Cryptologic Network Warfare Specialist
E-5 (Sergeant) · Army
Sergeant is the rank where you stop being the operator who drives the position and start being the NCO who signs for the work the element produced. You also own three to five soldiers' careers, counselings, NCOER input, Continuous Vetting alerts, polygraph re-scope cycles, and personal-life triage. The first 90 days as SGT 35Q is the steepest leadership learning curve in the joint cryptologic / cyber community — the SCIF will not pause for you to catch up, and the Army NCO chain and the joint workforce chain will both grade you simultaneously. Build the ALC packet and the 350F / 353-series / 17A commissioning conversation on the same calendar; both are 18-24 months out and both move faster than first-time NCOs in this MOS expect. The 35-series vs 17C boundary navigation is your daily explanation to junior soldiers, to supported customers, and to your own Army chain — get the language clean and use it consistently.
- 01E-5 SGT pin-on (post-BLC, post-promotion-point cutoff, post-chain recommendation, post-DA Form 3355 board file).
- 02First 90 days as mission element lead, watch NCO, or analytic-section junior NCO — 3-5 soldier element owned end-to-end, counseling cadence (DA 4856 monthly per AR 623-3) established.
- 03Third work-role qualification under JQR / OJT or specialized depth on existing two — the SSG board reads multi-position depth.
- 04ALC slot built and locked 12-18 months before SSG board eligibility — STEP gate, no waivers.
- 05IAT-III credential current (CISSP, CASP+, CCNP-Security, or GIAC); IAT-III instructor-level recognition or technical-skill certification (GIAC GCIH / GCIA / GREM / GPEN / GXPN depending on track) as the differentiator.
- 06First mission element / watch NCO leadership through a real-world contingency or exercise cycle — the team chief reads the element's performance through the cycle as the leading indicator of SSG-board competitiveness.
- 07353-series SIGINT Analysis Technician / 170A Cyber Warfare Technician / 17A Cyber Warfare Officer commissioning packet candidacy decision with the shop WO and the senior NCO chain; first packet typically goes in as senior SGT or junior SSG.
- 08Second re-enlistment window with CSRB / SRB potential per current HRC MILPER; OCS / Green-to-Gold / WO packet consideration for those eligible and command-encouraged.
- 09Promotion to E-6 SSG: 48 mo TIS / 10 mo TIG (waivable), ALC complete, cutoff above MOS-specific line, chain release, senior-rater NCOER profile defensible at brigade and team-chief level.
- ×Skipping the monthly DA 4856 counseling on your soldiers. AR 623-3 requires it; NCOERs reference it; 'no counseling on file' is the legal defense that gets a bad soldier reduced-charge'd six months later and the SGT named in the gap. The Army-internal piece for a joint-workforce SGT is harder to maintain because the soldiers are at NSA all day — block the calendar and keep it.
- ×DUI / Art 15 / off-post arrest at SGT rank with a TS/SCI + polygraph on the line. SEAD 4 Adjudicative Guidelines apply immediately — Guideline G (alcohol), Guideline H (drugs), Guideline E (personal conduct), Guideline I (criminal conduct). Clearance suspension is the default. The SSO pulls access; the team chief writes the counseling; the senior NCO chain reads it as career-ending in this MOS.
- ×Failure to self-report under AR 381-12 (TARP) and SEAD 3 — foreign contact, foreign travel, marriage to foreign national, financial event, suspicious cyber activity. CV will surface the indicator first; the conversation moves from SSO administrative to CI investigative; the SGT's record carries the gap forever.
- ×Picking favorites in the element. The other soldiers will figure out within 30 days which SPC you actually trust; the SPC you wrote off in week 2 may be your most reliable operator by month 6 if you held the line. The senior NCO reads it in the element's product quality and in the NCOER spread.
- ×Confusing the joint chain (team chief, NSA civilian senior, watch chief at NSA) with your Army NCO chain (section sergeant, platoon sergeant, MI battalion / brigade CSM, MI senior NCO). The CWO at NSA cannot write your NCOER and cannot defend you at the brigade enlisted-management cell. Both chains matter; engage both.
- ×Re-enlisting without reading the current HRC CSRB / SRB MILPER carefully. Bonus money for 35-series soldiers moves cycle to cycle; the wrong contract terms (rank, zone, MOS, follow-on assignment, language-pay reset, reclass option) lock you in for years.
