←Back to 1799 Cyberspace Warfare Chief — overview, pay, training, civilian translation, reviews
1799E1-E3
Cyberspace Warfare Chief
E-1 to E-3 (Junior Enlisted) · Marines
HEADS UP
The 1799 Cyberspace Warfare Chief designator does not exist at E-1 through E-3. You are a 1721 Cyberspace Warfare Operator trainee or another 17XX junior Marine. This page is about the path that starts here — not a billet you can hold for another decade. Read the 1721 Playbook for your actual job right now; read this to understand what you are building toward.
The Honest MOS Read
Nobody pins 1799 at PFC. The designator is the 17XX community's version of 0369 or 0699 — a senior NCO career code that the Marine Corps assigns to seasoned cyber leaders who have demonstrated both technical mastery and enlisted leadership depth across a full career arc. The typical entry point is SSgt, sometimes GySgt. You are somewhere between ten and fifteen years away from that conversation.
What you are right now is a boot in the 17XX pipeline. You completed MOS school at MCCES Twentynine Palms — or you are about to — and your first operational assignment puts you in a SCIF at MARFORCYBER, a Marine Cyberspace Warfare Group element, or a supporting establishment billet that feeds the cyber mission. The tools are real. The authorities are real. The classified material you handle is real. And the clearance investigation that granted your TS/SCI is tracking every decision you make from this point forward.
The honest truth about this tier: your job is to be an excellent junior 1721. That means running your watch, logging your anomalies, escalating what needs escalating, and keeping your mouth shut about what you see in the SCIF. It means earning the DoD 8140 baseline certification — typically Security+ — within the command timeline. It means passing every PFT and CFT at 1st Class because the 17XX community does not issue fitness waivers for people who sit in front of screens. It means proving to your team lead that you can handle the boring, repetitive, high-consequence work of cyber operations without cutting corners.
The 1799 pathway is built on a decade of clean clearance history, progressively deeper technical qualifications, and leadership performance that the community tracks in a population small enough that everyone knows everyone. A single security incident at this rank — a phone in the SCIF, an unauthorized disclosure, a social media post that grazes operational details — is remembered by name when the designator board meets eight or ten years later. The foundation is not spectacular performance. The foundation is consistent, reliable, trustworthy performance sustained across years.
The Marine Corps does not mark junior 17XX Marines for the 1799 track. There is no list, no screening board, no early identification program. What happens instead is simpler and harder: you do the work, you earn the trust, you keep the clearance clean, and the community remembers. When the designator conversation happens at SSgt or GySgt, the board looks backward at the full record — and the record starts here, at PFC, in the SCIF, on the watch, doing the unglamorous work that nobody outside the building will ever know about. That starts now.
Career Arc
- 01Complete 17XX MOS school at MCCES Twentynine Palms — the schoolhouse evaluation shapes your first assignment and follows you.
- 02Report to first operational unit — typically a MARFORCYBER element or Marine Cyberspace Warfare Group subordinate command.
- 03Earn DoD 8140 baseline certification (Security+ or equivalent) within the command-directed timeline.
- 04Qualify on watch — running the tools, producing logs, escalating anomalies to the team lead's standard.
- 05Complete Marine Corps Martial Arts Program (MCMAP) advancement — the 17XX community expects you to be a Marine first.
- 06Build toward Cpl cutting score — composite score matters, but in this small MOS the team lead's read on you matters equally.
- 07Start tracking intermediate certifications (CEH, CySA+) for the Cpl-to-Sgt window.
Common Screwups
- ×Bringing a personal electronic device into a SCIF — even accidentally. The security office does not care about your intent; the incident report goes in the file.
- ×Discussing anything about your work on social media — even vague references to 'what I do' or 'where I work.' The CI threat to 17XX Marines is not hypothetical; it is an active, ongoing concern.
- ×Getting a DUI, drug offense, or any UCMJ action that triggers a clearance review. The TS/SCI is the single non-negotiable for the entire 17XX career. Lose it and you are reclassified before the investigation is complete.
- ×Treating the barracks or liberty as a place where operational security does not apply. The foreign intelligence services that target young TS/SCI holders do not operate only inside the wire.
- ×Failing a PFT or CFT and assuming it does not matter because the job is technical. The 17XX community is small; the Marine who falls out of the company run is known by name at the next FITREP cycle.
A Day in the Life
- 0500Wake. Check phone for any recall or security notifications — the 17XX community runs 24/7 and a watch-team recall can come at any hour.
- 0530-0630PT formation. Company PT — runs, calisthenics, obstacle course rotation, MCMAP days. You fall in with the platoon; the team lead notices whether you are at the front or the back.
- 0630-0745Hygiene, chow, change into utilities or the duty uniform for the SCIF. Pre-work phone check — leave the personal device in the car or the lockbox before you badge in.
