diff --git a/atst/routes/users.py b/atst/routes/users.py
index 2762421c..adb1246c 100644
--- a/atst/routes/users.py
+++ b/atst/routes/users.py
@@ -1,5 +1,6 @@
-from flask import Blueprint, render_template, g, redirect, session, url_for, request
+from flask import Blueprint, render_template, g, redirect, url_for, request as http_request
 from atst.forms.edit_user import EditUserForm
+from atst.domain.users import Users
 
 
 bp = Blueprint("users", __name__)
@@ -14,4 +15,11 @@ def user():
 
 @bp.route("/user", methods=["POST"])
 def update_user():
-    return redirect(url_for(".home"))
+    user = g.current_user
+    form = EditUserForm(http_request.form)
+    if form.validate():
+        Users.update(user, form.data)
+        return redirect(url_for("atst.home"))
+    else:
+        return render_template("user/edit.html", form=form, user=user)
+
diff --git a/templates/fragments/edit_user_form.html b/templates/fragments/edit_user_form.html
index ed0ec406..1e7f3fe2 100644
--- a/templates/fragments/edit_user_form.html
+++ b/templates/fragments/edit_user_form.html
@@ -2,7 +2,8 @@
 {% from "components/options_input.html" import OptionsInput %}
 {% from "components/date_input.html" import DateInput %}
 
-<form action='{{ form_action }}'>
+<form method="POST" action='{{ form_action }}'>
+  {{ form.csrf_token }}
   <div class='panel'>
     <div class='panel__content'>
       <div class='form-row'>
diff --git a/tests/factories.py b/tests/factories.py
index 0ab5f5fd..ae6f1a7e 100644
--- a/tests/factories.py
+++ b/tests/factories.py
@@ -48,6 +48,17 @@ class UserFactory(Base):
     last_name = factory.Faker("last_name")
     atat_role = factory.SubFactory(RoleFactory)
     dod_id = factory.LazyFunction(lambda: "".join(random.choices(string.digits, k=10)))
+    phone_number = factory.LazyFunction(
+        lambda: "".join(random.choices(string.digits, k=10))
+    )
+    service_branch = factory.LazyFunction(
+        lambda: random.choices([k for k, v in SERVICE_BRANCHES if k is not None])[0]
+    )
+    citizenship = "United States"
+    designation = "military"
+    date_latest_training = factory.LazyFunction(
+        lambda: datetime.date.today() + datetime.timedelta(days=-(random.randrange(1,365)))
+    )
 
     @classmethod
     def from_atat_role(cls, atat_role_name, **kwargs):
diff --git a/tests/routes/test_users.py b/tests/routes/test_users.py
new file mode 100644
index 00000000..deb2cc3a
--- /dev/null
+++ b/tests/routes/test_users.py
@@ -0,0 +1,22 @@
+from flask import url_for
+
+from atst.domain.users import Users
+
+from tests.factories import UserFactory
+
+def test_user_can_view_profile(user_session, client):
+    user = UserFactory.create()
+    user_session(user)
+    response = client.get(url_for("users.user"))
+    assert user.email in response.data.decode()
+
+
+def test_user_can_update_profile(user_session, client):
+    user = UserFactory.create()
+    user_session(user)
+    new_data = {**user.to_dictionary(), "first_name": "chad", "last_name": "vader"}
+    new_data["date_latest_training"] = new_data["date_latest_training"].strftime("%m/%d/%Y")
+    client.post(url_for("users.user"), data=new_data)
+    updated_user = Users.get_by_dod_id(user.dod_id)
+    assert updated_user.first_name == "chad"
+    assert updated_user.last_name == "vader"