Information Technology (IT) Systems

The 1D7X1 Information Technology (IT) Systems Airman holds one of the newest AFSCs in the Air Force. The Air Force retitled the specialty Information Technology (IT) Systems in October 2025 (formerly Cyber Defense Operations). It consolidates defensive cyber roles that previously sat under legacy AFSCs like 3D0X2 Cyber Systems Operations and 3D1X2 Cyber Transport Systems. If you're a 1D7, you sit on the defensive side of cyberspace operations: hunting threats inside Air Force networks, running incident response, managing vulnerability scans, supporting blue team and red team exercises, and keeping mission systems hardened against adversary intrusion.

Day to day, 1D7s work inside Cyber Protection Teams (CPTs), Mission Defense Teams (MDTs), and base-level Communications Squadrons. Tooling typically includes SIEM platforms (Splunk, Elastic), endpoint detection (CrowdStrike, Defender for Endpoint), packet capture and analysis tools, vulnerability scanners (Tenable Nessus, ACAS), and DoD-specific platforms like the Big Data Platform, Gabriel Nimbus, and Risk Management Framework (RMF) workflows. The pipeline starts with Basic Military Training, then Information Technology (IT) Systems technical training at Keesler Air Force Base, with follow-on training tied to specific role assignments and DoD 8140 cyber workforce requirements.

The reason civilian and federal employers value 1D7s isn't generic "cyber experience." It's the specific combination of defensive operations under sustained nation-state pressure, an active Top Secret/SCI clearance, and DoD 8140 / 8570 baseline certifications most commercial SOC analysts never get exposed to. If you're starting to look at the door, you have more leverage than the average cyber candidate. The path runs through commercial SOCs and threat hunting teams, federal civilian cyber roles at DoD components, and defense contractor positions tied directly to the same missions you supported in uniform. Cross-branch peers worth comparing notes with include 1B4X1 Cyber Warfare Operations on the offensive side and 3D0X2 Cyber Systems Operations on the systems administration side.

I sat on the federal hiring side after the Navy and 1D7X1s are some of the easiest cleared cyber hires the federal government can make. The GS-2210 IT Management series at DISA, ARCYBER, AFCYBER, and DoD components actively recruits 1D7s out of uniform. The combination of defensive cyber operations experience, DoD 8140 alignment, and active TS clearance is exactly what federal cyber programs and major defense contractors compete for. — Brad Tachi, Navy Diver veteran & BMR founder

The commercial cybersecurity market for cleared defensive operators is one of the strongest hiring environments in tech right now. The roles below are where 1D7s consistently land, with BLS OEWS May 2024 salary data attached. None of these are "entry level" by industry standards even though many 1D7s separate as junior NCOs. Your operational reps inside CPTs and MDTs put you ahead of most civilian SOC analysts who've never defended a network under real adversary pressure.

Information Security Analyst (O*NET 15-1212.00) is the most common landing spot. BLS OEWS May 2024 reports a median wage around $124,910 with the top 10% above $182,000, and growth is projected at 33% through 2033, far above average. Cleared analysts in the DC, Maryland, and Virginia corridor typically clear $130K-$150K base out of uniform. The role covers SOC tier 2/3 analysis, threat hunting, and incident response, which is the exact same work loop you ran in defensive cyber operations.

SOC Analyst (Tier 2/3) and Threat Hunter roles also map to O*NET 15-1212.00 but skew toward 24/7 operations centers at MSSPs and large enterprises. Companies like Mandiant, CrowdStrike, Arctic Wolf, and Palo Alto Networks Unit 42 specifically recruit veterans with defensive cyber backgrounds. Threat hunter roles tend to pay $120K-$160K and require proactive hypothesis-driven hunting, which is closer to the mission defense team workflow than traditional alert-driven SOC work.

Penetration Tester / Red Team Operator (O*NET 15-1212.00) is the pivot for 1D7s who supported red team exercises and want to switch to offense. BLS groups this under information security analysts at the same $124,910 median, but specialized red team roles at firms like Bishop Fox, NetSPI, and IBM X-Force routinely pay $130K-$170K. OSCP is the dominant cert here, often required by the second interview round.

Network Engineer / Computer Network Architect (O*NET 15-1241.00) applies if you spent time on the network defense side. Computer network architects show a BLS median of $130,390 with growth at 13% through 2033. Cleared network engineers at federal systems integrators routinely clear $125K-$155K. This is a strong path if you held network admin roles before transitioning into the 1D7 AFSC consolidation.

Cybersecurity Engineer / DevSecOps Engineer (O*NET 15-1212.00) is where the higher salaries live. The work focuses on building security tooling, automating detection, and integrating security into CI/CD pipelines. Companies like Microsoft, Amazon AWS, and Google Cloud actively recruit cleared veterans for cleared cloud cybersecurity engineering roles, often at $150K-$200K base.

Geographic note: the strongest cleared cyber market is the National Capital Region (Northern Virginia, DC, Maryland), followed by San Antonio (AFCYBER), Augusta (ARCYBER), Colorado Springs (Space Force / NORTHCOM), and Tampa (CENTCOM/SOCOM). Hampton Roads and Honolulu are smaller but real markets. Cross-branch peers landing in these same lanes include Army 17C Cyber Operations, Navy CTN, and Marine 0651 Cyber Network Operator. Use the military resume builder to translate your DoD tooling into the language commercial recruiters actually search for.

