Cybersecurity

The 1D7X5 Cybersecurity AFSC is the Air Force's dedicated defensive cyber specialty. It was carved out of the 1D7X1 Cyber Defense Operations family when the Air Force designated cybersecurity as its own shred in November 2024 and then converted it to the standalone 1D7X5 code by May 2025. If you held this AFSC, you were the airman who hardened Air Force networks, ran continuous monitoring, hunted intrusions, and kept mission systems accredited and compliant. This is distinct from the offensive and full-spectrum cyber work in 1B4X1 Cyber Warfare Operations and from the network plumbing that 3D1X2 Cyber Transport Systems airmen build and maintain.

Tech training runs at Keesler AFB, Mississippi, the same schoolhouse that trains the broader 1D7X1 Cyber Defense Operations field. From there, 1D7X5 airmen land on Mission Defense Teams protecting weapon systems and base infrastructure, in communications squadrons running boundary defense, and under 16th Air Force (Air Forces Cyber) at Joint Base San Antonio-Lackland. Day to day, the work means tuning a SIEM, triaging alerts, running vulnerability scans, writing and enforcing system security plans, and walking systems through the Risk Management Framework to keep an Authorization to Operate current. You held a Top Secret clearance and worked inside SCIFs and on classified enclaves, which is a credential civilian employers cannot easily find on the open market.

Civilian employers value 1D7X5 backgrounds because you defended high-value targets under real adversary pressure, not in a lab. You already speak the language of the NIST Cybersecurity Framework, NIST 800-53 controls, and incident response because the DoD built its accreditation process on top of them. If you want to see where your defensive cyber experience maps across the rest of the force, the military career crosswalk lays out adjacent specialties, and our guide to breaking into InfoSec after the military walks through the first 90 days of a civilian job search.

When I left the Navy I spent 18 months sending resumes into the void with almost nothing back. My experience was fine. The way I wrote it was the problem. Defensive cyber airmen hit that same wall in a specific way: you defended live networks under real pressure, but a resume that lists RMF, SIEM, and continuous monitoring as bare acronyms reads as noise to a hiring manager who does not speak DoD. Spell out what you protected and what you caught, and the 1D7X5 background sells itself. — Brad Tachi, Navy Diver veteran & BMR founder

Defensive cyber talent is in structural shortage, and the salary data reflects it. The U.S. Bureau of Labor Statistics (BLS OEWS, May 2024) reports a median wage of $124,910 for Information Security Analysts (O*NET 15-1212.00), with the occupation projected to grow far faster than average. That is the most direct civilian match for a 1D7X5 background, and it covers SOC analyst, threat hunter, and security engineer titles in practice.

The roles below are where 1D7X5 experience translates with the least friction. SOC and detection-engineering work mirrors the monitoring and triage you already did on Air Force enclaves. Governance, Risk, and Compliance (GRC) roles map almost one-to-one onto the RMF and 800-53 accreditation work, because commercial frameworks like SOC 2 and ISO 27001 borrow the same control logic. Cloud security is the fastest-growing segment, since most Air Force modernization now runs in cloud environments you likely already touched.

• Information Security Analyst / SOC Analyst: $124,910 median (BLS, 15-1212.00). Detection, triage, and response work that mirrors Air Force network defense.
• Cloud Security Engineer: mapped to Information Security Analysts (15-1212.00), $124,910 median (BLS). Securing AWS, Azure, and GovCloud workloads.
• Computer Systems Analyst: $103,790 median (BLS, 15-1211.00). Bridging security requirements and system design.
• Computer Network Architect: $130,390 median (BLS, 15-1241.00). Designing secure network and zero-trust architectures.
• Network and Systems Administrator: $96,800 median (BLS, 15-1244.00). Hardening and patching enterprise systems.
• Computer and Information Systems Manager: $171,200 median (BLS, 11-3021.00). A realistic 5-to-7-year target for airmen who led a Mission Defense Team.

Be honest with yourself about the market: entry-level SOC seats are competitive and often shift-based, and many cleared roles cluster around the National Capital Region, San Antonio, Colorado Springs, Huntsville, and Tampa where defense work concentrates. Your clearance is the differentiator that thins that competition. The same defensive skill set powers civilian paths for Navy CWT Cyber Warfare Technicians and Coast Guard Cyber Mission Specialists, so the cross-branch hiring pool you are competing in is broad. For a no-degree roadmap, see our breakdown of cybersecurity jobs veterans can land without a degree, then build your resume now to start applying.

Federal defensive cyber hiring runs on the GS-2210 Information Technology Management series, with the INFOSEC parenthetical. A 1D7X5 background qualifies you across the full ladder: most separating NCOs target GS-9 through GS-12 depending on time in the field and supervisory experience, and team leads who ran accreditation or a Mission Defense Team can compete at GS-13. Agencies score you against the cybersecurity competencies in the OPM qualification standard, so frame your RMF, continuous monitoring, and incident-response work in those exact terms.

Beyond GS-2210, your work touches several adjacent series. GS-1550 Computer Science fits airmen who did detection engineering or scripting. GS-0854 Computer Engineering fits those who worked security architecture on weapon systems. GS-1515 Operations Research fits analysts who built risk models or metrics. GS-0080 Security Administration fits the physical and information-security overlap from SCIF and classified-system work. CISA, the NSA, U.S. Cyber Command, the Air Force civilian workforce, and nearly every cabinet department staff these series.

Veterans' Preference adds 5 or 10 points to your federal application score, and your existing Top Secret clearance is a hiring accelerator: agencies save months and thousands of dollars when they do not have to sponsor an investigation. To read a vacancy correctly before you apply, work through our guide on decoding a USAJOBS announcement and the OPM federal resume format requirements. The same GS-2210 path serves Army 25B Information Technology Specialists, so cross-branch competition for these billets is real. When you are ready, our federal resume builder formats your experience to OPM standards.

If you are applying to a cleared defense cybersecurity job, your AFSC jargon already lands. Hiring managers at defense contractors know what RMF and a continuous-monitoring program are. This section is for the airmen targeting commercial security teams, GRC roles at banks and hospitals, or tech companies where nobody has heard of a Mission Defense Team.

The fix is not to dumb your experience down. It is to name the civilian framework that maps to what you did. Commercial security runs on the NIST Cybersecurity Framework, SOC 2, ISO 27001, and PCI DSS, and the control logic is the same one you used for DoD accreditation. Translate the acronym, keep the substance.

• RMF / Authorization to Operate becomes a security accreditation and compliance program built on NIST 800-53, the same control family behind SOC 2 and FedRAMP.
• Mission Defense Team becomes a security operations team protecting high-value systems and infrastructure.
• ACAS / vulnerability scanning becomes enterprise vulnerability management using industry scanners like Tenable Nessus.
• SIEM and continuous monitoring stays as SIEM operations, because Splunk and the commercial market use the same term you do.

A resume bullet like "Served as ISSO managing RMF accreditation for a classified enclave" reads as jargon to a commercial recruiter. Rewritten, it becomes "Owned the security compliance program for a 600-user classified system, maintaining 100% control coverage against NIST 800-53 and securing continuous authorization for two years." Same work, language a civilian hiring manager scores immediately. Our glossary of 50 military terms translated to civilian language covers the rest, and the Air Force-specific guide to translating your EPR/OPR bullets shows how to mine your evaluations for the metrics that make these rewrites work. The military resume builder handles the translation as you write.