- ×Letting the technician / 17A / 17C conversation be transactional with the warrant or the senior NCO. The technician, commissioning, and reclass paths are among the most consequential decisions in the MOS — the SGTs who treat the conversation as a checkbox are the SGTs whose packets do not select.
A Day in the Life
- 0500Wake. Coffee. Quick mental check for the element's open items — RFIs outstanding from the previous watch, products in sign-off cycle, the watch handoff log from the previous shift. Any soldier emergencies (CV alert, SHARP indicator, family deathgram, missed accountability, polygraph re-scope no-show)? None? Good. PT uniform on; badge in pocket; phone goes in the kitchen drawer because it is not going near the SCIF.
- 0530PT formation. The cyber-MI company runs PT on a schedule aligned to the team's watch rhythm. As SGT you take accountability for your element's soldiers at the company PT field; you report to the SSG NCOIC; the senior NCO reads the formation.
- 0545-0700Unit PT. Cardio, strength, recovery-mobility rotation. As mission element lead you also set the element's PT pattern — Tue/Thu the element may break out and run its own plan around the SSG's overall scheme. The SGT who runs at the front of her element is the SGT the element respects.
- 0700-0830Hygiene, change into OCPs, breakfast at the DFAC or off-post if married. Walk to the SCIF.
- 0830In-process the SCIF. Badge swipe, SF 702 sign, lock personal electronics in the entry container, walk to the element's huddle space. The senior operator from the previous watch briefs the picture; the watch log is read by everyone on shift.
- 0830-1000Element shift / watch start. You run the huddle — open RFIs, today's priorities, JQR currency, IAT credential currency, any compliance items on the schedule. The SPCs and PFCs under you walk to their positions; you walk to yours, because the SGT 35Q who stops driving the position stops being credible. You drive the home work-role for the morning block while supervising the element from the seat.
- 1000-1130Position work continues. You produce the element's deliverables on the home work-role; you redline the SPC's draft BLUFs; you handle the RFI dialogue with the supported tactical or theater customer. The team huddle may pull you for 15 minutes at mid-morning to sync with the senior operator, the warrant, and the team chief.
- 1130-1300Chow. You eat with the other SGTs and the SSG NCOIC in the company or in the team space. The senior NCO read of you forms around that table as much as around the briefing room.
- 1300-1500Afternoon work continues. Counseling sessions if a monthly DA 4856 is due — block 30 minutes per soldier in your calendar and keep it. NCOER input cycles if the rating quarter is closing; ALC packet review if the slot is approaching; Foundry slot coordination through the brigade Foundry coordinator; element training (structured analytic technique drills, tool refreshers, intel writing redlines, cross-domain hygiene reviews).
- 1500-1600Element huddle. You review tomorrow's priorities with your soldiers; you confirm RFI status; you walk through any sign-off blockers; you check JQR signoff items each SPC drove that day. The SSG NCOIC reviews your element's rollup as part of the platoon huddle.
- 1600-1630SF 702 walk-around begins; SF 701 end-of-day SCIF checklist; classified destruction line if it is your element's rotation; two-person integrity walks of any spaces your element is closing. Sensitive items, containers, terminals all accounted for before lights down.
- 1630Released. Most garrison days. Watch shifts, exercise cycles, real-world contingencies, inspection cycles, and element emergencies change this hour by hours or days.
- 1700-2000Personal time. If married, family time. If chasing the ALC slot, packet prep. If on the 353-series / 170A / 17A track, NCOER-bullet documentation work. If the GIAC seat is approaching, prep reading. The SGT who studies on her own time is the SGT whose SSG board NCOER reads stronger.
- 2000-2200If a soldier in your element called you with a problem — financial, marital, legal, CV alert, SHARP indicator, polygraph re-scope concern, foreign-travel question, technician-packet question — you are on the phone or in his BEQ room. The SGT's after-hours job starts here, not earlier. The senior NCO read of you tracks how you handle the after-hours calls.
- 2200Lights out. Tomorrow starts at 0500.
