This is most definitely _not_ illegal if US citizenship is required to perform the job, which is the case in any job dealing with classified information.
Or export restricted things like anything covered by ITAR, which is not always classified.
Being a US citizen doesn't automatically mean you get all security clearances. There are many levels/variations of security clearance and job requirement should state what clearance they are looking for.
My understanding is only US citizens can go through certain clearance/background checks required by our clients. Although perhaps it's just folks with a valid right-to-work? I don't know for certain, I'll amend it to be "valid right to work in US" and clarify for clearance reasons.
If they need a clearance, then in all but very, very limited circumstances they must be US citizens.
Some sensitive industries like defense will DEF require citizenship for getting immediate clearance OR future scenarios where you'll need a clearance