform the review I am authorized and required to perform.'
  • Stopping the WO referral conversation for strong performers because the section needs to keep them at team level.
    The Army's most capable CI practitioners run through the 350L warrant officer pipeline. An SFC who systematically blocks high-potential SSGs from the WO conversation to preserve team manning is identified in the INSCOM talent management review within one promotion cycle. The SSGs who were not referred eventually find a different SFC who will refer them — or they ETS to DCSA. Either way, the section that blocked the pipeline is the one that cannot find experienced team chiefs in three years.
  • Letting the section's training program drift during high-operational-tempo periods.
    CI tradecraft — legal authority precision, interview technique, source handling discipline — degrades faster than most MI technical skills when it is not practiced. The section that stops running training because operations are the priority is the section that produces a legal-authority error in the next deployment because the team chief who was mentored last year lost the precision they were building. The INSCOM incident report that follows names the SFC who stopped training.

Career Decisions at This Rank

  • 1SG track vs SGM/staff track — make the deliberate decision now.
    The 1SG track puts you in a company-level command team with a mixed-MOS population — a CI company at INSCOM, a MI company at a division, or a non-MI company if the branch makes the assignment. You are responsible for company readiness, unit climate, and all 150-200 soldiers regardless of MOS. The SGM/staff track keeps you in the intelligence community as a senior CI advisor — CI program management at the theater or national level, senior enlisted advisor to a G2 or J2, or INSCOM enterprise-level senior NCO. Neither track is inherently better; the right one depends on whether you are better at running an enterprise or building a culture. Talk to sitting 1SGs and SGMs in both tracks — not your chain, who will tell you what they think you want to hear — and make the decision deliberately with the battalion CSM.
  • MLC timing and the MSG board preparation.
    MLC is the STEP gate for MSG — without it you cannot pin. Seats are competitive and nationally allocated through the NCOES pipeline. The SFC who waits until the MSG board prep year to seek the MLC slot is the SFC who misses the first board. Coordinate with the battalion SGM to identify the window, submit through the brigade S3, and lock the slot at least 12 months before you need the credential. The MLC is also the most intensive professional military education most SFCs have attended; the learning is real and the time investment shows in the senior-rater narrative the battalion CSM writes for the MSG board.
  • Post-Army transition planning — federal civilian CI, defense contractor CI, or law enforcement.
    The most realistic post-Army paths for a senior 35L NCO: DCSA GS-13/14 special agent (the most direct pipeline — similar authorities, familiar environment, clearance translation straightforward); FBI counterintelligence (longer hiring timeline, more competitive, higher ceiling); DIA senior enlisted equivalent or GS-13 analytical position; defense contractor CI program manager or senior advisor. The federal hiring process is slow — DCSA GS-13 competition to selection can take 12-18 months from first application. Build the federal resume 36 months out, maintain TS/SCI reinvestigation currency, and make the contact network real before you need it.

How the Seat Varies by Unit Type

  • Brigade/division G2X CI section
    The SFC here is likely the senior CI NCO for the entire BCT or division G2X — a small section with high visibility to the BCT CDR and G2. Direct relationship with the supported command's senior officers. The mission set is tactical but the CI authority questions come up in real time with operational pressure. The SFC who runs a clean program at BCT level with zero legal-authority incidents has the G2 endorsement that matters for the SFC board and the MSG board.
  • INSCOM field element / 902nd MI Group
    The SFC here is one senior NCO in an enterprise with multiple SFCs and a robust CW3-CW5 warrant officer community. The peer population is strong and the standard is high. The operational cases are more sensitive and the multi-agency coordination is more complex. The senior warrant officers in the building are the most experienced CI practitioners in the Army; the SFC who learns from them is the one who builds the WO referral relationships that feed the enterprise.
  • Deployed CI team
    The SFC on a deployed element may be running 2-4 teams in a theater with limited legal advisor access, no physical J2X proximity, and operational pressure that does not pause for administrative completeness. The legal authority framework has to be internalized at a level that enables confident decision-making without a JAG in the building. The SFC who built the legal discipline at every previous rank does not struggle in this environment.
  • FBI/DIA/DCSA agency liaison
    A SFC 35L on a formal inter-agency assignment is working at the senior-NCO level alongside federal SES and GS-15 intelligence professionals. The tradecraft exposure and the institutional knowledge gained in this assignment is the best post-Army career preparation in the CI community. The federal civilian hiring pathway from this seat is the most direct in the Army.

