Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to CWT Cyber Warfare Technician — overview, pay, training, civilian translation, reviews
CWTE5

Cyber Warfare Technician

E-5 (Sergeant) · Navy

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

CWT2 (E-5) is the rating's first real petty-officer-of-the-section tier — element lead in fact even when the title is unofficial. The CWT3s call you lead whether the watch bill posts it or not, and the chief is mentoring you toward anchors he expects in two boards. The NWAE for CWT1 is the next gate. The work-role track and NEC stack you committed at CWT3 are maturing, and your eEVAL trait average against peer CWT2s starts to drive the CWT1 board record. The clearance is now a leadership load — you watch your juniors' reporting like your chief watches yours.

The Honest MOS Read
Cyber Warfare Technician Second Class (CWT2, E-5) is the rating's first real petty-officer-of-the-section tier — the working senior operator, the element lead in fact even when the title is unofficial, and the petty officer the CWT3s and CWTSNs read for the standard of the watch. You stopped owning just your seat at CWT3; at CWT2 you own a piece of the team, and the chief above you has already started building the record that puts you in front of the Chief board in two cycles. You run an element on a mission crew — a defensive cyberspace operations element, a network-operations cell, or the work-role group your team certified you to lead — on a Cyber Mission Force team supporting US Cyber Command's Navy component, a Fleet Cyber Command / NAVIFOR detachment, or a joint-duty site. You train and qualification-sign two-to-four CWT3s and CWTSNs. You build the element's training plan. You own the analytic or operational tempo on your seat, and you write the portion of the mission turnover or readiness brief your element owns — in language the team lead and the wardroom will not rewrite. You mentor work-role packets — the next certification up, the more capable seats, the NEC pieces that define a cyber career — and you counsel honestly when a junior is chasing the wrong path. Pull the current source-rating NAVADMIN when you do; the rating's structure is newer and moving, and the worst mentorship you can give is confident advice off a stale chart. The advancement math runs on the Navy Enlisted Advancement System (NEAS) under MILPERSMAN. The NWAE for CWT2 to CWT1 (E-6) runs twice a year, and your FMS combines the exam, your eEVALs (the Navy enlisted evaluation system under the NAVPERS 1610 series), time-in-rate, awards, and education. The exam is built off the current CWT1 BIB — own it. The cutoff is published per NAVADMIN after each cycle and moves with rating manning, so pull the message instead of quoting a cycle. And the eEVAL is now decisive: the trait average and ranking against your peer CWT2s drives the CWT1 board record, your LCPO knows your number before the board reads it, and a flat or generic eEVAL at this tier costs you the slate even when your watch performance is strong. The work-role qualification track is maturing. You are expected to have at least one more capable work role certified and the next in progress, tracked on the LCPO's tickler, and to develop the analytic or operational depth that makes you a senior operator and not just a senior petty officer. The NEC stack you committed at CWT3 matures alongside it; verify the current codes against NAVPERS 18068 and the source-rating NAVADMIN, because the cross-rate and NEC routes for this rating are still being built and the window for some narrows as the CWT1 board record starts to outweigh the time a long pipeline would cost. Navy COOL funds the credential stack the cleared market reads — work-role certs plus the cyber credentials that open more capable seats and read as bench depth to the CWT1 board (verify the current funded list at navycool.navy.mil). The CWT2 who exits the second enlistment with a work-role track, a maintained cert stack, and a clean TS/SCI is structurally positioned for the senior cleared cyber operator and engineer roles the contractor and federal-civilian world competes to fill. The clearance is now a leadership responsibility, and that is the part of CWT2 that catches operators who were fine managing only their own paperwork. You watch your element's reporting and continuous-evaluation status the way your chief watches yours — nobody on your watch loses a seat to a foreign-contact or financial-reporting lapse you could have caught. A junior's neglected paperwork is your readiness gap, and the LCPO reads whether you caught it or let it rot. The cyber chain runs through the chief; integrate with the goat locker, take the hard clearance and discipline conversations early, and never go around the LCPO to the cyber officer — the chiefs talk, and the Chief board reads the pattern three years later.
Career Arc
  • 01CWT2 (E-5) pin-on via NEAS / NWAE cycle.
  • 02Element lead assumption — defensive cyberspace operations element, network-operations cell, or work-role group on a CMF team, Fleet Cyber / NAVIFOR detachment, or joint-duty site.
  • 03Train and qualification-sign two-to-four CWT3s and CWTSNs; build the element's training plan; write the element's portion of the mission turnover and readiness brief.
  • 04Work-role track maturing — a more capable work role certified, the next in progress; senior-operator analytic/operational depth expected, not just senior-petty-officer status.
  • 05NEC sub-specialty maturity; cross-rate and senior-pipeline windows narrowing as the CWT1 board record starts to outweigh the cost of a long pipeline (verify current routes against the source-rating NAVADMIN).
  • 06Navy COOL cert stack matures — work-role certs plus cyber credentials that read as bench depth to the CWT1 board and to the cleared market.
  • 07NWAE for CWT1 (E-6) — twice yearly, FMS / BIB-based, NAVADMIN-published cutoff; eEVAL trait average against peer CWT2s starts to drive the CWT1 board record.
Common Screwups
  • ×DUI / drug pop — separation under MILPERSMAN, clearance revocation, and the cleared cyber market foreclosed for years (reinstatement timelines run multi-year). At CWT2 you are an element lead with more eyes on your liberty habits, not fewer; the fall takes the element, the work-role track, the CWT1 board read, and the clearance simultaneously.
  • ×NJP for fraternization, classified mishandling, controlled-substance, or financial irresponsibility. The CWT2 element lead who lands at captain's mast loses the element, the work-role pipeline, the CWT1 board read, and the post-service clearance in one stroke — there is no quiet recovery in a clearance-gated rating.
  • ×Letting clearance hygiene slide on your element. A junior's late foreign-contact or financial report becomes a security flag, and you are the lead who should have caught it. At CWT2 the clearance is a leadership load; the readiness gap from a junior's neglected paperwork lands on your name.
  • ×Going around the LCPO to the cyber officer or the higher echelon. The cyber chain runs through the chief; the goat locker hears about it the same day, and the Chief board reads the pattern three years later. The CWT2 who never integrates with the goat locker stalls at CWT1 for the wrong reasons.
  • ×Phoning Navy COOL and the BIB at CWT2. The work-role certs and cyber credentials are funded, the cleared market reads the stack directly, and the CWT1 board sees the cert sheet as bench depth. Leaving them on the table costs measurable post-service salary and the next slate's defended narrative.

