CYBER TALENT WANTED: Military, Intelligence Community Strive to Retain Cyber Workforces

Photo: Defense Dept.

The private sector has for years lured cyber talent away from the government with promises of higher compensation. To counter this, leaders within the military and intelligence community are implementing a slew of programs that they believe will boost retention.

The Army is closely monitoring retention rates for its cyber workforce, including officers, enlisted soldiers and civilians, said Todd Boudreau, deputy commandant of the U.S. Army Cyber School at the Cyber Center of Excellence in Fort Gordon, Georgia.

“We do know that there is a challenge to retain that workforce,” he told National Defense in an interview.

While the Army recognizes that it cannot pay as much as the private sector can, there are ways that the service can entice its workforce to stay in government, said Sgt. Maj. Karl Pendergrass, the Army’s cyber training and education directorate sergeant major.

One example includes special incentive pay for jobs that are deemed to be particularly critical, he noted.

The Army is currently exploring ways to piggyback off of a Pentagon program to incentivize service members to have proficiency in certain languages, he said.

For a soldier to be a top-tier cyber professional, it requires significant dedication to education and certifications that are outside of the scope of their normal duties, he noted. The Army wants to reward those men and women who spend that time investing in their profession, he added.

“Similar to a language program, [it’s] based on the level of your proficiency [and] you get paid more a month,” he said. “But you have to maintain that, and so it’s a very rigorous program to make sure that you’re achieving and maintaining those standards.”

However, Pendergrass said he often finds that pay isn’t a top factor for most Army cyberwarriors.

“We provide them with a unique environment where they get access to things that their counterparts typically do not. They get access to unique mission sets and environments,” he said. “Keeping their minds engaged … is something they find uniquely attractive.”

The service also permits its personnel to work with industry for a certain amount of time, enabling them to obtain important experience that they can then apply to their regular military job.

It “allows us to collaborate alongside industry,” he said. “We send someone off to Microsoft to work in their spaces and then [they] bring back what they’ve learned. … What they give us back is remarkably valuable, because remember those companies — the Citibanks, the Carnegie Mellons, the Microsofts, the Googles — they also have their own … cyber protection entity.”

The Army is also initiating a direct commissioning pilot program that will allow the service to recruit from a bigger pool, Boudreau said.

Direct commissioned officers are often lawyers, doctors, veterinarians or chaplains, he said. “The Army recognizes we’re not going to stand up our own medical school or our own theological college,” he said. “Individuals that have the bachelor’s degree and have gone through those different programs, they’re assessed in the Army outside of your normal” channels.

Officers who join through the initiative are normally awarded three years worth of credit, allowing them to come in as a first lieutenant and on the precipice of becoming a captain, he said. Doctors can even come in at the colonel level, he added.

The National Defense Authorization Act of 2018 gave the Army the authority to offer such a path for cyber professionals under a pilot that will last five years, he said.

“The Army has already jumped in and has established a baseline of between five and 10 individuals that we would bring in a year,” he said. It has already held interviews with applicants, but a timeline for when they would be approved is not yet available.

Data so far shows that the service is successfully retaining its top talent, Boudreau said.

“We don’t really see an alarming retention problem,” he said. “We are guarded and are monitoring to make sure that we maintain the normal attrition rates, that we’re not losing [our workforce]. But evidence to date has not shown that we have.”

Photo: iStock

The Air Force is also tracking retention rates for its cyber workforce and looking at ways to keep its most talented individuals, said Maj. Gen. Patrick C. Higby, director of cyberspace strategy and policy at the office of information dominance and chief information officer within the office of the secretary of the Air Force.

“Our cyber airmen certainly have skills that are very attractive to the commercial sector,” he said. “The commercial sector as you can imagine can offer higher levels of compensation. … [But at] the end of the day, that does not overly concern us because we believe that the mission sets that our cyber airmen are engaged in — i.e., being decisively engaged with an adversary that is trying to do our nation harm — that that higher calling will basically supersede the attractiveness of compensation in the commercial sector.”

The two biggest factors in retaining its workforce — which include officers, enlisted airmen and civilians — is to ensure they have healthy relationships with their supervisors and that they recognize how important their day-to-day job is to the Air Force’s larger mission, he said.

The Air Force has more than 50 initiatives looking at ways to better retain its cyber workforce, he noted.

The service has to retain an exponentially higher number of officers working in cybersecurity in order to keep its career field healthy, Higby said. Budget cuts in 2009 and 2014 forced the Air Force to make manning decisions that reduced the number of officers in the cybersecurity field, he noted.

