Emphatically? The director of the NSA is required to be a four star general and concurrently serves as commander of US Cyber Command. Ostensibly non-military, perhaps.
The director is required to be a commissioned officer (and upon taking the role gets the O-10 grade) because they also head Cyber Command and the CSS (Central Security Service) but they don't really "run" the NSA like you'd expect say the director of the FBI or CIA to. Their role instead is mostly to coordinate the interaction between the NSA, CSS, and CYBERCOM on top of running CYBERCOM itself.
When it comes to actual day to day operations however the deputy director (who is required to be a technically experienced civilian) actually runs things and reports directly to the president. The director isn't actually in the deputy director's chain of command however one of their job roles is to provide advisory support to the director when needed.
The assistant Secretary of Health is also a commissioned 4 star admiral but they have never seen been the inside of a Navy ship. The last one was a pediatrician before joining. There's a lot of symbolic and tradition based commissions like that through the US gov.
It’s important to remember that “DOD” is a pathetic rebranding attempt of what it was originally founded as and continues to operate as: the Department of War.
You are incorrect. There are two categories of intelligence agencies in the US as a matter of law, with significantly different legal authority and structure.
Intelligence agencies like the CIA, FBI, et al are non-military. NSA is explicitly a military agency and operates under military authority. The easiest way to tell the difference is that the Director of military agencies is always an active military flag officer. It isn't just a superficial distinction, they operate quite differently.