Federal civilian cyber hiring is the single best path for most 1D7s. The pay scale on the GS schedule plus locality is competitive with industry once you factor in pension accrual, TSP match, federal holidays, and stability. The work is also the closest to what you did in uniform, often on the same systems and at the same buildings.

GS-2210 Information Technology Management is the dominant series. Specialty parentheticals matter here: 2210 (INFOSEC) for cybersecurity work, 2210 (NETWORK) for network defense, and 2210 (SYSADMIN) for systems administration overlap. Most 1D7s qualify at GS-9 or GS-11 on separation depending on rank and time-in-grade. With a BS in cyber or CompSci and meaningful operational time, GS-12 is realistic at DISA, AFCYBER civilian cells, ARCYBER, NSA, and the major COCOMs (CYBERCOM, NORTHCOM, INDOPACOM, CENTCOM). DoD 8140 alignment with your military training shortens qualification timelines compared to civilians coming in cold.

GS-1550 Computer Science is the right series if you have a CS degree or equivalent coursework. It pays the same as 2210 at the same grades but requires the formal academic background. Federal R&D labs (AFRL, DARPA support contractors, MIT Lincoln Lab partner roles) often classify cyber engineering positions under 1550.

GS-0855 Electronics Engineering applies to airmen who supported cyber-physical systems, weapons system cybersecurity, or RMF authorization work for embedded platforms. AFLCMC, the Cryptologic Systems Group, and various PEO offices hire 0855s for cyber resilience of weapons systems.

GS-0132 Intelligence Specialist opens up if you supported all-source threat intelligence, cyber intel fusion, or counterintelligence cyber work. Many 1D7s with intel-adjacent assignments at NSA-affiliated commands or 16th Air Force qualify. NSA, DIA, and the service intel commands recruit heavily here.

GS-0301 Miscellaneous Administration covers cyber program management, RMF authorizing official support, and cyber policy positions that don't fit cleanly under 2210. This is a backdoor for 1D7s who want federal stability without the technical certification renewal treadmill.

Veterans' Preference (5-point or 10-point depending on disability rating) plus an active TS/SCI is the combination that wins federal cyber jobs. USAJobs filters that hide the noise: Military Spouses E.O. 13473, VEOA-eligible only, and Schedule A for service-connected disabilities. The DoD 8140 cybersecurity certification guide walks through which baseline certs unlock which positions. Federal resumes run different from civilian — see Army 17C federal paths for parallel guidance, and start your federal-format resume on the homepage when you're ready to apply.

If you're staying in cyber, your jargon translates directly. Commercial SOCs, MSSPs, and federal cyber programs all run SIEM, EDR, and incident response on the same workflow you used in uniform. This section is for 1D7s targeting careers OUTSIDE direct cyber operations: tech program management, sales engineering, IT consulting, compliance, or product roles where the hiring manager doesn't speak fluent DoD.

Term-by-term translations for non-cyber audiences:

• Cyber Protection Team (CPT) -> Enterprise incident response team / threat hunting team
• Mission Defense Team (MDT) -> Specialized blue team protecting mission-critical systems
• RMF (Risk Management Framework) -> Security compliance framework (NIST 800-53 controls)
• ACAS / Tenable Nessus scans -> Enterprise vulnerability management program
• JSIG / NIST 800-171 -> Federal cybersecurity compliance standards
• Big Data Platform / Gabriel Nimbus -> Enterprise SIEM and threat analytics platform
• SCAP scans -> Automated security configuration auditing
• POA&M (Plan of Action & Milestones) -> Risk remediation tracking and project plan
• 16th Air Force / AFCYBER -> Defensive cyberspace operations command equivalent to a Fortune 100 enterprise SOC

Resume bullet before/after for a tech program manager target:

Before (military-coded): "Led 4-person CPT element conducting DCO-IDM operations on AFNet, executing ACAS scans and POA&M remediation across 12 mission systems IAW DoDI 8500.01."

After (civilian-coded): "Led a 4-person cybersecurity team running enterprise vulnerability management and incident response across 12 mission-critical systems serving 8,000+ users, reducing critical vulnerabilities by 60% over 9 months and producing remediation roadmaps adopted by leadership."

Resume bullet before/after for a sales engineering target at a security vendor:

Before: "Operated SIEM (Splunk ES) for 16 AF DCO mission, triaging 200+ alerts daily and authoring 30 incident reports under TS/SCI."

After: "Operated Splunk Enterprise Security as a tier 2/3 analyst at one of the largest defensive cyber operations in DoD, triaging 200+ daily alerts and producing executive-level incident reports for senior leadership audiences."

Most 1D7s underestimate what their certifications signal outside DoD. Sec+, CySA+, CASP+, and the cleared TS/SCI on file collectively reset the recruiter's mental "junior" tag almost immediately. The 50 military terms translated to civilian language blog covers cross-MOS terminology. The military resume builder handles the cyber-specific translation patterns automatically.