- Watch / shift rotationCMF teams and NSA-tasked analytic lines run 24-hour watches during exercises and real-world contingencies. The 12-hour night shift becomes your rhythm; you sleep when the watch hands off; the morning brief is briefed by whoever has the picture at the agreed time regardless of which shift owns it.
- Real-world contingency or exercise cycleSame clock, less sleep. You run the element as mission element lead through the cycle; your element's sector is your responsibility through the cycle; you sleep in shifts. The team chief grades the element's performance through the cycle as the leading indicator of SSG-board competitiveness. A 14-day cycle feels like 30 and the senior NCO chain watches whether the SGT hangs.
Weekly Cadence
Key Skills — How to Drill Each
- 01Run a Cyber Mission Force shift, mission element, or analytic watch as the lead Army NCO — accountability, position coverage, JQR currency, IAT credential currency, and tasked deliverables out the door on time.The watch SOP your team publishes is the template; do not invent your own. The senior Army NCO on watch owns the element's piece of the picture from shift start to shift end — the BLUF input to the team's morning slide, the threat-warning push if the indicators trip, the RFI triage when traffic surfaces a gap, the escalation chain when something exceeds your authority to sit on. Build the muscle memory: at shift start, read the previous watch log, scan the open RFIs, walk the SCIF physical security under ICD 705 (SF 702 status, container check, terminal lock state), check JQR currency on the soldiers under you, check IAT-II/III credential currency, and identify the day's two-or-three highest-priority deliverables. At shift end, write the watch log the next NCO will read first. The senior rater grades on watch-log discipline more than most SGTs expect.
- 02Drive at least two qualified work-roles to current standard; lead the JQR / OJT signoff for the soldiers underneath you to the same standard you were held to.Currency is the rolling discipline. Multi-position qualification at SGT is the senior-NCO read of credibility; the SGT who lost currency on her own work-roles because she 'moved into the NCO seat' is the SGT the team chief stops asking for. Drive a rotation: spend defined hours on the home position each week; rotate to the second and third positions on a published schedule; teach the JQR line items to your SPCs and PFCs through demonstration, not lecture. The SGT who signs a JQR signoff on a soldier she has not personally watched at the position is the SGT whose section's first audit finding lives on her record. The fix: watch the work, then sign.
- 03Apply the joint analytic and targeting cycle (JP 2-0, JP 3-12, JP 3-60) end-to-end on the products your shift owes — and defend the team's call to the supported command when they wanted a different one.The supported commander, the J2 / J3 staff at the CCMD level, or the senior NSA civilian on the partner team may want a confidence call or a target nomination the team's data does not support. Hold the line. Cite ICD 203 standards (sourcing, confidence, alternative analysis); name the sources by enclave (SIGINT, IMINT, HUMINT, OSINT, GEOINT); name the confidence honestly; name the gaps explicitly. The senior operator or the warrant or the team chief walks in front for the partner-element coordination; you walk behind with the source-citation packet. The SGT who pushes a confidence the data does not support — because the customer wants it — is the SGT whose section runs an operation it should not have run, and whose career stalls at the next NCOER cycle.
- 04Write the DA 4856 counseling that documents both the technical mistake and the development plan — Plan of Action specific, measurable, signed before the soldier leaves the room.Counseling at SGT in a 35Q element is different from counseling at SGT in a line platoon — the technical content is more specific and the security-clearance / CV / polygraph context is loaded into every counseling. 'Soldier will improve work-role technique' is not a plan; 'Soldier will complete the IAT-III voucher study through the team's credential coordinator by 15 OCT, will demonstrate the second-work-role JQR line items 3-7 to the senior operator by 30 OCT, and will produce two ICD-203-compliant BLUFs per week for SSG review for the next 90 days' is a plan. Write the Plan of Action in second person, put the deliverable and the date and the signature line on the page, and have the soldier sign before he leaves your office. Email yourself a copy. The SSG NCOIC and the warrant read your counselings during NCOER cycles; the senior rater calls you at the end of the rating period because your bullets describe what the soldier did.
