Find a way to retain cyber pros, Pentagon personnel guru says

Mark Gorak is a self-proclaimed “resource guy.”

That means he knows — more or less — what he’s got, and what he needs. And what he needs, is people.

“[In the services], we’re not having a problem recruiting cyber talent,” he said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore. “Our retention is where we’re having a challenge.”

Gorak, the principal director for resources and analysis for the Pentagon’s Chief Information Officer, said DoD has 27,000 vacancies, down from 30,000 last year. The total cyber defense workforce is comprised of roughly 225,000 service members, civilians and contractors.

Gorak said there is interest in working for the government or serve in the military. The public sector has always been able to emphasize a unique mission and a stable career. While that has been — and is — a selling point, leaders said they also need to use authorities to pay competitively and offer training. Otherwise, government will lose workers to the private sector or other agencies who are also competing for this great need.

Messaging is a part of the problem, Gorak said, especially in the search for early career talent.

“I talk to students and I tell them, ‘You can join the Department of Defense as a civilian,’” Gorak said. “They look at me like I’m cross-eyed. [They say], ‘I had no idea that we have 900,000 civilians in the DoD.’”

There is some headway being made, with the department announcing on June 12 its new Cyber Academic Engagement Office, led by Gorak. The goal is to have a dedicated office for coordinating and funding academic engagement programs for the department.

The other aspect of solving the people problem is organizing all the different pay authorities, work roles, skill requirements and types of hires across the Defense Department.

Take, for example, the basic IT job in the government, called a “2210.” Gorak said there are 54,022 employees with this position description performing 72 different work roles, illustrating how one occupation can manifest into different work depending on the office.

That’s part of what makes classification difficult, especially as technology constantly evolves to require new skills or training. The DoD Cyber Framework originally had 54 distinct work rules; now it has 72.

So, recruiters need to understand the actual work being done in order to look for it in the job market, classify it correctly, and then compensate it competitively, Gorak said.

“If you’re a GS-12 and you’re an expert, you should get paid a lot more than a GS-12 who’s at a basic level,” he added. “Pay for performance. Pay for what your actual expertise is. That’s the system we have to get.”

DoD has a number of authorities available that allow it to pay recruitment and retention bonuses, set higher starting salaries and reward high achievers. The department has direct hire authority to circumvent the USAJobs application process. The DoD Cyber Excepted Service offers a market-based pay structure that can offer as much as a 40% salary increase, Gorak said.

So far, about 15,000 positions are eligible for CES, but only 9,000 of them have actually been converted. Gorak’s team has worked to make some improvements to encourage conversion, including allowing individuals to convert instead of requiring that of an entire organization and letting the services delegate that process in-house instead of relying on one office process all conversion packets.

The only combatant command that is fully eligible for CES is Cybercom. Army Cyber Command is the second biggest.

Still, part of the reason available flexibilities haven’t been used is they’re expensive. In other cases, HR personnel don’t know they exist or aren’t trained on how to use them. That’s also why time-to-hire even for positions that should be fast-tracked remains lengthy.

On the civilian side, hiring timelines hardly improved from 2022 to 2023, and 2210 IT workers remain among the slowest to onboard.

In the meantime, the department — alongside other civilian agencies — has recognized that young people can attain digital skills without a college degree. The government is coming around to that trend, but it’s still a new way of thinking for some.

“I contend to you that there are people out there today ... working in their bedroom upstairs who are outstanding cyber professionals who can do this job, but because they don’t have the experience and they don’t have the degree and they don’t have whatever certs we think are hot right now, we don’t hire them,” he said. “I think that is a mistake by the federal government, and we have to get past it.”

Molly Weisner is a staff reporter for Federal Times where she covers labor, policy and contracting pertaining to the government workforce. She made previous stops at USA Today and McClatchy as a digital producer, and worked at The New York Times as a copy editor. Molly majored in journalism at the University of North Carolina at Chapel Hill.

马克·戈拉克自称是“资源专家”。

这意味着他或多或少知道自己拥有什么，以及需要什么。而他需要的，是人。

“（在军队方面），我们招募网络安全人才不成问题，”他在巴尔的摩举行的由国际武装部队通信与电子协会主办的2024年TechNet网络安全大会上说。“我们面临的挑战是如何留住人才。”

五角大楼首席信息官办公室资源与分析主管戈拉克表示，国防部目前有2.7万个职位空缺，低于去年的3万个。网络防御人员总数约为22.5万人，包括军人、文职人员和承包商。

戈拉克表示，人们对在政府部门工作或参军很感兴趣。公共部门一直以来都强调其独特的使命和稳定的职业发展。虽然这过去是、现在仍然是一个优势，但领导们表示，他们也需要利用职权提供具有竞争力的薪酬和培训。否则，政府将会流失人才，这些人才可能会流向私营部门或其他也在争夺这一巨大需求的机构。

戈拉克表示，信息传递是问题的一部分，尤其是在寻找早期职业人才方面。

戈拉克说：“我跟学生们说，‘你们可以以文职人员的身份加入国防部。’他们都用看怪人的眼神看着我，好像我是个斗鸡眼。[他们说]，‘我以前根本不知道国防部有90万文职人员。’”

目前已取得一些进展，该系于6月12日宣布成立新的网络学术交流办公室，由戈拉克领导。其目标是设立一个专门的办公室，负责协调和资助该系的学术交流项目。

解决人员问题的另一个方面是协调国防部内所有不同的薪酬权限、工作角色、技能要求和招聘类型。

以政府部门的基本 IT 工作为例，称为“2210”。戈拉克表示，有 54,022 名员工拥有此职位描述，从事 72 种不同的工作角色，这表明一个职业如何根据办公室的不同而表现为不同的工作。

这正是分类工作的难点之一，尤其是在技术不断发展，需要新的技能或培训的情况下。美国国防部网络框架最初有54条不同的工作规则；现在增加到了72条。

戈拉克说，因此，招聘人员需要了解实际的工作内容，才能在就业市场中寻找合适的职位，正确地对其进行分类，然后给予有竞争力的薪酬。

“如果你是GS-12级别的专家，你的薪水应该比那些只是初级水平的GS-12级别员工高得多，”他补充道。“应该按绩效付费，按你的实际专业水平付费。这才是我们必须建立的体系。”

国防部拥有多项授权，可以发放招聘和留任奖金、设定更高的起薪并奖励优秀员工。该部门拥有直接聘用权，可以绕过美国政府招聘网站（USAJobs）的申请流程。戈拉克表示，国防部网络安全特许服务部门提供基于市场的薪酬结构，最高可达40%的薪资涨幅。

目前，约有15,000个职位符合CES（员工转型计划）的资格，但实际完成转换的只有9,000个。Gorak的团队致力于改进流程以鼓励转换，包括允许个人进行转换而非要求整个组织转换，以及允许各部门自行处理转换流程，而不是依赖单一办公室处理所有转换申请。

唯一完全符合CES资格的作战司令部是网络司令部。陆军网络司令部是规模第二大的作战司令部。

然而，现有灵活政策未被充分利用的部分原因是其成本高昂。在其他情况下，人力资源人员要么不知道这些政策的存在，要么没有接受过相关培训。这也是为什么即使是那些本应快速招聘的职位，招聘周期仍然很长的原因。

在民用领域，2022 年至 2023 年的招聘进度几乎没有改善，2210 IT 员工的入职速度仍然是最慢的群体之一。

与此同时，该部门与其他民事机构一道，已经意识到年轻人无需大学学位也能掌握数字技能。政府正在逐渐接受这一趋势，但对一些人来说，这仍然是一种新的思维方式。

“我认为，如今有很多网络安全专业人士，他们可能就在楼上的卧室里埋头苦干，完全能够胜任这份工作。但因为他们缺乏经验、没有学位，也没有我们现在认为热门的那些证书，所以我们不雇用他们，”他说道。“我认为这是联邦政府的一个错误，我们必须纠正这个错误。”

莫莉·韦斯纳是《联邦时报》的专职记者，主要报道与政府劳动力相关的劳工、政策和合同方面的新闻。她曾先后在《今日美国》和麦克拉奇报业集团担任数字内容制作人，并在《纽约时报》担任过文字编辑。莫莉毕业于北卡罗来纳大学教堂山分校，主修新闻学。