- 0800Badge into the SCIF. Receive the watch-team turnover brief from the outgoing shift — current taskings, ongoing analysis, any open anomalies, any pending authorities questions.
- 0815-1130On watch. Run the tools, monitor the dashboards, execute assigned analysis tasks. Log everything. Escalate anomalies to the team lead per SOP. The morning block is typically the heaviest tasking period.
- 1130-1230Lunch. Exit the SCIF, secure your workstation, badge out. Eat in the chow hall or the break area. Do not discuss work outside the SCIF — not even in generalities.
- 1230-1600Afternoon watch block. Continue analysis, complete reporting, attend any scheduled training or certification study time the team lead has built into the schedule.
- 1600-1630Watch turnover to the next shift (if shift work) or end-of-day closeout. Secure workstation, log final entries, brief the team lead on any open items.
- 1630-1700Badge out of the SCIF. Gear accountability if there is a formation. Admin — dental, medical, personnel actions, any command-directed training outside the SCIF.
- 1700-1800Personal time begins. Gym, cert study, barracks. The Marines who use this hour for certification study are the ones who pass the exam early.
- 1800-2100Evening. Chow, personal time, study. The smart boot studies an hour a day for the Security+ and does not cram the week before the test.
- 2100-2200Rack. The recall phone stays charged and audible. If the watch team calls, you answer.
Weekly Cadence
Monday through Friday in garrison follows the SCIF watch schedule — typically day shift for junior Marines, with periodic rotation to mids or nights depending on the unit's operational tempo. PT is five days a week: three organized company PT sessions (Monday, Wednesday, Friday) and two self-directed sessions (Tuesday, Thursday) that the team lead expects you to use for PFT/CFT improvement, not for sleeping in.
The training schedule runs underneath the operational tempo. One day a week is typically designated for professional military education, certification study, or MCMAP — the team lead blocks the time, and you use it. When the operational tempo spikes — a USCYBERCOM exercise, a real-world mission surge, or a security incident — the training day disappears and you are on extended watch rotations until the tempo drops.
Field training is less frequent than the infantry but not absent. The 17XX community deploys Marines on exercises that test the unit's ability to operate in austere, expeditionary environments — not just from a fixed SCIF. When the company goes to the field, you go to the field. Ruck, sleep on the ground, set up the expeditionary comm gear, and prove you can run a mission from a tent as well as from a building. The Marine Corps does not produce cyber operators who cannot operate outside a climate-controlled room.
Key Skills — How to Drill Each
- 01Complete the 17XX MOS-producing school and any follow-on training to the passing standard.Treat the schoolhouse like it matters — because the instructors write evaluations that your first team lead reads. Take notes. Ask questions during the practicals, not during the lectures. The Marines who coast through MCCES and show up at the unit pretending they learned it all spend the first six months getting retrained by Cpls who did not coast.
- 02Operate baseline cyber tools — vulnerability scanners, SIEM dashboards, command-line environments — to the team SOP standard.Lab time is your friend. If the team has a training environment, live in it. Run the tools against the practice targets until the syntax is muscle memory, not something you look up during a live watch. The team lead who has to walk you through the same query twice stops trusting you with the hard tasks.
- 03Handle classified material and SCIF protocols without a single incident.Memorize the SCIF entry procedures on day one. Check your pockets before you badge in — every time, not just when the security officer is watching. Build the habit now because at SSgt or GySgt the 1799 designator board looks at a clearance jacket that spans a decade, and one incident at PFC is still one incident.
- 04Earn the DoD 8140 baseline certification within the command timeline.Get the study materials the week you arrive. Block an hour a day. The Marines who put it off until the deadline are the ones who fail the first attempt and end up on the company commander's non-compliance report. Pass it early and you become the Marine who helps the next boot study.
- 05Document watch activities — logs, anomaly reports, escalations — to the standard the team lead can brief from cold.Write like someone who was not in the room has to understand what happened. Timestamp everything. Name the tool, name the finding, name the action taken. The logs you write today are evidence if something goes wrong next week — and they are your track record if everything goes right.
Manuals & References — What Chapters Matter
- NAVMC 3500.44 — Cyberspace Operations Training and Readiness Manual.Governs every individual training task across the 17XX field. Your team lead grades you against these tasks. Know which ones apply at your paygrade and which ones you are building toward.
- DoDD 8500.01 — Cybersecurity.The overarching directive governing everything you touch in the SCIF. You do not need to memorize it — you need to understand that it exists, it is enforced, and violations are investigated.
- JP 3-12 — Cyberspace Operations (unclassified portions).Read the unclassified executive summary to understand the OCO/DCO/DODIN framework. You operate inside one of these lanes; knowing which one and why matters when the authorities question comes up.