- 05Run the Army-internal piece for a joint workforce — promotion packets, DA 4187s, schools, retention bonuses, family-readiness — without making the soldier go find HRC themselves.The Army-internal piece is the SGT's hidden differentiator in this MOS. The soldier sitting at NSA all day does not naturally engage the Army NCO chain unless you make it engageable. Build a section-NCO rhythm: monthly DA 3355 worksheet review with each soldier; quarterly SRB / CSRB MILPER pull for soldiers approaching re-enlistment windows; quarterly school-slot review (BLC for E-3s, ALC packet prep for E-5s eyeing SSG, Foundry seat availability, NSA-cryptologic-school slots); annual family-care plan review for soldiers with dependents. The SGT who runs the Army-internal piece cleanly is the SGT whose soldiers do not have to fight HRC alone; the senior NCO read of you tracks this metric.
- 06Operate the cross-MOS interface honestly — 35Q sits next to 35N (SIGINT analyst), 35P (cryptologic linguist), 35S (signals collector), 35F (all-source intel analyst), and 17C (cyber operations) seats. Know what each does and how the work-role boundaries are drawn so you do not embarrass the team by claiming someone else's lane.35Q is cryptologic cyberspace operations under SCC / NSA authorities (SIGINT enterprise). 35N is SIGINT analyst (analytic side of the cryptologic enterprise). 35P is cryptologic linguist (language-coded SCC workforce). 35S is signals collector (collection side of the SCC workforce). 35F is all-source intelligence analyst (separate from the SCC; consumes SIGINT alongside other disciplines). 17C is cyber operations specialist (USCYBERCOM authorities; CMF-team work-role enabling offensive and defensive cyber). The work-role boundaries are drawn in the team's SOP and the joint workforce credentialing framework. As SGT, you explain the boundaries cleanly to junior soldiers, to supported customers, and to your own Army chain peers who do not work the joint workforce daily. The warrant officer and the team chief will help calibrate; the senior NSA civilian analyst on the team can also walk you through the cryptologic-vs-cyber-operations distinction at the authority level.
Manuals & References — What Chapters Matter
- FM 2-0 — IntelligenceOwn it cover-to-cover at SGT. The Army doctrine spine for the intelligence warfighting function. As mission element lead or watch NCO, you reference FM 2-0 in NCOER block-reads, in counseling statements, in training plans, and in the explanation to junior soldiers of where 35Q sits inside the larger Army intelligence enterprise. The senior rater quotes from FM 2-0 in evaluations; have the book on your desktop and reread the chapters on the intelligence warfighting function and the intelligence cycle quarterly.
- JP 3-12 — Cyberspace Operations; JP 2-0 — Joint Intelligence; JP 3-60 — Joint TargetingThe joint doctrine your team operates under. JP 3-12 frames offensive cyberspace operations, defensive cyberspace operations, DODIN operations, and the authorities the Cyber Mission Force operates under. JP 2-0 frames the joint intelligence cycle. JP 3-60 frames the joint targeting cycle (F2T2EA). At SGT you reference these in team huddles, in element training plans, and in the explanation of authority boundaries to soldiers and supported customers. The warrant officer on the team will quote from these documents during operational coordination; match the bar.
- ICD 203 / 206 / 208 — Analytic Standards, Sourcing, Utility of Disseminated Analytic ProductsThe IC-wide standards your element's products are graded against by the team chief, the NSA civilian senior, and any IC reviewer above the team. Print the five ICD 203 tradecraft elements; print the ICD 206 sourcing requirements; print the ICD 208 utility framework. Keep them at the element's huddle space and train your SPCs against them. The SGT whose element's products read like ICD 203 / 206 / 208 standards is the SGT the team chief brings to the partner-element coordination call.
- ICD 503 — IC IT Risk Management; ICD 705 — SCIF AccreditationICD 503 governs IC IT systems and the risk-management framework the cognizant security authority applies to your team's systems. ICD 705 governs SCIF accreditation — the standard the rooms your element works in are built to. As mission element lead you sign for the element's piece of ICD 705 compliance (SF 702 / SF 701 discipline, two-person integrity, classified discussion boundaries, sensitive-item accountability) and the element's piece of ICD 503 compliance (cross-domain hygiene, credential management, system-use compliance). The SSO outranks you on compliance; your job is to be the SSO's partner, not the SSO's audit finding.