A Day in the Life

  • 0500-0600Wake — most CWT2s are off-base, married or established. Phone check for overnight watch-chat, element issues, watch-bill changes. Hygiene, PT gear on. As element lead you scan for anything that affects your CWT3s' positions before quarters.
  • 0600-0700Command or section PT on the LCPO's schedule. At element-lead level the juniors run with you and read your standard, so you train the PRT to a Good High, not a bare pass. Cyber is shore-and-watch-floor; PT is a normal command's morning.
  • 0700-0800Chow, uniform of the day, walk to the cyber spaces or the watch floor. Pre-quarters: read the turnover log, check your element's overnight activity and any open items, review status feeds, confirm your CWT3s' position assignments. Phones into the bin before the SCIF.
  • 0800-0830Quarters. The LCPO puts out plan-of-the-day; the cyber officer or department head briefs what is driving the day. As CWT2 you take the element's tasking, brief your CWT3s on the day's positions and priorities after quarters, and flag any coverage or qualification gap to the LPO.
  • 0830-1130Run the element — manage the position rotation, own the analytic or operational tempo on your seat, escalate and back-stop your CWT3s, and keep your own hands in the work so your technical edge stays sharp. Qualification-sign a CWT3 or CWTSN on a line item they can demonstrate cold between tasks.
  • 1130-1230Chow with the CWT2s and the CWT1s; you eat closer to the LPO and the goat locker now than you did at CWT3. Quick check of the watch chat and afternoon changes. Mission stays in the space, and you are the one who corrects a junior who forgets it.
  • 1230-1500Afternoon block — run a section-level training lane for your element (work-role drill, after-action review of a recent event, OPSEC and security-incident-reporting brief), work your CWT1 BIB / cert study, and handle the element's administrative load: eEVAL inputs on your juniors, qualification tracking, and the clearance-deadline tickler for your people.
  • 1500-1600CWT1 BIB / work-role cert study block, and element-lead admin. The next work-role cert and the CWT1 BIB both feed the board record the chief is building — Navy COOL funds the voucher. Pace the current cycle's bibliography; do not let the day's tasking eat the study.
  • 1600-1630End-of-watch turnover. Walk the on-coming watch through the element's positions — open items, ongoing activity, pending escalations, any coverage note for the next shift. As element lead your turnover sets the standard the CWT3s copy; it does not get reworked.
  • 1630-1800Released, most days at a shore command. Watch rotations, real-world tempo, joint-site surge, and higher-echelon assessments reshape this window. PRT prep, gym, study, family time — and the after-hours text from a junior with a clearance question that cannot wait.
  • 1800-2100Personal time. Family time for the married CWT2, the spouse's questions about why the watch bill changed again. Mission stays in the SCIF — and you are now the standard the whole element follows on OPSEC, online and off. The lead who is careless after hours cannot enforce the standard on watch.
  • 2100-2200Study-log maintenance, eEVAL input drafting, a look at where each of your juniors needs help tomorrow, and the next day's element plan. The LCPO who texts at 2130 about the element's readiness expects an answer from the lead who owns it.
  • Standing watch (cyber watch-floor rotation, joint-site watch bill, real-world tempo)Run the element as the senior operator on shift — incident triage, escalation to the team lead correct and on time, position coverage, and clean handoff to the on-coming watch without the chief rewriting your turnover. On a real-world event you own your element's portion of the response and the after-action.
  • Higher-echelon assessment / inspectionWhen the higher echelon walks the floor, your element has to brief itself — qualification current, 8140 compliance clean, coverage at or above team average, documentation defensible. The CWT2 who keeps his element audit-ready every day owns the assessment; the one who scrambles is the one whose finding lands on his CWT1 board record.

