Cybersecurity recruiting
Cybersecurity hiring in the federal market runs along two lines. The first is operational: cyber commands, cryptologic centers and security operations centers that need analysts, engineers and testers with clearances.
The second is compliance: contractors that must meet NIST SP 800-171, the Cybersecurity Maturity Model Certification program and FedRAMP, and agencies that must meet FISMA. Recruiters Workforce recruits cybersecurity analysts, penetration testers, information system security officers, DevSecOps engineers and network security engineers for both.
The specialty pages list the certifications employers ask for. This page maps where the hiring is.
Who hires in cybersecurity
The commands, centers and rules below describe the cybersecurity market. They are named as facts and none is a client of the firm.
-
Fort Meade and U.S. Cyber Command
Fort George G. Meade calls itself the home of U.S. Cyber Command and lists the National Security Agency, Army Cyber Command, the Defense Information Systems Agency and the Defense Media Activity among its tenants. NSA's cybersecurity mission is to prevent and eradicate threats to national security systems, with an initial focus on the defense industrial base. The Johns Hopkins Applied Physics Laboratory in Laurel, a university affiliated research center on a 461-acre campus, sits between Fort Meade and Washington.
-
San Antonio and Augusta
Sixteenth Air Force, Air Forces Cyber, is headquartered at Joint Base San Antonio-Lackland and is responsible for operating and defending the Air Force's information network and for the cyberspace forces assigned to U.S. Cyber Command. Port San Antonio, on the former Kelly Air Force Base, states that more than 1,000 uniformed and civilian Air Force cybersecurity experts work on its campus, and its Alamo Regional Security Operations Center houses the city's and CPS Energy's security teams. Fort Eisenhower in Augusta is home to the Army Cyber Center of Excellence, and the Georgia Cyber Center offers a cyber range and training in partnership with Augusta University.
-
Florida, Colorado and Hawaii
Cyber Florida, created by the state legislature in 2014 and housed at the University of South Florida in Tampa, focuses on the defense, finance, health care, transportation and utility sectors. Catalyst Campus in Colorado Springs hosts Air Force CyberWorx and Platform One programs alongside the aerospace and defense industry. NSA Hawaii's regional operations center near Wahiawa opened in January 2012.
-
Defense contractors under CMMC
The CMMC program at 32 CFR Part 170 took effect on December 16, 2024 and sets three levels: Level 1 is the 15 requirements of FAR 52.204-21, Level 2 is the 110 requirements of NIST SP 800-171 Revision 2, and Level 3 adds 24 requirements from NIST SP 800-172. The DFARS rule at 252.204-7021 took effect on November 10, 2025, with CMMC requirements included in selected contracts for three years and applied to all contracts involving federal contract information or controlled unclassified information from November 10, 2028. DFARS 252.204-7012 separately requires NIST SP 800-171 safeguards and cyber incident reporting within 72 hours.
-
Civilian agencies
CISA leads the national effort to reduce risk to cyber and physical infrastructure and provides the common security baseline for federal civilian executive branch agencies under FISMA. NIST SP 800-53 Revision 5 supplies the control catalog, and FedRAMP applies it to cloud services. Health care systems apply the HIPAA Security Rule, which requires safeguards for electronic protected health information.
Clearances and access in cybersecurity
Operational cyber positions at the commands and cryptologic centers require TS/SCI, and at NSA the suitability process includes a polygraph. Security operations and engineering roles at defense contractors commonly require Secret, with Top Secret for program offices. Compliance roles built around NIST SP 800-171 and CMMC assessments often require no clearance at all, which makes them the entry point for candidates moving from commercial security work into the federal market.
Requisitions in this industry name the framework as often as the clearance: NIST SP 800-53 for agencies and FedRAMP platforms, NIST SP 800-171 and CMMC for defense contractors, the HIPAA Security Rule for health systems. The submittal records which frameworks the candidate has worked under and in what role.
Specialties we recruit for cybersecurity
Markets with cybersecurity hiring
Engagement models that fit
Security operations centers and cyber task orders run around the clock and to contract periods, so contract staffing and contract-to-hire fit most analyst and engineer seats. Direct hire fits ISSOs and security leads that a contractor must carry on its own payroll for a CMMC assessment or an authorization to operate. Retained search is used for directors of cybersecurity and chief information security officers at contractors and technology firms. The engagement models page compares them.
Questions about cybersecurity recruiting
Which certifications do cybersecurity requisitions ask for most often?
Security+ appears on more requisitions than any other, followed by CySA+, CISSP, the GIAC incident handling and penetration testing credentials, and the vendor cloud security certifications. The cybersecurity analysts, penetration testers and information system security officers pages describe each credential with its issuing body's requirements.
Does a defense subcontractor need cleared staff to reach CMMC Level 2?
No clearance is required to implement or assess the 110 requirements of NIST SP 800-171, which is what Level 2 measures. Cleared staff are needed where the program itself is classified. Many subcontractors therefore recruit a non-cleared ISSO or compliance analyst for the CMMC work and keep their cleared engineers on the classified program.