- AR 380-5 — Information Security; AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; AR 25-2 — CybersecurityAR 380-5 is the day-to-day classified handling reg. AR 381-10 is the governing reg for Army intelligence activities (Procedures 1-15 oversight rules for collection on US persons — the IG inspects against this reg in the MI community). AR 381-12 is TARP self-reporting (the obligation you carry and that you mentor your soldiers through). AR 25-2 is Army cybersecurity — the framework the team's cyber-incident reporting chain runs under. All four are referenced in the annual compliance training cycle and in the element's day-to-day discipline.
- DoDM 8140 — Cyberspace Workforce Qualification; AR 600-20 — Army Command Policy; AR 623-3 — Evaluation Reporting; AR 600-8-19 — Enlisted Promotions; SEAD 3 / SEAD 4 / SEAD 6 / DoDM 5200.02DoDM 8140 (current edition) is the cyberspace workforce framework your IAT / position credentials live under. AR 600-20 is command policy including SHARP (chapter 7), EO (chapter 4), and anti-extremism (chapter 5) — the 24-hour and 72-hour SHARP reporting windows are non-negotiable when something happens in your element. AR 623-3 governs NCOERs and counseling. AR 600-8-19 governs promotion math. SEAD 3 (Continuous Evaluation), SEAD 4 (National Security Adjudicative Guidelines), SEAD 6 (Continuous Vetting), and DoDM 5200.02 (Procedures for the DoD Personnel Security Program) frame the clearance environment your element operates in.
Standards — How to Hit Each
- At least two work-role qualifications current; IAT-III credential in motion or already in hand if the work-role requires it.Currency is the rolling discipline at SGT. Drive the second-position rotation deliberately; build a published schedule with the senior operator and the team chief that protects time on both work-roles. The IAT-III credential path runs through Army Credentialing Assistance and unit training funds — CISSP, CASP+, CCNP-Security, or GIAC certifications depending on the work-role and the team's funding posture. The GIAC certifications (GCIH, GCIA, GREM, GPEN, GXPN) are particularly valued in the joint cyber workforce. Plan the credential 6-12 months before the SSG board window; the senior NCO read of you tracks credential currency.
- BLC graduate; ALC slot built and ready when the schedule drops — STEP gate for SSG under AR 600-8-19.BLC is in the rear-view; ALC is the next STEP gate. The ALC packet (DA 4187, ATRRS) goes in 12-18 months before you need the slot. ALC for 35Q runs through the regional NCO Academy with the intel-MOS-specific track or, in some cycles, through USAICoE at Fort Huachuca for the intel branch's senior leader pipeline. The Commandant's List at ALC is a promotion-points line and a known SSG-board check. Plan the packet through the section sergeant and the brigade S2 NCO development chain.
- ACFT 560+ as a floor — your soldiers do not respect an NCO who skates on the test they are graded on, joint workforce or not.560 requires roughly 250+ on three events plus 60+ on the others. Lift heavy three days a week, run intervals two days a week, focus on grip and core. The 2-mile run is the score-killer; pull your time below 16:30 and you can afford to score moderately on the lift. The cyber MI community fought hard to shed the 'soft' stereotype; the SGT who skates on PT in the SCIF puts the stereotype back on the section. The element's ACFT pass rate trends to the SGT's pass rate.
- Section product quality measurable — work-role deliverable timeliness, JQR pipeline velocity, IAT credential currency rate trending the right way under your tenure.Measure what the element produces and track it on a section log the warrant or the team chief reads on Mondays. Work-role deliverable timeliness: are the element's products closing inside the team's published timeline. JQR pipeline velocity: are the SPCs and PFCs under you completing line items at the team's average pace. IAT credential currency rate: are the soldiers under you maintaining IAT-II and IAT-III currency under DoDM 8140. The SGT who tracks these is the SGT whose senior rater can write NCOER bullets with numbers in them.
- Promotion-points stacked: cryptologic / cyber school seats, weapons quals, college credit, credentials (Sec+, CISSP / CISSP-Associate, CASP+, GIAC seats depending on work-role), correspondence.The DA 3355 worksheet at SGT has known ceilings per category. Cryptologic / cyber school seats (Foundry, NSA-cryptologic-school slots, language schools if applicable) and intel-specific schools accrue in the awards-and-decorations and military-education columns. College credit (CLEP, DSST, TA) maxes out at the 110+ pt line for 60+ semester hours. Credentials (Sec+, IAT-III credentials, GIAC certifications) accrue under the military-education or civilian-education line per the current AR 600-8-19 / DA PAM 600-25 guidance. DLC (Distributed Leader Course) is the structured self-development requirement. Review the worksheet with your section sergeant or career counselor quarterly; the cutoff score moves monthly per the HRC MILPER.
