UPDATE TO FY22 MOS MANUAL FOR THE 17XX OCCUPATIONAL FIELD
Date Signed: 8/3/2021 | MARADMINS Number: 399/21
MARADMINS : 399/21

R 031734Z AUG 21
MARADMIN 399/21
MSGID/GENADMIN/CMC WASHINGTON DC I//
SUBJ/UPDATE TO FY22 MOS MANUAL FOR THE 17XX OCCUPATIONAL FIELD//
REF/A/NAVMC 1200.1G/MILITARY OCCUPATIONAL SPECIALTIES MANUAL//
NARR/REF A IS THE FY22 MOS MANUAL.//
POC/K. C. POTTER/CIV/TECOM/EMAIL: KENNETH.POTTER@USMC.MIL//
POC/A. F. CALLANAN/MAJ/IMD/EMAIL: AFCALLA@NSA.GOV//
GENTEXT/REMARKS/1.  Background:  The Deputy Commandant for Information (DC I) conducted a Cyber Occupational Field (OccFld) Operational Planning Team to evaluate the force generation process and challenges associated with creating a professional cyber workforce.  As a result of the analysis, the working group realigned skillsets and Military Occupational Specialty (MOS) structure to streamline the force generation process and improve the sustainability of the cyberspace workforce.  The new MOS structure will be updated in Reference (A) and will include the deletion of the 1711 Primary Military Occupational Specialty (PMOS), the updating of the 1721 PMOS, and the creation of the 1712, 1713, 1722, and 1723 Necessary MOSs (NMOS).  The following changes are approved in coordination with Training and Education Command (TECOM).
2.  The 1711 PMOS entry and all mentions of the 1711 PMOS will be deleted from Reference (A).
3.  The 1721 PMOS will be updated to reflect the changes as outlined in paragraphs 3.a-3.b.
3.a.  MOS Title.  MOS 1721, Cyber Warfare Operator (GySgt – LCpl) PMOS, DC I
3.b.  Summary.  The Cyberspace Warfare Operator is familiar with all aspects of maneuver operations.  They employ offensive and defensive cyber tools, tactics, techniques, and procedures.  They integrate effects into warfighting functions in order to support tactical, operational, and strategic objectives.  The Cyber Warfare Operator further provides the means to emulate tactics, techniques, and procedures used by known adversaries to identify unmitigated vulnerabilities through simulated exploitation or attacks on Department of Defense information systems.  Familiar with digital network concepts and analytical techniques that support tactical cyber operations.  Utilizing these skills to enumerate friendly environments, these operators search for and respond to targeted adversary presence within USMC cyber enabled capabilities.
4.  The 1712 NMOS will be created as outlined in paragraphs 4.a-4.g. 
4.a.  MOS Title. MOS 1712, Interactive On-Net Operator (MGySgt to LCpl) NMOS (1721, 1799, 2629, 2651, 2659), DC I
4.b.  Summary.  This NMOS requires advanced cyber operations training.  Interactive On-Net Operators are involved in all facets of planning and conducting cyber operations.  Operators must be experts with computer hardware and software programs to include network operating systems.  The duties for MOS 1712 encompass cyber operations and information operations planning support to develop situational awareness within the cyber environment.  Interactive On-Net Operators are technical experts in defensive and offensive cyber operations.  The duties for MOS 1712 increase with experience in multiple disciplines to encompass developing new techniques and methods, technical leadership, running cyber projects, and serving as the subject matter expert for tools, techniques and procedures.
4.c.  Prerequisites.
(1) Must be currently assigned the PMOS of 1721, 2611, 1799, 2629, 2651, or 2659.
4.d.  Requirements.
(1) Complete training and certification standards as determined by the National Security Agency or United States Cyber Command.
(2) MOS 1712 assigned upon approval of the Director, Information Maneuver Division.
4.e.  Duties. For a complete listing of duties and tasks, refer to NAVMC 3500.124, Cyberspace Training and Readiness Manual.
4.f.  Related Standard Occupational Classification (SOC) Title and Code. No civilian equivalent.
4.g.  Related Military Skill.
(1) Offensive Cyberspace Warfare Officer, 1710.
(2) Cyberspace Warfare Operator, 1721.
