mos.directory

Navy NEC · IT & Cyber

H32A Cyber Threat Emulation Operator (CTEO)

Current service use not established

This code is listed in the directory. Inclusion alone does not confirm current service use.

A Navy Enlisted Classification: a skill designation sailors hold in addition to their rating.

Browse Navy

Overview

A Cyber Threat Emulation Operator replicates adversary tactics, techniques, and procedures to assess blue Mission Relevant Terrain Cyber. They use intelligence from all sources to execute offensive cyber plans, assess information and combat systems, inform defensive procedures and posture, and recommend mitigation strategies to allied entities.

Minimum clearance: TS/SCI

Core Skills

  • Intelligence-informed adversary tactics emulation
  • Mission-focused cyber threat assessment
  • Adversary behavior analysis for defensive mitigation

Civilian Career Paths

Career associations are editorial assessments of the cited evidence, not an official crosswalk unless the evidence explicitly says so. O*NET supplies civilian occupation information, not proof of a military match. Related experience does not confer civilian qualifications. Tasks and tools below describe civilian work, not military training.

Penetration Testers

Replicating adversary tactics and executing offensive cyber assessments transfers directly to testing system weaknesses and recommending mitigations.

How to prepare: Create a lab-based assessment report documenting test scope, reproduced adversary behaviors, findings, and recommended mitigations.

What the civilian work involves
  • Collect stakeholder data to evaluate risk and to develop mitigation strategies.
  • Conduct network and security system audits, using established criteria.
Civilian tools and software (examples)
  • Bash
  • Linux
  • Microsoft Active Directory

Information Security Engineers

Using threat assessments to inform defensive posture and mitigation strategies transfers to evaluating security controls and addressing system weaknesses.

How to prepare: Build a lab demonstration that reproduces an attack, implements a defensive control, and measures whether the control prevents or detects the repeated attack.

What the civilian work involves
  • Identify security system weaknesses, using penetration tests.
  • Assess the quality of security controls, using performance indicators.
  • Scan networks, using vulnerability assessment tools to identify vulnerabilities.
Civilian tools and software (examples)
  • Linux
  • Microsoft Active Directory
  • Microsoft PowerShell

Notes & Sources

Evidence for this guidance (3 documents)
  1. NAVPERS 18068F Vol II (NEOCS, Jul 2026 edition): NEC H32A

    [1] NEC entry "H32A - Cyber Threat Emulation Operator (CTEO)"; cached text line 6289; NAVPERS 18068F Vol II, 2026-07 edition

    Supports: Intelligence-informed adversary tactics emulation, Mission-focused cyber threat assessment, Adversary behavior analysis for defensive mitigation, Penetration Testers (O*NET 15-1299.04), Information Security Engineers (O*NET 15-1299.05)

  2. O*NET: Penetration Testers

    [2] O*NET 30.3 occupational data

    Supports: Penetration Testers (O*NET 15-1299.04)

  3. O*NET: Information Security Engineers

    [3] O*NET 30.3 occupational data

    Supports: Information Security Engineers (O*NET 15-1299.05)

Defense contractor jobs for H32A

Descriptions may be summarized for clarity. Verify all information with your branch career counselor or official military documentation before making career decisions.

Report an error on this page