Technical Mistakes — Concrete Consequences
- Signing off a JQR on a soldier you have not actually watched at the position.The audit finds it. The senior operator finds it. The warrant or the team chief finds it. The team's training authority gets pulled until the JQR is re-validated; the soldier's qualification gets pulled until re-validated; the SGT's signature gets read as the discipline failure. The fix: watch the work, then sign. The 'I trust him' shortcut is the one the audit cycle catches first, and the team's credibility with the partner element (NSA, USCYBERCOM, the supported COCOM) pays for the SGT's shortcut.
- Counseling soldiers verbally instead of writing the DA 4856.When a soldier loses an Article 15 appeal, files an IG complaint, gets caught up in a CV alert, or has a SHARP indicator surface, the chain's first move is to pull every counseling on file. A verbal counseling you swear you gave is invisible in the legal file; the soldier's lawyer or the IG investigator will use the gap to argue the standard was fabricated after the fact. Two minutes typing a DA 4856 equals 12 months of legal defense for you, the SSG, the team chief, and the senior NCO chain. AR 623-3 requires monthly counseling for rated NCOs and SPCs; build the calendar block and keep it.
- Skipping the SAEDA / TARP / insider-threat report on an indicator you saw — foreign contact, financial distress, unreported travel, behavioral change.AR 381-12 is not optional. The 24-hour and 72-hour reporting windows on specific indicators are non-negotiable. The SSO will hear it from someone else first if not from you — Continuous Vetting (SEAD 6) surfaces indicators automatically; another soldier's report may surface the indicator before yours; the CI office may surface the indicator through a separate channel. The conversation moves from administrative to investigative when the SGT did not report. The soldier you were 'protecting' is in worse shape than if the indicator had been reported in the published window; the SGT's record carries the gap forever.
- Confusing the joint chief / watch chief / NSA civilian senior with your Army NCO chain.The CWO or GS-13/GS-14 civilian at NSA cannot write your NCOER, cannot defend you at the brigade enlisted-management cell, cannot resolve a DA 4187, cannot fix a promotion-point calculation, cannot drive an ALC slot, and cannot resolve a family-care plan issue. The SGT who treats the joint chain as the entire chain is the SGT whose Army-internal record reads thin at the SSG board. Both chains matter; engage both. The warrant officer on the team can help bridge — but the responsibility is yours.
- Letting a SIPR / JWICS / NSAnet currency lapse on a soldier under you.Day-one of expiry the position is empty and the team chief asks why. The team's authority on that position gets pulled; the soldier's individual access gets re-evaluated; the SGT is in the counseling chain for failure to track currency. Currency reporting is the SGT's job; the SSO and the team chief assume the SGT is tracking. The fix: build a currency tracker on the element's whiteboard or on a shared spreadsheet; review it weekly with the soldiers; flag expirations 60 days out and 30 days out and 7 days out.
Career Decisions at This Rank
- ALC slot timing and packet completion — STEP gate for SSG under AR 600-8-19ALC graduation is the hard prerequisite for the E-6 SSG pin. The slot is allocated by the chain through the regional NCO Academy or USAICoE depending on the track. Pull a slot 12-18 months before your TIS/TIG hits the SSG window; the slots fill and the SGT who waits is the SGT who sits in zone. The trade-off: 4-6 weeks away from the element and the position. The cost of not taking the slot when offered: the SSG board moves regardless of your readiness. The ALC Commandant's List is a promotion-points line; show up at standard PT, in clean uniform, with the mission-element NCO habits already built. Phone it in and the brigade S2 SGM hears about it from the NCO Academy CSM.