5.  The 1713 NMOS will be created as outlined in paragraphs 5.a-5.g.
5.a.  MOS Title. MOS 1713, Exploitation Analyst (MGySgt to LCpl) NMOS (1721, 1799, 2629), DC I
5.b.  Summary.  This NMOS requires advanced cyber analytical training.  Exploitation Analysts are the primary planners of cyber operations.  Analysts must be experts with adversary systems, networks, technologies, tools, techniques, and procedures.  The duties for MOS 1713 encompass converting intelligence to operational planning, developing significant target awareness, and balancing levels of risk against operational goals.  Analysts are technical experts on planning cyber operations.  The duties for MOS 1713 increase with experience to encompass managing additional projects and targets, developing new techniques and procedures for offensive cyber operations.
5.c.  Prerequisites.
(1) Must be currently assigned the PMOS of 1721, 1799, or 2629.
5.d.  Requirements.
(1) Complete training and certification standards as determined by the National Security Agency or United States Cyber Command.
(2) MOS 1713 assigned upon approval of the Director, Information Maneuver Division.
5.e.  Duties.  For a complete listing of duties and tasks, refer to NAVMC 3500.124, Cyberspace Training and Readiness Manual.
5.f.  Related Standard Occupational Classification (SOC) Title and Code. No civilian equivalent.
5.g.  Related Military Skill.
(1) Offensive Cyberspace Warfare Officer, 1710.
(2) Cyberspace Warfare Operator, 1721.
6.  The 1722 NMOS will be created as outlined in paragraphs 6.a-6.g. 
6.a.  MOS Title.  MOS 1722, Host Analyst (MGySgt to LCpl) NMOS (1721, 1799), DC I
6.b.  Summary.  This NMOS will be granted upon meeting the United States Cyber Command training and certification standards for the Senior certification level in this work role.  The 1722 NMOS requires knowledge of Windows services, security, and various system configurations encountered.  This work role performs individual memory process analysis using built-in tools and capabilities.  The 1722 NMOS possesses advanced knowledge of Unix/Linux services and their security and configuration.  The Host Analyst also requires advanced knowledge of file systems, permissions, and operation system configurations.  The 1722 NMOS is responsible for capturing the memory of individual processes and analyzing it using built-in tools and capabilities.
6.c.  Prerequisites.
(1) Must be currently assigned the PMOS of 1721 or 1799.
6.d.  Requirements.
(1) Complete training and certification standards as determined by United States Cyber Command.
(2) MOS 1722 assigned upon approval of the Director, Information Maneuver Division.
6.e.  Duties.  For a complete listing of duties and tasks, refer to NAVMC 3500.124, Cyberspace Training and Readiness Manual.
6.f.  Related Standard Occupational Classification (SOC) Title and Code. No civilian equivalent.
6.g.  Related Military Skill.
(1) Defensive Cyberspace Weapons Officer, 1720.
(2) Cyberspace Warfare Operator, 1721.
7.  The 1723 NMOS will be created as outlined in paragraphs 7.a-7.g. 
7.a.  MOS Title.  MOS 1723, Network Analyst (MGySgt to LCpl) NMOS (1721, 1799), DC I
7.b.  Summary.  This NMOS will be granted upon meeting the United States Cyber Command training and certification standards for the Senior certification level in this work role.  The 1723 NMOS is responsible for providing analytic expertise in network traffic.  They will understand network traffic signatures and discover anomalies through net flows and PCAP analysis.  The Network Analyst will identify, assess, and mitigate intrusions into networks that are vital to DODINs security and will conduct packet capturing.  The duties for MOS 1723 encompass analyzing full packet captures using GUI or command-line based tools, assisting in developing network topology mapping, developing network-based signatures, developing advanced network detection rules and alerts, and developing highly-tailored queries and dashboards in order gain a holistic view of the network.  The Network Analyst identifies Enterprise network flow in order to identify anomalous traffic, utilizes scripting languages to parse collected data for analysis, and develops signatures to redirect specific traffic, as desired.
7.c.  Prerequisites.
(1) Must be currently assigned the PMOS of 1721 or 1799.
7.d.  Requirements.
(1) Complete training and certification standards as determined by United States Cyber Command.
(2) MOS 1722 assigned upon approval of the Director, Information Maneuver Division.
7.e.  Duties.  For a complete listing of duties and tasks, refer to NAVMC 3500.124, Cyberspace Training and Readiness Manual.
7.f.  Related Standard Occupational Classification (SOC) Title and Code.  No civilian equivalent.
7.g.  Related Military Skill.
(1) Defensive Cyberspace Weapons Officer, 1720.
(2) Cyberspace Warfare Operator, 1721.
8.  This MARADMIN is applicable to the Marine Corps Total Force.
9.  Release authorized by Lieutenant General M. G. Glavy, Headquarters Marine Corps, Deputy Commandant for Information.//