Weekly Cadence

The Mon-Fri rhythm at CWT2 runs on the LCPO sync and the department head sync, not on the CWT3 watch rotation you used to run. Monday is heaviest on planning — the LCPO comes out of the department head sync with the week's training plan, the element rotation, the qualification and PQS targets, the readiness or assessment milestone the cyber officer is driving, and the eEVAL cycle if the period is closing. As element lead your Monday is your own element's training plan, the section-LPO-level sync where you align with the other leads across the team, and the qualification, cert, and eEVAL inputs the LCPO needs from your element. Tuesday through Thursday are the working core. The watch runs at the team's tempo and you run your element through it — owning the analytic or operational seat, back-stopping your CWT3s, qualification-signing on the LCPO's timeline, and keeping your own technical edge sharp so you stay a credible operator. Section training falls on the days the LCPO and cyber officer blocked, and as a lead you may run an element-level lane one day and brief a team-level update another — the LCPO reads whether you teach to the current work-role standard and the current incident-handling doctrine or to personal preference. The after-action on any real event your element worked lands in this window, and so does the steady administrative load of eEVAL inputs, qualification tracking, and the clearance-deadline tickler for your people. Friday is plan-of-the-week-out for the next week. The LCPO publishes the next week's element rotation; the department head sync confirms the next week's training and assessment calendar; the leads align at section sync; and the LCPO walks the floor for the weekly readiness look. As CWT2 you bring your element's qualification and coverage numbers, your CWT1 BIB and cert study log, your juniors' clearance and continuous-evaluation status, and any gap that needs the LCPO's call before next week. Real-world tempo, joint-site surge periods, and higher-echelon readiness assessments collapse the Mon-Fri rhythm entirely — your element operates to the event calendar, training and study time get crammed into the off-windows, and the lead whose qualification, coverage, or clearance tracking drifted is the one exposed when the assessment hits.