- 353-series SIGINT Analysis Technician / 170A Cyber Warfare Technician / 350F All-Source Intelligence Technician warrant officer packetThe technician warrant officer path is the technical-deep career option. 353-series (SIGINT Analysis Technician) is the natural cryptologic-side path for 35Q-track SGTs eyeing the analytic technician seat; 170A (Cyber Warfare Technician) is the natural cyber-side path for 35Q-track SGTs who want to push deeper into cyber operations; 350F (All-Source Intelligence Technician) is more common for 35F SGTs but reachable for some 35Q-track candidates depending on track and depth. Each packet requires NCOER bullets at SGT / SSG, recommendations from current and prior leadership, technical-skill documentation, board appearance, and the WO Recruiting Command (WORC) selection cycle. Most packets go in as senior SGT or junior SSG with the NCOER profile built. The trade-off: the technician path is technical-deep, single-track, and one of the most respected positions in the MOS — the technician is the senior analytic / cryptologic / cyber voice at brigade, theater intel brigade, INSCOM, NSA-co-located detail, or CMF-team seats across decades. The cost: you commit to the technical track rather than the broad NCO leadership track (the PSG, 1SG, CSM arc) or the commissioned-officer path. The honest test: do you want to be the senior technical voice in the room or the NCO running the room or the commissioned officer in the room. All three are good. Talk to the shop warrant, to a senior technician if your unit has one, and to your spouse. The decision is one of the most consequential in the MOS.
- 17A Cyber Warfare Officer / Green-to-Gold / Direct OCS — commissioning conversation for SGTs with a bachelor's degree (or close to one)With a bachelor's degree (or close to one), Green-to-Gold scholarship + OCS is the active-duty commissioning path. Direct OCS (no scholarship, your existing degree) is the faster route. For 35Q-track soldiers, the 17A Cyber Warfare Officer accession is the natural commissioned-officer track — the MI Basic Officer Leader Course (MIBOLC) at Fort Huachuca and the 17A pipeline open the door to commissioned cyber-warfare seats at USCYBERCOM, the 780th MI Brigade, the Cyber Mission Force, and the joint-staff cyber-strategy billets. The honest test: are you better at executing missions or at building systems and writing policy? Soldiers who love being NCOs make average officers. Soldiers who keep asking "why are we doing this the way we are doing this" make excellent LTs and warrants. Talk to the section sergeant, the warrant, the team chief, and the company CO — the chain's read of you is the leading indicator of whether to package.
- Second re-enlistment — SRB, CSRB, follow-on assignment, ETS to cleared-cyber civilian, or Active to ReserveThe second re-enlistment window typically opens 12-18 months before your second contract ends. The Selective Reenlistment Bonus (SRB) per the current HRC SRB MILPER and the Critical Skills Retention Bonus (CSRB) for specific cryptologic / cyber skill identifiers vary by MOS, re-up zone, shortage indicator, and follow-on assignment. Pull both current MILPERs before signing. 35-series soldiers at SGT are often on the CSRB schedule because the MOS is a Critical Skill. The ETS-with-clearance option is real and substantial at this rank — the cleared cyber contractor market (Booz, Leidos, MITRE, CACI, ManTech, SAIC, BAE, and the long tail of cyber-specific shops) hires from the SCC workforce on the TS/SCI-with-poly profile with IAT-III credentials and GIAC certifications. A SGT 35Q at the second re-enlistment window with multiple work-role qualifications, IAT-III in hand, and a clean record can walk into a strong cleared-cyber offer. The traps: signing for a maximum bonus into a follow-on assignment that breaks your family; signing for a longer contract than you actually want; resetting your language-pay clock if applicable by misreading the FLPB rules in the contract. Run the math twice. Talk to your spouse, your career counselor, the warrant, and the team chief.
- Drill Sergeant / Recruiter / TRADOC instructor / Foundry instructor / NIOC Corry Station instructor — special duty assignmentTRADOC special duty assignments (Drill Sergeant at OSUT or BCT, Recruiter, AIT instructor at NIOC Corry Station, Foundry instructor at one of the Foundry sites or USAICoE, NSA enterprise team trainer) are typically 3-year tours that age you fast, pay an SDA bonus, and visibly differentiate your career profile. The Drill Sergeant identifier (X4 ASI) is a known check at the E-7 board. The NIOC Corry Station instructor billet is the 35Q-community-specific version — you teach the cherry operators who replace you in the joint workforce, and the instructor billet is a visible signal of subject-matter mastery in the cryptologic / cyber community. The Foundry / USAICoE instructor tour is the intel-community-specific version. The cost: family quality-of-life is harder during a Drill Sergeant tour; the instructor tours are typically less brutal but still demanding. Some careers are made by SDA tours; some marriages are broken by them. Talk to NCOs who have done the tour before volunteering.