- DoDM 8140 — Cyberspace Workforce Management.The certification framework that tracks you from day one. Your baseline cert (Security+ or equivalent) is the first gate; intermediate and advanced certs build throughout the career. Non-compliance is a readiness metric the CO briefs.
- MCO 6100.13 — Marine Corps Physical Fitness and Body Composition.The standard is 1st Class PFT and CFT. The 17XX community does not have a separate fitness track — you are a Marine who operates in cyberspace, not a civilian contractor who wears a uniform.
Standards — How to Hit Each
- MOS school complete with passing marks.Attend every class, take the labs seriously, and do not be the Marine who barely passes the final practical. The schoolhouse record shapes your first-assignment billet, and the instructors talk to the receiving unit.
- TS/SCI clearance adjudicated and maintained without incident.Report every foreign contact, every financial change, every legal issue to the security manager immediately. The CI investigation does not stop because you got the clearance — it runs continuously. The Marines who get burned are the ones who assumed the initial adjudication was the finish line.
- DoD 8140 baseline certification earned within commanded timeline.Study daily, take the practice exams seriously, and pass it before the command-directed deadline. Failing and rescheduling is not a career-ender at this rank — but it puts you on the CO's radar in a way you do not want.
- 1st-Class PFT and CFT under MCO 6100.13.Run on your own time. The company PT program gets you to the minimum; the formation run and the CFT are where the team lead forms an opinion about whether you take the whole job seriously or just the part behind the screen.
Technical Mistakes — Concrete Consequences
- Treating MOS school as just another pipeline to survive instead of the technical foundation for a decade-long career.You arrive at the unit unprepared, spend the first six months being retrained by Cpls, and the team lead's initial read on you — unreliable — takes a year to overwrite.
- A single SCIF security violation — phone in the SCIF, badge tailgating, unsecured workstation.The incident report goes in the clearance jacket permanently. In a community of fewer than a thousand Marines, the security office remembers your name at every subsequent reinvestigation.
- Posting anything about your work, unit, or capabilities on social media.The CI threat briefing is not hypothetical. Foreign intelligence services actively target young TS/SCI holders. A single post that confirms your role, your unit, or your location can trigger a counterintelligence investigation that follows you for years.
- Neglecting physical fitness because the job is behind a screen.The formation runs, the company humps, and the cyber Marine who falls out loses credibility with the platoon sergeant and the infantry Marines who share the base. In a community this small, that reputation follows you to the next unit.
Career Decisions at This Rank
- First enlistment: stay 1721 or explore lateral moves within 17XX.At E-1 through E-3 this is not a real decision yet — you do not have the operational depth to make it intelligently. Focus on the 1721 mission, earn the certifications, and let the first enlistment teach you whether the DCO/OCO work is the right fit. The lateral-move conversation becomes real at Cpl or Sgt when you have enough operational hours to know what you actually want to do for a career.
- Reenlistment vs. EAS after the first contract.The civilian cyber market pays significantly more than E-3/E-4 base pay, and the recruiters start calling before your EAS date. The honest math: if you love the mission and the Marine Corps, reenlist — the 1799 pathway requires a full career. If you are reenlisting because you do not have a plan, that is the wrong reason. The Marines who EAS with a TS/SCI, a Security+, and four years of operational experience walk into $80K-$120K entry-level cyber analyst roles. The Marines who stay are building toward something the civilian market cannot replicate — operational leadership in a domain that most companies only understand in theory.
- Certification prioritization — which certs to pursue beyond the baseline.The baseline (Security+) is mandatory. Beyond that, the intermediate certs (CEH, CySA+, GIAC family) are the next gate — but which one matters less than earning one. Talk to your team lead about what the section values. The Marines who chase the most expensive cert without understanding the mission are spending time and money on a credential that does not match their operational lane.
How the Seat Varies by Unit Type
- MARFORCYBER / Marine Cyberspace Warfare Group element — fixed SCIF, garrison-heavy.The default assignment for most 17XX junior Marines. Fixed SCIF operations at Fort Meade, Quantico, or another established cyber facility. The work is real, the tools are real, the authorities are real — but the daily rhythm is more garrison than expeditionary. PT, watch, chow, liberty. The Marines who thrive here are the ones who treat the watch as seriously as a combat patrol, because in this domain it is.
- MEF Information Group (MIG) element — expeditionary, deploying.The MIG provides cyberspace capabilities to the MEF commander. This means you deploy — on exercises, on MEU support, on real-world missions. The SCIF may be a tent. The network may be expeditionary. The work is the same mission set but the conditions are harder, the hours are longer, and the Marine Corps expects you to be a field Marine who can also run cyber tools. Junior Marines at MIG elements get more field time and more deployment exposure than the garrison MARFORCYBER billet.
