Mark Gorak is a self-proclaimed “resource guy.”
That means he knows — more or less — what he’s got, and what he needs. And what he needs, is people.
“[In the services], we’re not having a problem recruiting cyber talent,” he said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore. “Our retention is where we’re having a challenge.”
Gorak, the principal director for resources and analysis for the Pentagon’s Chief Information Officer, said DoD has 27,000 vacancies, down from 30,000 last year. The total cyber defense workforce is comprised of roughly 225,000 service members, civilians and contractors.
Gorak said there is interest in working for the government or serve in the military. The public sector has always been able to emphasize a unique mission and a stable career. While that has been — and is — a selling point, leaders said they also need to use authorities to pay competitively and offer training. Otherwise, government will lose workers to the private sector or other agencies who are also competing for this great need.
Messaging is a part of the problem, Gorak said, especially in the search for early career talent.
“I talk to students and I tell them, ‘You can join the Department of Defense as a civilian,’” Gorak said. “They look at me like I’m cross-eyed. [They say], ‘I had no idea that we have 900,000 civilians in the DoD.’”
There is some headway being made, with the department announcing on June 12 its new Cyber Academic Engagement Office, led by Gorak. The goal is to have a dedicated office for coordinating and funding academic engagement programs for the department.
The other aspect of solving the people problem is organizing all the different pay authorities, work roles, skill requirements and types of hires across the Defense Department.
Take, for example, the basic IT job in the government, called a “2210.” Gorak said there are 54,022 employees with this position description performing 72 different work roles, illustrating how one occupation can manifest into different work depending on the office.
That’s part of what makes classification difficult, especially as technology constantly evolves to require new skills or training. The DoD Cyber Framework originally had 54 distinct work rules; now it has 72.
So, recruiters need to understand the actual work being done in order to look for it in the job market, classify it correctly, and then compensate it competitively, Gorak said.
“If you’re a GS-12 and you’re an expert, you should get paid a lot more than a GS-12 who’s at a basic level,” he added. “Pay for performance. Pay for what your actual expertise is. That’s the system we have to get.”
DoD has a number of authorities available that allow it to pay recruitment and retention bonuses, set higher starting salaries and reward high achievers. The department has direct hire authority to circumvent the USAJobs application process. The DoD Cyber Excepted Service offers a market-based pay structure that can offer as much as a 40% salary increase, Gorak said.
So far, about 15,000 positions are eligible for CES, but only 9,000 of them have actually been converted. Gorak’s team has worked to make some improvements to encourage conversion, including allowing individuals to convert instead of requiring that of an entire organization and letting the services delegate that process in-house instead of relying on one office process all conversion packets.
The only combatant command that is fully eligible for CES is Cybercom. Army Cyber Command is the second biggest.
Still, part of the reason available flexibilities haven’t been used is they’re expensive. In other cases, HR personnel don’t know they exist or aren’t trained on how to use them. That’s also why time-to-hire even for positions that should be fast-tracked remains lengthy.
On the civilian side, hiring timelines hardly improved from 2022 to 2023, and 2210 IT workers remain among the slowest to onboard.
In the meantime, the department — alongside other civilian agencies — has recognized that young people can attain digital skills without a college degree. The government is coming around to that trend, but it’s still a new way of thinking for some.
“I contend to you that there are people out there today ... working in their bedroom upstairs who are outstanding cyber professionals who can do this job, but because they don’t have the experience and they don’t have the degree and they don’t have whatever certs we think are hot right now, we don’t hire them,” he said. “I think that is a mistake by the federal government, and we have to get past it.”
Molly Weisner is a staff reporter for Federal Times where she covers labor, policy and contracting pertaining to the government workforce. She made previous stops at USA Today and McClatchy as a digital producer, and worked at The New York Times as a copy editor. Molly majored in journalism at the University of North Carolina at Chapel Hill.