Key Skills — How to Drill Each

  1. 01
    Lead an element on a mission crew — task management, triage escalation, clean handoff to the team lead without the chief rewriting your turnover.
    Own the element's tempo: assign the positions, manage the triage flow, escalate correct and on time, and turn over so complete the team lead never reworks it. Lead from the standard, not the rank — the CWT3s read whether you hold the line on a quiet watch the same as a busy one. The CWT2 whose element's turnovers are clean and whose escalations come right is the one the LCPO names when the cyber officer asks who is running the hard watch; the one who lets the element drift is the one the chief has to babysit.
  2. 02
    Brief your element's portion of a readiness or mission update — qualification status, position coverage, analytic findings, risk — in language the team lead and the wardroom will not rewrite.
    Know your element's numbers cold — who is certified on what, where the coverage gaps are, what the analytic found, what the risk is — and present them with the closure plan attached, not just the problem. Practice briefing tight and honest; the CWT2 who owns the gap and presents the fix is the one the team lead trusts to brief up, and the one whose words the wardroom repeats without rewording. The lead who hides a gap until the assessor finds it is the one whose CWT1 board record feels it permanently.
  3. 03
    Develop the analytic or operational depth a more capable work role requires, and certify on it, so the team has a senior operator and not just a senior petty officer.
    Push your technical depth past element-lead administration into real senior-operator capability — certify on the more capable work role, keep your hands in the analytic or operational work, and stay current as the tooling and the threat move every quarter. The CWT2 who becomes a pure manager and lets his technical edge dull is the one the CWT3s out-skill and the team lead stops trusting on the hard problem; the one who leads the element and remains a credible operator is the one the rating grooms toward Chief and the cleared market pays a premium for.
  4. 04
    Onboard a new CWT3 or CWTSN and have them qualified and productive faster than the pipeline alone would manage — clearance and OPSEC discipline first, tools second.
    Build a real onboarding plan, not ad-hoc shadowing: drill the clearance and OPSEC habits first, then the PQS and tool quals on a timeline the LCPO can see. Qualification-sign only what they can demonstrate cold, and counsel the ones who are drifting before the LPO has to. The CWT2 whose juniors come up clean, qualified, and squared away on security is the one the LCPO reads as a future LPO; the one whose bench is shaky is the one whose element coverage breaks under him.
  5. 05
    Write a clean, defensible after-action on a real event your element worked — timeline, what was seen, what was done, what to fix — to the standard the higher echelon expects.
    Write the after-action the way the higher echelon will read it: a clear timeline, what was seen, what was done, and the honest list of what to fix — including the parts that did not go well. The element that skips the after-action because 'we handled it' repeats the same gap on the next event, and your element is the one named in the higher-echelon report. The CWT2 whose after-actions are tight and honest is the one whose element gets better every cycle; the one who buries the lessons is the one who relearns them the hard way.
  6. 06
    Watch your juniors' clearance and continuous-evaluation status as part of your leadership load.
    Track your element's reporting and reinvestigation deadlines the way your chief tracks yours — know whose foreign-contact report is due, whose finances are under strain, whose reinvestigation is coming, and get ahead of it before the continuous-evaluation system flags it. Take the awkward conversation early; a disclosed problem is survivable and a junior kept on a seat is readiness retained. The CWT2 who lets a junior's paperwork lapse loses a seat to a preventable flag, and the LCPO reads it as a leadership miss, not a junior's mistake.

Manuals & References — What Chapters Matter

  • DoDM 8140.03 — Cyberspace Workforce Qualification.
    The work-role chart you now sign your CWT3s and CWTSNs against, not just the one your own certs are checked against. Know it well enough to build your element's qualification plan off it and to defend your coverage at the readiness brief. Pull the current edition; the framework is actively revised, and the lead who plans off a stale chart signs a junior onto a seat the audit finds.
  • SECNAVINST 5239 series and the current OPNAV Navy cybersecurity program instruction.
    The Department of the Navy and Navy-specific cybersecurity / IA framework your element operates inside — current versions only. As element lead you are expected to know the operator-responsibility and incident-reporting sections well enough to enforce them on your watch, not just follow them. Pull from the Navy Doctrine Library, not the team's stale share.
  • US Cyber Command Cyber Mission Force work-role qualification standards.
    The joint framework you now mentor packets against — you are guiding CWT3s through the qualification track you came up, so you have to know the current edition cold. Verify it; the rating and its quals are still maturing, and the work-role names and gates shift between cycles, so the route you took may not be the route your junior takes.
  • NIST SP 800-61 — Computer Security Incident Handling Guide.
    The incident-response playbook the cyber force maps to — the structure under how your element triages, escalates, and writes up a real event. As the lead who owns the after-action, know the IR lifecycle well enough that your element's response and documentation map to it cleanly, because the higher echelon reads your after-action against this standard.
  • NAVPERS 18068 series plus the current NEC source-rating NAVADMIN.
    You mentor career packets off this now, not the version on the share from two years ago. Read the cyber NEC entries and pull the current source-rating NAVADMIN before you advise a junior, because the codes and pipelines are still moving — the worst mentorship is confident advice off a stale chart that sends a CWT3 chasing a code that no longer exists.
  • The current NWAE Bibliography for Advancement (BIB) for CWT1.
    Own it — the BIB is the test. Keep your Enlisted Advancement Worksheet (EAW) clean and your study log defensible, and pace the current cycle's bibliography across the year. At CWT2 the eEVAL drives the board record alongside the exam, so do not let BIB study eat the on-watch performance that earns the eEVAL — both have to be there for the FMS to clear the CWT1 cutoff.

