Defensive Cyberspace Operator

Air Force Civilian Service; San Antonio (TX); On-site; USD 133,000 - 181,000; Full time

Benefits offered by this job

Relocation incentives

Job summary

Air Force Civilian Service (AFCS) seeks a Defensive Cyberspace Operator to support the U.S. Cyber National Mission Force. The role is based at Joint Base San Antonio–Lackland, Texas, with a competitive base salary and potential relocation incentives.

Candidates must be a U.S. citizen and able to obtain a Top Secret/SCI clearance. The position involves training and deployment for national security missions, including HUNT, CLEAR and HARDEN defensive cyber operations.

Qualifications

• Must have Top Secret clearance or SCI eligibility and Information Assurance certification.
• U.S. citizenship required and ability to obtain/maintain security clearances.
• Experience with defensive cyber operations and national security mission teams.

Responsibilities

• Conduct defensive cyberspace operations including hunting for adversaries, analyzing threats and hardening systems.
• Train, exercise, and certify cyber protection team members as part of CNMF missions.
• Support National Mission Force defensive cyber operations for combatant commands.

Skills

Top Secret clearance

SCI clearance

Information Assurance

Cybersecurity

Threat analysis

Network defense

Tools

UNIX

Windows

Job description

Advance the Mission with Us—AFCS Intelligence Careers Need Talent Ready to Expand Innovation and Strengthen National Security!

The Air Force Civilian Service (AFCS) is looking for a full time Defensive Cyberspace Operator, GG-2210-13 in San Antonio,, Texas at Joint Base San Antonio- Lackland Air Force Base.

Base Salary Range : $132,751 to $181,428

Relocation incentives may be available

Must Have Requirements Or May Not Be Considered

The work may require the employee to drive a motor vehicle. A valid driver’s license is required for the position.

Depending on the type of position (competitive/excepted) you are selected for; you will be required to serve a 1-year probationary period OR 2-year trial period. Upon completion of your probationary/trial period, your employment will be terminated unless you receive certification, in writing, that your continued employment advances the public interest.

(NOTE: Typically, the 1-year probationary period is for Competitive Jobs, and 2-year trail period is for Excepted Jobs.)

This position is a Defense Civilian Intelligence Personnel System (DCIPS) position aligned under authorities of Section 1601, Chapter 83 of Title 10, United States Code and DoD Instruction 1400.25-V3007.

Qualifications/Requirements

The U.S. Air Force 867th Cyber Operations Group is seeking highly motivated cybersecurity host and network analysts to serve on USCYBERCOM Cyber National Mission Force (CNMF) National Cyberspace Protection Team (N-CPT) mission elements, conducting HUNT, CLEAR and HARDEN defensive cyber operations on specified key cyber terrain to counter adversary activity in support of Combatant Commanders. An individual appointed under this position description may be tasked/assigned to fill one of the following CPT crew positions: Network Analyst, Host Analyst (Unix), Host Analyst (Windows), or Cyber Threat Analyst. You will not only train, exercise and certify national cyber protective team members, but you will also be a member of a dynamic defensive cybersecurity team that travels to defend foreign and domestic mission partner networks.

U.S. Citizenships Required.

This is a designated Drug Testing Position.

Must be able to obtain and maintain a Top Secret, Sensitive Compartmented Information (SCI) Security Clearance. A non-disclosure agreement must be signed.

Information Assurance Certification is a condition of employment. This position includes information assurance (IA) work as a paramount duty requirement. IA Technician Level III is required IAW the USCYBERCOM CPT JQR for this position (Cyber Threat Analyst, Host Analyst, Network Analyst).

Compliance with Cyber Mission Force (CMF) training specified in the USCYBERCOM Cyber Mission Forces Training and Readiness Manual; and applicable higher headquarters guidance memoranda for Cyber-Crew Training, Standardization and Evaluation, and Cyberspace Operations, is a condition of employment.

Pre-employment physical examination is required and a condition of employment. Selectee must meet requirements for positions overseas/deployed locations due to the following. The duties of this position require moderate physical exertion involving walking and standing, possible use of firearms, and exposure to inclement weather. Due to travel requirements, individual must be capable of lifting and carrying a suitcase/transit case weighing a minimum of 50 lbs. unassisted.

This is a Mission Essential and Key Position; Active Guard and Reserve personnel may not be considered. Personnel on Ready Reserve status must be removed from status.

This position is covered by the Domestic Violence Misdemeanor Amendment (30 Sep 96) of the Gun Control Act (Lautenberg Amendment) of 1968. An individual convicted of a qualifying crime of domestic violence may not perform the duties of this position.

Advanced knowledge of and skill in application of the concepts, and practices in two or more of the following areas: cyberspace security, computer programming, networking, computer operating systems (Windows, UNIX), malware forensics; threat analysis, operations research, artificial intelligence/machine learning; cyber incident handling and response, penetration testing, software/malware reverse engineering. the application of Information Assurance (IA), Mission Assurance (MA) and threat hunting technologies and techniques, analysis of computer systems, operating systems, network communication protocols, computer and network architectures and virtual machine (VM) technology; ability to analyze and correlate data in order to distinguish evidence of attacks or intrusions from normal activity.

Knowledge of IA and MA technologies such as COMSEC, COMPUSEC, EMSEC, and OPSEC, computer systems, digital communications systems, network protocols, and computer architectures; and computer security penetration tools and techniques.

Extensive knowledge and skill in one or more of the following areas: (a)computer operating systems (Unix, Windows, etc.) enterprise services, file systems, security, configuration and analysis; (2) network operations and security including netflows, protocols, PCAP, etc.; (3) computer programming and scripting; (4) malware identification and analysis; (5) system forensics.

Skill in developing new or modified work methods, processes, or information protection procedures; and ability to develop and articulate technical direction and approaches to formulating interoperability plans, implementation plans, and contingency plans involving communications and connectivity between major command and control systems; proficiency in applying analytical and evaluative methods and techniques to issues or studies concerning the efficiency and effectiveness of program operations.

You will be evaluated for this job based on how well you meet the qualifications above.

As of 27 September 2025, Federal agencies will only accept resumes up to two pages in length. To learn more about the new resume requirements visit https://afciviliancareers.com/resumetips/ OR https://www.opm.gov/policy-data-oversight/hiring-information/merit-hiring-plan-resources/agency-guidance-on-the-two-page-limit-on-resume-length/.

Candidates should be committed to improving the efficiency of the Federal government, passionate about the ideals of our American republic, and committed to upholding the rule of law and the United States Constitution.

U.S. citizenship required. Must be of legal work age.

AFCS is an Equal Opportunity Employer.