US Gov Removing Four-Year-Degree Requirements for Cyber Jobs | Hacker News Reader

US Gov Removing Four-Year-Degree Requirements for Cyber Jobs

securityweek.com

44 pointsalephnerd53 comments

I always thought the big elephant in the room for public vs private sector, especially the case for IT sector was the compensation leading to not being able to attract the best talent.

That is - regardless of people who already have 4 year degrees or not, in the private sector both categories of people who are already established and accomplished would have much more earning power.

Has this changed recently? If not I still think most of the best talent would be going to private sector. Sure with the recent amount of layoffs and what I've heard people saying is a general reduction in earnings for software devs and IT positions some people are looking for basically anything. While those are great people, the people doing the most impactful work likely weren't laid off in the first place in the majority of companies.

Government can still hire contractors or products from the private sector no?

Yes, but it is extremely budget constrained and there are a few companies who tune their business to this type of work. It's brutal.

If you need clearanced engineers the price goes through the roof.

Government pays IT fairly well compared to 95% of all IT jobs. It’s not paying FAANG wages, but more time off, less overtime, and pensions make direct salary comparisons misleading.

Honestly if I was starting over as a fresh graduate I’d probably try and get a government job. Job security makes a huge difference in lifetime earnings and several of my early jobs sucked.

And pension! At least in my circle

I agree with your first paragraph, not your second. A major downside to govt. tech is their overly conservative approach to adopting new technology, and generally low standard to overall speed of execution and productivity. You'll probably be safe if you stay in the same agency or related cluster, but I have found that people trying to break into the private sector or jump to a different jurisdiction with a totally different tech stack were either woefully under developed in terms of their skill set outside of the 20 year old proprietary stuff they were used to using, or were 0.1x developers compared to their private sector colleagues.

When you're young, you have the time and energy to toil hard for long hours and learn lots of new things. I would not waste that resource on a government job unless I were ready to make a career long commitment to it.

> tech is their overly conservative approach to adopting new technology, and generally low standard to overall speed of execution and productivity

Or, another reading would be that they're avoiding the hype cycle the private sector constantly falls into, and you won't be overworked/eventually stressed out because of the constant pressure from shareholders/executives/founders who want you to put 150% of your energy with no work/life balance into their "vision of supercharged spreadsheets" or something similar.

I personally wouldn't waste my youth on just slaving away at companies for money, but also spend time exploring the world and yourself while you're young enough to have the energy (and hopefully time) to do so.

My private sector jobs have largely used outdated or proprietary technologies. First job had me maintaining a ~30 year old Object Pascal project in the early 2000’s. They were still using AppleTalk instead of TCP/IP locally.

IMO keeping up is more about what you do in your free time rather than trying to actually work with whatever the new hotness is. So having free time is critical not just whatever technology you’re using at work. However, work for NASA for 40 years and what the industry does is irrelevant.

No it definitely does not. A GS-15, whose job duties would be equivalent to a CTO or principal engineer in private sector, makes _at least_ 3x less than the going rate. You are correct in that gov benefits are incredible.

>> Government pays IT fairly well compared to 95% of all IT jobs. It’s not paying FAANG wages, but more time off, less overtime, and pensions make direct salary comparisons misleading.

> No it definitely does not. A GS-15, whose job duties would be equivalent to a CTO or principal engineer in private sector, makes _at least_ 3x less than the going rate. You are correct in that gov benefits are incredible.

What's the government pay for a senior engineer, and what's your number for an equivalent private sector salary?

I’m in gov making 55K. My friends in private make 130K+.

Are they doing similar jobs near you? The cost of living adjustment hits 45% and that’s arguably low for San Francisco.

That's very low for a GSA role.

Are you state or local government?

Base salary for most GSA SWE roles tend to be around $70-140k base (GS-7 to GS-15).

I don't think I've ever met a sub-GS-7 SWE outside of those working on a military base directly or via a non-trad veteran hiring program.

It’s important to realize senior government roles are bumped up by years of service and local cost of living.

CTO’s pay varies wildly but the average is only ~175k you can make more than that in government. Yes Google’s CTO makes vastly more, but there’s 1,000 local banks for every Google. https://www.payscale.com/research/US/Job=Chief_Technology_Of...

In Arlington VA you’ll cap out at 33.26% over the GS-15 step 10 so 160k * 1.33 = 212k and someone with 40 years of service is looking at a 212 * 0.011 * 40 = 93k per year pension at 62 which then gets inflation adjustments. There’s people making 3x that but not that many of them.

> I always thought the big elephant in the room for public vs private sector, especially the case for IT sector was the compensation leading to not being able to attract the best talent.

Is the best talent only attracted by money in the US? Are none of these people OK with taking a X% paycut (just an example) in order to work on things that have higher impact?

Do the government even want people who work there to be working there only because it pays more? Is it possible that because the government pays less than the private sector, it ends up employing people who are more aligned, compared to if they just chunked more money at people?