Standards — How to Hit Each

  • Advancing through the DoD 8140 work-role qualification track — at least one capable work role certified and maintained, the next one in progress, tracked on the LCPO's tickler.
    Earn and maintain the more capable work-role cert, bank the continuing-education credits, and have the next one in progress on a timeline the LCPO can see. Navy COOL funds it. The CWT2 who keeps advancing the track is the senior operator the team grooms toward Chief; the one who stopped certifying after CWT3 is the senior petty officer the CWT3s out-skill, and the CWT1 board reads the stall.
  • Element qualification, position-coverage, and readiness numbers at or above the team average, every cycle, no caveats.
    Build and run the element's training plan so coverage stays at or above the team average without short-handed shortcuts — never sign a junior onto a seat the qual does not support to plug a hole. Track the numbers yourself and brief them honestly. The CWT2 whose element numbers brief without caveat is the one the LCPO names for the hard watch; the one who caveats his coverage every cycle is the one the chief stops trusting with an element.
  • NWAE for CWT1 prep on the LCPO's timeline; eEVAL trait average and ranking that supports an EP / MP recommendation.
    Pull the current CWT1 BIB, work a documented study log, and pace it across the cycle. Give your eEVAL input early and make it action-result-impact, tracking your accomplishments all cycle so the narrative writes itself. Your LCPO knows your number before the eEVAL board reads it — the CWT2 who earns the early-promote or must-promote read is the one whose watch performance and bench-building gave the chief something to rank high. A flat eEVAL at CWT2 costs the slate even with a passing exam.
  • PRT Good High or better; BCA in standard.
    Train the PRT cycle under OPNAVINST 6110.1 to a Good High, not a bare pass — at element-lead level the juniors run with you and read your standard. Base mileage, the strength and core events, BCA discipline through chow and the gym. The lead who falls out of the run loses standing he needs to lead, and the LCPO does not write an EP eEVAL on an operator who cannot pass his own PRT.
  • Your element's clearance and continuous-evaluation status clean across the board — no junior parked off a seat for a reporting lapse.
    Track your element's reporting and reinvestigation deadlines on your own tickler, take the awkward conversation early, and get ahead of the continuous-evaluation flags before they cost a seat. A disclosed problem is survivable; a surprise flag is a covered seat lost and a readiness gap with your name on it. The CWT2 whose element's clearance status never surprises anyone is the one the LCPO can put on any mission; the one whose junior loses a seat to a preventable lapse owns the readiness miss.

Technical Mistakes — Concrete Consequences

  • Letting a CWT3 sit a position they are not certified on because you are short-handed.
    The DoDM 8140 audit catches it and the finding is on you, the lead who signed or allowed it, not on the junior. Short manning is real and constant in a growing rating, but the unauthorized seat is a reportable compliance failure that reads against your element's readiness and your CWT1 board record. The fix is to brief the coverage gap honestly and let the team lead make the manning call — never to plug the hole with an uncertified operator and hope the audit misses it.
  • Skipping the after-action on a real event because 'we handled it.'
    The next event repeats the same gap and your element is the one named in the higher-echelon report. The after-action is where the element gets better; the lead who buries the lessons because the event ended well is the one who relearns them on the next event with the higher echelon watching. At CWT2 the after-action is your deliverable, and the team lead reads whether you wrote the honest one or the one that protects your element's pride.
  • Bypassing the LCPO to talk to the cyber officer or the higher echelon directly.
    The cyber chain runs through the chief, and the goat locker hears about it the same day. The CWT2 who routes around the LCPO — even with good intentions — reads as an operator who does not understand the chain, and the Chief board sees the pattern three years later. Take it to your chief first; the rare time the chain is genuinely broken, the chief is still the first call, not the cyber officer's open door.
  • Treating an authorization or change request informally — no record, no proper approval.
    On a mission network the unrecorded action is the one that becomes an incident with no paper to defend either you or the operator who did it. As element lead you set whether changes go through the proper authorization and documentation or get handled on a handshake; the handshake version is the one that surfaces in the investigation with no record to show the action was approved. Enforce the paper trail on your element — it protects the mission and it protects your people.
  • Letting clearance hygiene slide on your element.
    A junior's late foreign-contact or financial report becomes a security flag, and you are the lead who should have caught it. At CWT2 your juniors' clearance status is your leadership load — the lapse you could have caught with an early conversation becomes a seat your element cannot cover and a readiness gap with your name on it. The LCPO reads a junior's preventable clearance flag as a CWT2 leadership miss, not a junior mistake, and the CWT1 board reads the gap.