What Good Looks Like at This Rank

The good SFC 35L is the senior NCO the G2 names when the INSCOM IG inspection is scheduled — because the case files are current, the legal-authority documentation is in every folder, the source validation cycle has never lapsed on this watch, and the SSG team chiefs can walk an inspector through their own files without the SFC in the room. The inspection passes because the section was built to pass inspections every day, not just the day INSCOM arrives. His SSG team chiefs run operations independently — brief the G2 cleanly, approve authority packages correctly, deconflict with the J2X without being reminded. Two of them are on the SFC board slate. One is in the 350L WO pipeline with a packet the SFC wrote personally and can defend in front of the WORC board without notes. His own MLC slot is locked, the MSG board prep is 18 months out, and the battalion CSM has told the BDE CSM that this section runs the way a CI section should run. The post-Army bridge is being built — DCSA contacts active, federal resume current, TS/SCI reinvestigation not lapsed. Not because retirement is close, but because the SFC who builds it early has options the one who waits does not.

Preview — The Next Rank

MSG and 1SG at the CI community level carry the weight of the enlisted force across a battalion or company — 40-100 CI agents across 6-12 teams, covering multiple geographic areas and mission sets. The MSG/1SG is not running individual operations; they are building and sustaining the program infrastructure that makes the SSG and SGT team chiefs effective. The operational authority questions the SFC handled come to the MSG/1SG only when the team chief and section SFC together cannot resolve them — which means the cases are the hardest ones. The SGM/CSM level is the enterprise-standard-setting seat. The SGM/CSM who runs the CI enlisted force at INSCOM, a theater command, or a joint intelligence center is setting the legal precision, the source handling discipline, and the reporting quality standard for the entire community. That seat requires a career of documented legal discipline and a professional reputation built on the case files and the NCOERs that preceded it. Build both deliberately, every rank.
FAQ

35L E7 — Frequently Asked Questions

Q01What does a E7 35L (Counter Intelligence Agent) actually do?
As a SFC you run the CI platoon or CI section of a G2 or INSCOM battalion — 2-4 teams, 10-25 agents, covering a theater geographic area or a full range of CI functions (FP, source operations, investigations, liaison, cyber CI where applicable).
Q02What's the most important thing to know as a E7 35L?
You are the senior CI NCO in the section.
Q03What does a typical day look like for a E7 35L?
Time-blocked day at the E7 35L rank tier: 0530 Unit PT — SFC runs the section's PT plan or runs with the platoon. Check in on the SSG who flagged a soldier welfare issue before the formation, 0700 SIPR review — INSCOM and theater J2X traffic, any CE flags for section personnel, operational tasking messages requiring SFC-level action today, 0800 Section operations review — all active operations status from the team chiefs, any endorsement requests requiring SFC review today, any source validation reports due this week. Legal-authority review of the one contact package submitted yesterday,…
Q04What mistakes get E7 35L soldiers fired or relieved?
Endorsing a team chief's operational request without personally reading the legal-authority section — the SFC who defers the review to the SSG team chief is the SFC whose endorsement is invalid when the DoD IG arrives and asks who read the file; Letting two teams run parallel contacts against the same target without documented J2X deconfliction — the double-agent exposure vector that surfaces at the INSCOM post-operation review names the SFC who approved both;…
Q05What career decisions matter most at the E7 35L rank tier?
1SG track vs SGM/staff track — make the deliberate decision now — The 1SG track puts you in a company-level command team with a mixed-MOS population — a CI company at INSCOM, a MI company at a division, or a non-MI company if the branch makes the assignment. You are responsible for company readiness, unit climate, and all 150-200 soldiers regardless of MOS. The SGM/staff track keeps you in the intelligence community as a senior CI advisor — CI program management at the theater or national level, senior enlisted advisor to a G2 or J2, or INSCOM enterprise-level senior NCO.…
Q06What's next after E7 for a 35L (Counter Intelligence Agent) in the Army?
MSG and 1SG at the CI community level carry the weight of the enlisted force across a battalion or company — 40-100 CI agents across 6-12 teams, covering multiple geographic areas and mission sets.
Q07What manuals and regulations does a E7 35L need to know cold?
FM 2-22.2 + ATP 2-22.2-1 / 2-22.2-2 — doctrinal authority you quote from memory.; AR 381-20 — Army CI Program (you draft the section's program document against this).; ICD 304 and applicable Intelligence Community Directives — cross-community authorities that bind Army CI operations in joint or JSOC environments.

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards