Skip to main content

Intel and SIGINT veterans to cybersecurity: occupations, skills and TS/SCI

Published 2026-11-01 · Cyber Wingman

Moving from intelligence work into cybersecurity? Start by separating three questions: what O*NET links to your military job, what cyber work you want to learn, and what clearance status your security office can verify. This guide uses Army 35N Signals Intelligence Analyst as its example, following the O*NET veterans search.

Why your MOS isn't on the usual lists

The two O*NET sources give different kinds of results. In the military crosswalk download, file milx0724.csv, the current Army 35N Signals Intelligence Analyst row directly maps to Communications Equipment Operators, All Other (43-2099.00). Older rows reuse 35N for different military titles; those are not the Signals Intelligence Analyst match.

My Next Move for Veterans instead shows these 13 similar civilian careers. Titles and codes are copied from its results and linked profiles:

  • Broadcast Technicians — 27-4012.00
  • Detectives & Criminal Investigators — 33-3021.00
  • Electrical & Electronics Repairers, Commercial & Industrial Equipment — 49-2094.00
  • Emergency Management Directors — 11-9161.00
  • First-Line Supervisors of Police & Detectives — 33-1012.00
  • Intelligence Analysts — 33-3021.06
  • Interpreters & Translators — 27-3091.00
  • Management Analysts — 13-1111.00
  • Operations Research Analysts — 15-2031.00
  • Remote Sensing Scientists & Technologists — 19-2099.01
  • Remote Sensing Technicians — 19-4099.03
  • Technical Writers — 27-3042.00
  • Training & Development Specialists — 13-1151.00

Neither source lists Information Security Analysts (15-1212.00) for 35N. O*NET does not directly link this MOS to cyber. The three analyst occupations above are similar-career results, not three direct crosswalk matches. My Next Move also cautions that similar careers may require more training, education, or experience. Use the military-to-analyst guide to understand the distinction before describing your background.

Explore related occupations without inventing a bridge

O*NET's Intelligence Analysts profile lists these among its Related Occupations:

  • Information Security Analysts (15-1212.00): work protecting networks and information, assessing vulnerabilities, and responding to breaches, as described in its occupation profile.
  • Digital Forensics Analysts (15-1299.06): work analyzing digital evidence and investigating computer security incidents, as described in its occupation profile.

These are occupation-to-occupation relationships. They do not turn 35N into a direct military match or establish that you already meet a job's requirements.

The Management Analysts and Operations Research Analysts profiles both list Computer Systems Analysts (15-1211.00) as related. Treat that as another occupation to investigate, rather than a promised cyber route.

For practice, choose one target profile and compare its tasks with work you can honestly describe. Try a public training exercise, then write a short report explaining your evidence, uncertainty, and recommended next step. That is this guide's suggested exercise, not an O*NET qualification or military mapping. Keep your examples unclassified; do not include operational details to make a resume sound stronger.

Present your clearance honestly

DCSA's adjudications FAQ describes clearance requirements as job-based. Its vetting overview says a sponsoring agency initiates the process. Describe verified eligibility and access through your agency or employer's security office, rather than treating TS/SCI as a personal credential you can activate yourself. DCSA also says SCI access can involve additional requirements even where someone otherwise has clearance eligibility.

OPM's clearance-status FAQ says a clearance may no longer be active after leaving employment or changing positions. It directs you to the granting agency's personnel security office, or your company's facility security officer, to determine current status.

Based on that guidance, these are suggested resume formats, not official wording. Use them only when accurate and cleared for inclusion by your security office:

  • Verified current eligibility: "Top Secret eligibility; SCI access status verified by security office, [month/year]." State current SCI access only if separately confirmed.
  • Lapsed or unverified status: "Previously held TS/SCI; last held [year]. Current eligibility requires security-office verification."

Do not guess an expiration date or label an unverified clearance "active." For the preparation checklist about recording your level and last investigation close date, see roadmap step 1.

DCSA describes continuous vetting as ongoing background review using automated criminal, financial, and other records checks in its vetting overview. Its May 19, 2026 contractor update says periodic reinvestigations are no longer required for NISP contractor national security personnel. An updated PVQ or SF-86 eApp and releases is required every five years, timed from the PVQ Date in DISS. That update interval is not a personal clearance expiration date. Ask your security office which requirements apply to you.

Where this fits next

Use the veteran cybersecurity roadmap for the broader sequence, and the Security+ guide when planning the certification step. Bring a target occupation, an honest account of your experience, and verified clearance wording to your planning.

Start your free assessment.

Sources and capture date

Sources linked above were captured November 1, 2026. Occupation results are from O*NET and My Next Move for Veterans; clearance guidance is from DCSA and OPM. The public veterans page was retrieved; the WS v2 related-results endpoint was not queried because API credentials were unavailable. No wage snapshot is used.

The crosswalk and veterans results are attributed to the U.S. Department of Labor, Employment and Training Administration under CC BY 4.0. The explanations and practice suggestions here are Cyber Wingman's.

👋 Hey! Click to chat with me!
i