Career Decisions at This Rank

  • Cross-rate to a sister cyber path versus stay CWT — the window is narrowing
    If your endgame is a different lane of the cyber fight than CWT delivers, CWT2 is roughly the last comfortable window to move, because the time a cross-rate or long sister-pipeline costs cuts straight into the CWT1 board record the chief is building. The math is the same as the legacy CTN-to-CWT calculus in reverse: the move is viable for the CWT2 whose career endgame genuinely requires the other path, and expensive for the one chasing a lateral that does not change the destination. Pull the current source-rating NAVADMIN and the accession messages before you commit — the routes for this newer rating are still being built, and you do not want to bank a packet on a path that closed last cycle. Talk to your chief first; this is a goat-locker conversation, not a self-service decision.
  • Commit hard to the CWT1 board record versus coast on element-lead competence
    Competent element leadership gets you a defensible CWT2; it does not get you the early-promote eEVAL that clears a moving CWT1 cutoff. The CWT2 who commits to the board record gives his eEVAL input early, tracks action-result-impact accomplishments all cycle, certifies the next work role, and gives the chief something to rank high — and his LCPO knows his number before the board reads it. The one who coasts on being good at the daily job writes generic cyber filler and gets a flat record, then wonders why a strong operator did not make the slate. At CWT2 the eEVAL is decisive; decide now to make every cycle's record real, because there is no recovery within a board cycle.
  • Stay a credible operator versus drift into pure management
    The trap at CWT2 is becoming a good administrator who let his technical edge dull — the lead the CWT3s quietly out-skill and the team lead stops trusting on the hard problem. The rating grooms the CWT2 who leads the element AND remains a credible senior operator: certified on the more capable work role, hands still in the analytic or operational work, current as the tooling and threat move every quarter. That CWT2 is the one the LCPO names for the hard watch and the cleared market pays a premium for. Budget the time to stay sharp; the management load will expand to fill every hour you give it if you let it.
  • Second-term reenlistment with NEC SRB versus the senior cleared-operator offer
    The second-term reenlistment window opens in this tier, and the cyber community has historically had access to meaningful NEC-tied SRB amounts because the retention math runs against a civilian cleared market that competes hard for the bench — but verify the current SRB NAVADMIN for the zone, NEC tier, and amount, because they change year over year. The CWT2 who exits with a matured work-role track, a maintained cert stack, and a clean TS/SCI is structurally positioned for senior cleared-operator and engineer roles the contractor and federal-civilian world competes to fill. Run the SRB against the obligation length, your work-role and NEC timing, the Chief track you would be giving up or keeping, and what the door is actually worth — and do not let either side rush a six-year decision.
  • Integrate with the goat locker now versus stay heads-down on the element
    The Chief board is no longer abstract at CWT2, and how you carry yourself with the goat locker matters as much as your watch performance. The CWT2 who integrates — takes mentorship from the chiefs, runs the hard clearance and discipline conversations through the LCPO, and never routes around the chain — is the one the mess starts to read as a future Chief. The one who stays heads-down on his element and treats the goat locker as separate from his job stalls at CWT1 for reasons that have nothing to do with his technical depth. The chiefs talk; the board reads the pattern three years out. Start building that relationship now, on purpose, the right way.