As an example, if one superstar programmer went to NSA instead of the private sector because NSA paid the most out of the offers they got, doesn't that mean it'll be trivial to pull this person away from the NSA in the future, just by offering more cash? Wouldn't it kind of make sense for the NSA to want people to join them because of the mission/purpose/something else, so they can retain people based on those things rather than just money?

Edit: Changed 10% to X% as apparently that's the only thing people could focus on, instead of the more meaningful questions in my comment.

More like a 20-30% pay cut. You trade it for the only semblance of stability that exists for such jobs. We are used to getting chucked on the street every few years. Once you get into a gov job you are in until you leave.

There's a difference between contractor and actual government, in terms of stability and pay.

Anecdata but one coworker was making about 30% of what I do for similar work and they are similarly skilled. They are now within 10% of me having gone private.

And you are right in that you will never be fired.. and that is equally true for your worst colleagues, horrible managers and so on.

The pay differential is way more substantial than 10%. The Federal GS pay scale tops out at 159k in 2024. That’s a salary typically reserved for people who have spent years in government.

There are ways to get that number higher, but at the end of the day our best developers can grab multiples of the highest government salary in Silicon Valley fresh out of college.

There are people that go into government work for reasons of moral duty, but at the end of the day, it’s hard to compete with salary differentials measured in multiples.

To respond to your edit about ignoring the pay differential, and the other substance of your comments.

I did note that some people choose to work in government out of a sense of moral duty, but the fact of the matter is that you probably aren't going to be working on something that has any sort of impact, especially compared to what private enterprise offers. If you want to work on interesting aerospace projects, that's private sector. At the leading edge of computing, again private sector. Leading edge of hardware research, private sector.

The only place where you are going to make a big difference with a CS degree in government is likely doing nefarious stuff with 3 letter agencies. Maybe with climate and environment as well. But again, you can have a big impact in cybersecurity or climate modelling in private sector as well.

And we just can't discard the pay differential. There are cities where government workers have to get second jobs to make their bills. a 50% pay cut just can't be ignored.

The skilled people I know who work for the US government usually are very mission driven and/or working towards a pension. For foreign governments, people tell me they like the stability.

All of the world’s most successful unions (bar associations, the APA, UAPD..) achieved the greatly increased remuneration by increasing the costs and barriers to entry as much as possible. It makes sense that any employer would want to lower those barriers to entry as much as possible. The reason this trend across all employers has been emerging is simply because they started to realise they could get away with it, as in there were qualified candidates that didn’t have college degrees. All employers benefit from the increased labour pool from this, because increasing the supply of anything is going to put downward pressure on its price.

> The US government this week announced the removal of “unnecessary degree requirements” in favor of skills-based hiring as part of an aggressive push to fill half-a-million open cybersecurity jobs.

> The ‘Serve for America’ initiative, announced by National Cyber Director Harry Coker, removes the four-year degree requirement in federal IT contracts and will push agencies to hire based on experience, certifications, and aptitude tests.

I'd guess that only a tiny fraction of the (claimed) half-a-million cybersec openings are under direct Federal control. Vs. contractors, state agencies, etc. - all of which may have their own "4 year degrees" requirements, whether formally or informally.

Anyone familiar with this space?

A little -

The requirements for federal government were put out a long time ago (some scientific role job descriptions date from the 80's). This prevented a lot of new grads who had degrees in fields that didn't exist in the 20th century to get denied or delayed as someone hired to be a sysadmin, or cyber analysis didn't have the correct number of math courses. Basically only a CS degree counted.

Don't know about state/local governments, but the ones I have heard about were all over the place: some just copied the federal rules, some just hired whoever they could find.

I would guess the beltway bandits will eventually change their requirements to match the federal gov't. They are already a little more lax in some areas (like the number of math courses). They really just want to say "our people meet your qualifications".

Federal contracts have staffing requirements, so the government does hand down education and experience requirements that the contractors must meet when staffing. If you search jobs at federal contractors they often state the position requirements from the government, it's common to see things like "Requires bachelors degree with 10 years relevant experience or 6 years with masters degree", which come straight from the government.

I'd imagine it trickles down.

Alright, then, what should I be studying in my free time to qualify? I'm already hitting a career ceiling and a midlife crisis, this might really interest me.

Contact a recruiter and ask, maybe you could even get an apprenticeship / on the job training. I always thought the book "Code" by Charles Petzold was gold for new people to the industry.

Has a recruiter ever known anything about a job they list? 0 times in my life

Not in any particular order:

Java, Spring Boot, Angular 1 & 2, React, CSS design tokens like Tailwind or Bootstrap, Oracle DB, MySQL, PostgreSQL, AWS and AWS Gov Cloud, Amazon SQS, Kubernetes, Rancher, New Relic, GitHub and GitHub Actions, Service Now, Confluence, Jira, and so on.

Study up and understand AGILE workflows, and a 2 week 10 business day sprint working cycles. Then tie that back into continuous integration/continuous deployments mentioned above.