“Many of those reductions came in the lower-grade positions, and so I’m now looking at this situation where I have more field-grade officer requirements than company-grade officer requirements,” he said. Field-grade officers include majors, lieutenant colonels and colonels. Company-grade officers are lieutenants and captains.

“Essentially my career field pyramid is inverted, and obviously that is not a healthy” situation, he said.

To retain these company-grade officers, the Air Force implemented a program that would give those who reenlisted for a certain number of years a financial bonus, he said.

The service is also looking at ways to better pinpoint cyber talent in its new recruits. Already the Air Force has a defense language aptitude test that has for years been used as a way to discover hidden talent, Higby said.

“It does not test how well you speak French or Arabic or Japanese. It tests what is your propensity to learn or what would be your aptitude for learning those languages,” he said.

The service is about to roll out a cyber equivalent of the assessment that will allow it to target young recruits who may not think that they would necessarily be a good fit for the Air Force’s cyber team, he said.

Such an assessment could tell if a person is good at adversarial thinking, which could prove to be useful for cyber operations, he said noting, “What better skill to have when you’re trying to set up cyber defenses than adversarial thinking?”

"For a soldier to be a top-tier cyber professional, it requires significant dedication to education and certifications..."

The National Security Agency is also working on ways to retain its cyber professionals, said Cynthia Miller, the agency’s chief of human resources, who could only speak about the civilian side of the workforce.

The agency is in a uniquely difficult position because its employees must obtain a security clearance and be a U.S. citizen to work there, she noted.

“That’s a uniqueness that … our competitors don’t have to have, which can be challenging,” she said. However, “in any given month we have over 10,000 people applying to work here. We have the interest. We also have the retention that we need, which rests at about 94 percent.”

The agency is implementing special pay authorities to entice its workforce to stay, she noted. However, even with these bonuses, the NSA cannot compete with industry when it comes to salaries, she said.

“Is it a challenge? Absolutely,” she said. The agency faces competition from defense contractors, the commercial sector and academia, she noted.

However, working for the NSA allows an individual to access technology that he or she could not in the private sector, Miller noted.

“There is uniqueness that you won’t find anywhere else,” she said. “The type of things that they touch literally every day in defense of this nation, no one else can offer them that opportunity.”

In the past, NSA has been dogged by accusations of low morale at its headquarters, which is located in Fort Meade, Maryland. This is something the agency recognizes and is working on, Miller said.

“We’re the size of a city here, tens of thousands of people. Of course you are going to have pockets of morale” issues, she said.

Miller pointed to growing pains related to the implementation of NSA 21 — an organizational restructuring plan — as one reason some employees have had lower morale.

“When we went to NSA 21, that was a huge change,” she said. Major overhauls often require large adjustments, she added.

For example, under the restructuring, at least 12 employees at the senior executive level — who comprised the agency’s board of directors — now are a tier lower on the organization chart than they were before, she said.

That was because NSA Director Adm. Mike Rogers wanted to have fewer people reporting to him directly, she said. “When you have the amount of change that we have had in the last 18 months, yes, of course it has affected morale. Is it something that we are pretending does not exist? No.”

The agency is aware of these morale issues and is working to open up communication channels via town hall meetings and brown bag sessions with its employees, she noted.

Morale issues do not keep Miller up at night, she said. “Why is that? Because we aware of it. We have a mechanism in place to try to ensure that we keep it at a level where it does not affect productivity.”

Photo: Defense Dept.

Bill Leigher, director of government cyber solutions for Raytheon, said by and large both the government and private sector face challenges retaining their workforce.

“The NSA and U.S. Cyber Command offer unique and challenging opportunities for cyber practitioners that private industry can’t match,” he said in an email. “Alternatively, many cybersecurity professionals choose an entrepreneurial route. It isn’t always an either/or proposition.”

However, it can often be difficult for cyber professionals who seek defense contractor or government jobs to obtain necessary security clearances. That can be a lengthy and time-consuming process, he noted.

“Understandably, this may not be appealing to some,” he said. It “can sometimes act as a barrier to entering that market.”

It is important for the government to offer “on and off ramps” for cyber professionals to move in and out of government, he noted. That allows them “to learn a new skill or get specific experience without losing seniority or benefits,” he said.

Topics: Cyber, Cybersecurity, Defense Department, Intelligence and Surveillance, Infotech, Information Technology