How the Seat Varies by Unit Type

  • Cyber Mission Force team (US Cyber Command's Navy component)
    As element lead on a CMF crew you run a work-role group executing under the joint Cyber Mission Force structure — the tightest qualification track and the most mission-driven tempo in the rating. The element-lead load is real here: coverage against the joint work-role requirements, after-actions the higher echelon reads, and clearance posture at its strictest. Verify the current team structure and work-role names; this is where the rating is moving fastest and where a stale chart hurts your mentorship most.
  • Fleet Cyber Command / NAVIFOR detachment
    Element lead on the Navy's own cyber and information-warfare enterprise under Fleet Cyber Command / Tenth Fleet and Naval Information Forces — running defensive and network-operations elements that protect and enable the fleet. Broader Navy-specific exposure than a CMF crew, often with a deeper bench of CTN-legacy seniors and chiefs to learn the leadership trade from. The shore-and-watch-floor rhythm gives you more room to build a deliberate training plan for your element.
  • Joint-duty cyber site / Cryptologic Warfare Activity
    Element lead in a joint or cryptologic-warfare environment, working alongside the other services and the broader cyber-and-intelligence enterprise. The strictest clearance environment and the most specialized work — and a CWT2 here learns to lead an element inside a joint framework, which reads strongly to both the Chief board and the cleared market later. The challenge is that the joint structure can make your Navy-specific advancement and goat-locker integration take more deliberate effort.
  • Defensive element versus network-operations cell versus specialized work-role group
    What you lead at CWT2 shapes the leadership and the technical depth you build. A defensive operations element is triage, analysis, and escalation tempo; a network-operations cell is infrastructure and engineering depth; a specialized work-role group is narrower and deeper. Your after-actions, your training plan, and the kind of senior operator you become differ materially — and the post-service profile each one builds is different, which is why staying a credible operator in your specific work role matters as much as the element-lead title.
  • Manning-rich element versus short-handed element
    The rating is still growing, so manning swings hard, and at CWT2 the manning of your element is your problem to manage. A manning-rich element lets you build a deliberate qualification track, run real training lanes, and keep coverage at or above team average cleanly. A short-handed element tempts the short-handed shortcut — signing a CWT3 onto a seat the qual does not support to plug a hole — which is exactly the compliance failure the audit finds with your name on it. On a short element, brief the gap honestly and let the team lead make the manning call; never plug it with an unauthorized seat.

What Good Looks Like at This Rank

The good CWT2 is the petty officer the LCPO names when the cyber officer asks who is running the element on the hard watch. His element's qualification and coverage numbers brief without caveat, his CWT3 has a work-role packet on the table, and his eEVAL bullets read action-result-impact instead of generic cyber filler. He sits the CWT1 NWAE on a study log the chief can defend, and his element's clearance status never surprises anyone. He leads from the standard, holds the line on a quiet watch the same as a busy one, and turns over so clean the team lead never reworks it. He stays a credible operator, not just a manager. He certified on the more capable work role and keeps his hands in the analytic or operational work, so the CWT3s do not out-skill him and the team lead still trusts him on the hard problem. His after-actions are tight and honest — the timeline, what was seen, what was done, and the real list of what to fix — so his element gets measurably better every cycle. He briefs his element's readiness with the closure plan attached, owns the gaps instead of hiding them, and the wardroom repeats his words without rewording them. The good CWT2 carries the clearance as a leadership load. He tracks his element's reporting and reinvestigation deadlines on his own tickler, takes the awkward conversation early, and never loses a seat to a paperwork lapse he could have caught — because in this rating a junior's neglected report is the lead's readiness gap. He integrates with the goat locker instead of going around it; the chiefs know his name for the right reasons, and his record is being built across the year for a Chief board that is no longer abstract. He mentors his CWT3's work-role and NEC packet off the current source-rating NAVADMIN, not stale advice, and he counsels honestly when a path is wrong for the Sailor. And he knows that a clean TS/SCI plus a matured work-role track plus the cert stack is one of the strongest enlisted exits the Navy produces — so whether he stays for the anchors or takes the senior cleared-operator offer the contractor world competes to make, he is building the record that pays either way.