If you get a grasp of everything I mentioned above and build out your LinkedIn and resume with all of those skills, multiple recruiters will be in your inbox on a daily basis.

Thank you, I've already got a portion of that under my belt. Getting to work now...

Please don't take the parent too too seriously, they listed some fairly useful technologies that are widespread but some that are definitely more situationally needed/niche. I think they were speaking somewhat jokingly/ironically if you couldn't tell (listing 3 relational databases for example as if you need to have experience with all 3 rather than just _any_ relational database).

I've done work for places where both MySQL and PostgreSQL were used. In any case, I'm reasonably proficient with either.

Thanks.

I was not joking at all. I was 100% serious and listed technologies and skills that the U.S. government is actively recruiting for right now.

In that case I think you perhaps overstated what is necessary to get a US government job. Or to get a software engineering job in general. I get paid GS-15 level as a civilian and I've never touched Oracle DB, Tailwind, Rancher, or some other technologies you mentioned. Perhaps you didn't mean to imply a person need to know all those things to get a job, but it came across that way to me and I disagree.

Start with a Security+ cert. It is the baby entry level certification for information security, but it is widely respected. More importantly, it is the first level of candidate screening for IT employment in the federal government.

Graduate to the CISSP. It is a management certification, but for the last 20 years it has been considered the gold standard for information security employment, and that is likewise reflected in federal government employment.

If you want to work in any relation to the DOD you will need a security clearance. If you have a regular federal background check that is active you are immediately more employable than other people. If you have a secret you are supremely more employable than other people. If you have a TS you are more employable than having a secret and can demand a much higher salary as a contractor, but to use a TS you will likely have to work on site at a SCIF.

A graduate degree and prior military experience in a leadership capacity seem to be equally weighted for consideration in federal employment and are supremely beneficial. A graduate degree is more practical as military experience alone will not provide career elevation.

Specifically for Cyber offense/security jobs you need to aware of CVE reports, reporting processes, mitigation, and security operations. It's absolutely more administrative and operational than technical, but technical skills are nonetheless essential for consideration. You will also want to look at the GSEC certifications, but those are ridiculously expensive.

Thank you. About half of those acronyms I know. My military experience is not in the US and not in a leadership capacity anyway. I'll start learning, see where we are this time next year!

You also need US citizenship and the ability to pass a background check (and if you've been in IL for years, I don't think you'd pass that check), but tbh depending on when and which unit you served in the IDF along with your technical skills, I think you could network your way into some good private sector SWE and PM jobs in the US or TLV.

I don’t know about a secret clearance. That might require citizenship. Lesser federal background checks do not require US citizenship.

A TS absolutely requires singular US citizenship. I have met many soldiers that were happy to revoke their dual-citizenship status to advance their career in the US military. I can also fully understand and appreciate why a person would not want to do that.

This can be problematic in software engineering and real engineering roles.

I've worked at shops where they overpaid people but hired folks who didn't have CS degrees so they didn't understand time-space tradeoffs, algorithms, data structures, or how anything worked under the hood... they were just there to collect paychecks, lacked curiosity and pride for the craft, and went home.

The current salary cap for any programmer (or any non executive level roll) that is a federal employee is currently $191,900. I’m glad the hiring requirements are being updated but I’m concerned that making the lower bands easier to join without competitively hiring more senior people will make the federal workforce less effective.

I don't think it's possible to make the federal workforce less efficient.

Have you ever worked a regular office job in the private sector? It's not exactly better either

I would say it's far better in the private sector, but the bar is low.

I've worked both and, anecdotally, I didn't notice a real difference in efficiency. Public sector was plodding and methodical; private sector was faster but thrashed around wasting energy on the latest Top Priority project. Lots more tech debt in the private sector too. Speed isn't always efficient.

Methodical to their own ends without having to produce anything that even one member of the public wants, compared to thrashing around wasting energy on the latest Top Priority project that still has to actually make someone want to buy it. There is no comparison. Being methodical is not a value in and of itself, a serial killer can be methodical, that does not make them better than a plumber who is not particularly methodical.

The public sector is often inefficient and insulated from market forces but that doesn't imply that what they produce doesn't meet the needs or desires of citizens. And I've done a lot of work in the private sector that would never in a million years have an impact on the bottom line.

Inefficiencies are everywhere, denying the simplistic stereotype that that the public sector is unusually inefficient.

I thought this was already the case under the "exempted service" thingy? Or maybe that is only for military? US Cyber Command is a thing too for those unaware.

CyberCom is different. This is for civilian hiring via GSA

DoD (and a couple other agencies like the SEC) have their own talent and hiring pipeline, as well as their own pay schedules.

How many times can you use the word "cyber" in a news item before it becomes silly-sounding?

Will it be the occasion to lower the price developers in the public sector ? Or is it already too cheap ?

Why not pay for their education instead of eliminating requirements? "Degree is not required" seems like a lowering of the bar more than anything.

One costs money and one is free. Not really a tough decision. They probably have at least some sort of tuition reimbursement program as well.

Reply on news.ycombinator.com