How the Seat Varies by Unit Type
- 780th MI Brigade (Fort Meade) — Army cyber brigade, mission-element NCO seatThe most common SGT seat for the Army cyber operations side. The 780th's tempo is high; the work-role density is deep; the senior NCO and warrant officer bench is one of the strongest in the Army cyber community. As mission element lead in the 780th, you own a 3-5 soldier Army-side element on a Cyber Mission Force team co-located with NSA-Washington or attached to USCYBERCOM. The analytic / operational problem is high-tempo and CMF-mission-set-specific. The reps come fast; the senior NCO visibility is direct; the technician (170A) and 17A pathways are extensively walked.
- 706th MI Group (Fort Eisenhower) — NSA/CSS Georgia mission-element NCO seatThe natural SGT seat for the Army cryptologic / SIGINT side. The 706th supports NSA/CSS Georgia at Fort Eisenhower (renamed from Fort Gordon in 2023). As mission element lead, you own a 3-5 soldier Army-side element on an NSA-tasked analytic line. The work-role focus is more SIGINT-analytic-tilted than the 780th's cyber-operations focus; the senior NCO bench is deep; the cost of living is lower than Fort Meade. The 353-series (SIGINT Analysis Technician) pipeline is well-trafficked at the 706th. The Cyber Center of Excellence is also on post; the cross-MOS interaction with 17C / 17A is dense.
- Cyber Mission Force team — NSA Cryptologic Center detachment (Hawaii, Texas, Colorado, or other)CMF team SGT seat is more compartmented than the brigade SGT seat. You own a small Army-side element on a joint team; the team chief and the supported COCOM are closer to you daily than the Army chain. The work-role focus is mission-set-specific. The lifestyle is location-specific — Hawaii is paradise with brutal cost of living; Texas is San Antonio with the BAMC / Fort Sam Houston military density; Colorado is altitude and proximity to USNORTHCOM. The SGT experience on a CMF team is closer to the joint workforce daily than the Army chain; the senior NCO read of you is the team chief's read in many cycles, with the parent brigade's read in the background.
- INSCOM major subordinate command — theater intel brigade, specialty unit, or 902nd MI Group supportThe slower-tempo seat at SGT. INSCOM units run the Army's above-brigade intel formations; SGT 35Qs at INSCOM units typically sit on theater intel brigade analytic lines (66th, 500th, 470th, 513th, 207th) or specialty units. The analytic problem is broader and slower-tempo than a CMF team or the 780th; the analytic-depth side is closer than the operations side. The trade-off versus a CMF / brigade SGT seat: slower tactical tempo, more analytic depth, a different career arc that aligns more naturally with the 353-series / 350F technician path and the IC-detail assignments.
- National detail / NSA enterprise team / DIA detail / joint-staff cyber seatClosed-access, compartmented, by name-request or HRC-directed assignment. National details at NSA or DIA or a joint-staff cyber-strategy seat put a SGT 35Q on an IC-wide problem alongside civilian analysts (GS-12 / GS-13 / GS-14) and contractors. The SGT seat at NSA / DIA / joint staff is rare but real — typically requires multiple work-role qualifications, IAT-III credential, GIAC certification, and a previous tour at a theater intel brigade or the 780th / 706th. The technician (353-series / 170A) packet candidacy from these seats reads strong on the WORC board. The Army NCO chain feels distant; the team chief at NSA / DIA / joint staff is the daily reality.
What Good Looks Like at This Rank
Preview — The Next Rank
35Q E5 — Frequently Asked Questions
Q01What does a E5 35Q (Cryptologic Network Warfare Specialist) actually do?
Q02What's the most important thing to know as a E5 35Q?
Q03What does a typical day look like for a E5 35Q?
Q04What mistakes get E5 35Q soldiers fired or relieved?
Q05What career decisions matter most at the E5 35Q rank tier?
Q06What's next after E5 for a 35Q (Cryptologic Network Warfare Specialist) in the Army?
Q07What manuals and regulations does a E5 35Q need to know cold?
This playbook has no tips yet. Be the first to share what you know.