- Joint / USCYBERCOM billet — interservice, high-classification.Less common at E-1 through E-3, but some junior Marines land in joint billets supporting USCYBERCOM or NSA missions. The work is higher-classification, the interservice environment is different (you are the only Marine in a room full of Army, Navy, and Air Force operators), and the standards are joint rather than Marine Corps-specific. The professional growth is excellent; the Marine Corps culture is thin.
What Good Looks Like at This Rank
The good junior 17XX Marine is the one the team lead mentions in the team brief as the boot who runs a clean watch. The logs are timestamped, the anomalies are escalated with context, and the classified material is handled like it matters — because it does. This Marine is not flashy. This Marine is not the best coder on the team. This Marine is the one who does the boring, repetitive, high-consequence work the same way every time, and the team lead does not have to check.
The clearance jacket is clean. The baseline cert is done early. The PFT is 1st Class. The MCMAP belt is advancing. The Corporals Course slot is already being discussed. Nobody at this rank calls any Marine a 'future 1799' — but the team lead who has seen twenty boots come through the section can tell the difference between the one who will still be here in ten years and the one who will EAS after the first enlistment. The good boot is building a foundation without knowing exactly what gets built on it.
Preview — The Next Rank
Corporal is where the 1799 pathway starts to mean something beyond aspiration. At Cpl you are a qualified operator carrying individual tasks, and you start training the junior Marines behind you. Corporals Course is the PME gate. The intermediate DoDM 8140 certification — CEH, CySA+, or a GIAC cert — is expected. You write proficiency and conduct marks on PFCs and LCpls, and the quality of those marks is the first real leadership signal the community tracks.
The shift from 'junior Marine who operates tools' to 'junior NCO who leads operators' is the defining transition of the Cpl rank. In the 17XX community, this matters more than it does in high-density MOS fields because the population is small enough that every Cpl is known by name to the section chief. The question the section chief is asking: can this Marine lead a watch team, or only run a watch position? The answer shapes the Sgt cutting score, the assignment slate, and the long-arc conversation about who eventually carries the 1799 designator.
FAQ
1799 E1-E3 — Frequently Asked Questions
Q01What does a E1-E3 1799 (Cyberspace Warfare Chief) actually do?
The 1799 designator does not exist at E-1 through E-3.
Q02What's the most important thing to know as a E1-E3 1799?
The 1799 Cyberspace Warfare Chief designator does not exist at E-1 through E-3.
Q03What does a typical day look like for a E1-E3 1799?
Time-blocked day at the E1-E3 1799 rank tier: 0500 Wake. Check phone for any recall or security notifications — the 17XX community runs 24/7 and a watch-team recall can come at any hour, 0530-0630 PT formation. Company PT — runs, calisthenics, obstacle course rotation, MCMAP days. You fall in with the platoon; the team lead notices whether you are at the front or the back, 0630-0745 Hygiene, chow, change into utilities or the duty uniform for the SCIF. Pre-work phone check — leave the personal device in the car or the lockbox before you badge in, 0800 Badge into the SCIF.…
Q04What mistakes get E1-E3 1799 soldiers fired or relieved?
Bringing a personal electronic device into a SCIF — even accidentally. The security office does not care about your intent; the incident report goes in the file; Discussing anything about your work on social media — even vague references to 'what I do' or 'where I work.' The CI threat to 17XX Marines is not hypothetical; it is an active, ongoing concern; Getting a DUI, drug offense, or any UCMJ action that triggers a clearance review.…
Q05What career decisions matter most at the E1-E3 1799 rank tier?
First enlistment: stay 1721 or explore lateral moves within 17XX — At E-1 through E-3 this is not a real decision yet — you do not have the operational depth to make it intelligently. Focus on the 1721 mission, earn the certifications, and let the first enlistment teach you whether the DCO/OCO work is the right fit. The lateral-move conversation becomes real at Cpl or Sgt when you have enough operational hours to know what you actually want to do for a career; Reenlistment vs. EAS after the first contract — The civilian cyber market pays significantly more than E-3/E-4 base pay,…
Q06What's next after E1-E3 for a 1799 (Cyberspace Warfare Chief) in the Marines?
Corporal is where the 1799 pathway starts to mean something beyond aspiration.
Q07What manuals and regulations does a E1-E3 1799 need to know cold?
NAVMC 3500.44 — Cyberspace Operations Training and Readiness Manual (governs individual training tasks across all 17XX MOS).; DoDD 8500.01 — Cybersecurity (the overarching directive governing everything you touch in the SCIF).; JP 3-12 — Cyberspace Operations (read the unclassified portions to understand the OCO/DCO/DODIN framework).
This playbook has no tips yet. Be the first to share what you know.
Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards