DOD needs to staff up to hire Cyber Excepted Service personnel, officials say

The Department of Defense finally has the plan and the authority to more quickly hire cyberwarriors — now it just lacks a dedicated staff big enough to recruit and bring thousands of information security specialists onboard across the military, Pentagon leaders said Tuesday.

Top defense IT officials detailed progress around the rollout of the Cyber Excepted Service personnel system, based on an authority Congress granted the Pentagon in 2016 to fast track the hiring of civilian cybersecurity specialists. While the department has moved on to the second phase of its CES plan, resources are lacking to recruit new talent at the scale the military services require, they said.

“The resources in the building are lacking for us, both internally and then at the service level, to make sure we can handle that workload we are addressing,” Brig. Gen. Dennis Crall, deputy principal cyber adviser for DOD, told members of the House Armed Service Committee.

Currently, there’s a staff of about five dedicated to the management of the CES process. But Crall said he’s developing a request to bring on about five or six more so DOD can hire cybersecurity specialists at a greater scale across the department, alluding to “thousands that need to be brought in and the training that’s required.”

“We have identified inside the building, and I have a request that we’re putting together right now that will be making its rounds to Mr. [Dana] Deasy here shortly that asks for some more resourcing inside the building to get after unfolding this a bit faster,” he said. “We could do a bit better inside the building to get after it, and I’m articulating what those specific needs are.”

Lawmakers were worried that despite giving DOD this authority, the department has only used it to hire cyber professionals for the U.S. Cyber Command, the Joint Forces HQ-DOD Information Networks and within the DOD CIO’s Office. That, however, was by design for a slower roll out during the first phase, Crall said.

Phase one was “modest by design … to make sure we knew what we were doing,” he said. “Were we trained properly, could we track those individuals properly?” In the ongoing phase two, which is focused on hiring for the Defense Information Systems Agency and the military services, activity will be “exponentially higher in number.” And that’s why the Pentagon needs more staff, “both internally and then at the service level, to make sure we can handle that workload we are addressing,” Crall said.

The Pentagon needs people “to dedicate the right number and the right mix to get after this at scale, and that scale has to change for us to meet pace,” he said.

Deasy, the department’s CIO, acknowledged that it takes a specialized staff to hire for the CES.

“This isn’t a case of the volume of people we need inside my respective organization or working on Gen. Crall’s cross-functional team,” he said. “This is about competencies that need to exist in them. This is a new way of doing business. And more importantly, the [personnel and readiness] organization in the respective military services need to train up at a faster rate the people that they need to bring on board to actually accelerate the Cyber Excepted Service.”

The hard part isn’t necessarily keeping people excited about mission once they arrive at the Pentagon, Deasy said — “but it’s how do we create a better avenue of awareness” for opportunities.

The Defense Digital Service is trying to tackle the issue as well. It recently issued a request for information looking to create a “Civilian Hiring as a Service Pilot Program.” The idea is that DDS would bring in a support service from industry to assist “with recruiting technical talent from industry and federal/state/local government into the Department of Defense.”

Crall agreed that the DOD and military services struggle to understand the market for talent.

“In many cases, we think we know where we should be recruiting, and we may not be recruiting to the level we should,” he said. “So understanding the type of applicant we’re looking for and the needs of those applicants, we need to bolster our understanding a little bit better.”

During Tuesday’s hearing, Deasy also discussed the department’s highly contentious Joint Enterprise Defense Infrastructure (JEDI) cloud contract and how protests of it are hurting DOD’s vision for cloud across the military.