Preview — The Next Rank

CWT1 (E-6) is where you become the LPO — the senior enlisted operator who runs the operators and a slice of the team's mission readiness, with the chief editing your Chief packet and the cyber officer calling you by name. The element you ran at CWT2 was a piece of the team; at CWT1 you own the division-level picture. The CWT2s and CWT3s watch how you carry the division the way you used to watch your chief, and the Chief board conversation that was abstract at CWT2 becomes the thing your record is being built around every cycle. You write four-to-six eEVALs per cycle for CWT2s and CWT3s that pick the next NWAE slate — the ranking power moves to you, and so does the responsibility to get it right. You build the division's training and qualification plan, defend the team's manning-and-readiness picture against the work-role requirements, manage DoD 8140 compliance at the division level, and own the clearance posture so the team is never short a qualified operator because a clearance lapsed on your watch. You mentor at least one Sailor a year into the next accession — a Cyber Warrant Officer path, a commissioning program, or the senior work-role and NEC pipelines — and you do it off the current accession messages, because the rating's pipelines are still being built out and the route changed since you came up. The load is more leadership and less keyboard, but the rating does not let you stop being technical — the threat and the tooling move every quarter, and the LPO who stopped reading is the one whose division falls behind. The CWT1 the LCPO trusts to run the division for a week without daily check-ins is the one whose readiness and compliance numbers brief without caveat, whose eEVALs pick operators above expectation, whose pipeline produces Warrant and commissioning packets the team signs without rewriting, and whose division never goes short a qualified operator because a clearance was neglected. Build toward it now: lead your element clean, stay a credible operator, integrate with the goat locker, and start watching how your chief runs the division, because that is the seat you are about to inherit.
FAQ

CWT E5 — Frequently Asked Questions

Q01What does a E5 CWT (Cyber Warfare Technician) actually do?
You run an element on a mission crew — a defensive cyberspace operations element, a network-operations cell, or the work-role group your team certified you to lead — on a Cyber Mission Force team, a Fleet Cyber Command / NAVIFOR detachment, or a joint-duty site supporting US Cyber Command.
Q02What's the most important thing to know as a E5 CWT?
CWT2 (E-5) is the rating's first real petty-officer-of-the-section tier — element lead in fact even when the title is unofficial.
Q03What does a typical day look like for a E5 CWT?
Time-blocked day at the E5 CWT rank tier: 0500-0600 Wake — most CWT2s are off-base, married or established. Phone check for overnight watch-chat, element issues, watch-bill changes. Hygiene, PT gear on. As element lead you scan for anything that affects your CWT3s' positions before quarters, 0600-0700 Command or section PT on the LCPO's schedule. At element-lead level the juniors run with you and read your standard, so you train the PRT to a Good High, not a bare pass. Cyber is shore-and-watch-floor; PT is a normal command's morning, 0700-0800 Chow, uniform of the day,…
Q04What mistakes get E5 CWT soldiers fired or relieved?
DUI / drug pop — separation under MILPERSMAN, clearance revocation, and the cleared cyber market foreclosed for years (reinstatement timelines run multi-year). At CWT2 you are an element lead with more eyes on your liberty habits, not fewer; the fall takes the element, the work-role track, the CWT1 board read, and the clearance simultaneously; NJP for fraternization, classified mishandling, controlled-substance, or financial irresponsibility.…
Q05What career decisions matter most at the E5 CWT rank tier?
Cross-rate to a sister cyber path versus stay CWT — the window is narrowing — If your endgame is a different lane of the cyber fight than CWT delivers, CWT2 is roughly the last comfortable window to move, because the time a cross-rate or long sister-pipeline costs cuts straight into the CWT1 board record the chief is building. The math is the same as the legacy CTN-to-CWT calculus in reverse: the move is viable for the CWT2 whose career endgame genuinely requires the other path, and expensive for the one chasing a lateral that does not change the destination.…
Q06What's next after E5 for a CWT (Cyber Warfare Technician) in the Navy?
CWT1 (E-6) is where you become the LPO — the senior enlisted operator who runs the operators and a slice of the team's mission readiness, with the chief editing your Chief packet and the cyber officer calling you by name.
Q07What manuals and regulations does a E5 CWT need to know cold?
DoDM 8140.03 — Cyberspace Workforce Qualification (the work-role chart you sign your CWT3s and CWTSNs against).; SECNAVINST 5239 series; the current OPNAV Navy cybersecurity program instruction — current versions only.; US Cyber Command Cyber Mission Force work-role qualification standards — the joint framework you mentor packets against (verify the current edition).

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards