Security clearance jobs: will security make it hard to get work done?

Question

In many government or defense contractor jobs, some level of security clearance is required because the work is supposed to be "secret". In other words, employees aren't allowed to talk about what they do with anyone. This makes it hard for an outsider to assess the true nature of a workplace with clearance requirements.

I have been thinking about finding work in places that require security clearance. Technically some of work appears very interesting, but I have concerns about whether such a job will have such onerous security that it becomes miserable because I won't have access to the resources I need to do my job.

Specifically, I would like to know from others who have held security jobs, how draconian is security as far as getting work done?

Specifically:

• Will I be able to "google" for information or can I expect the network to be completely locked down to the outside?
• How "good" are internal sources for reference information? (If I can't use outside resources)

From what I understand, going through the security clearance process is very invasive, time-consuming and iffy as far as actually being granted clearance. It would be profoundly disappointing to go through all that and then end-up in a miserable "top-secret" place.

Answer 1

Let's start from the beginning. Just to set the stage, with the exception of a TA position that I held in college, every job (summer job, co-op, internship, full-time position) I've ever had has been in the defense industry, either as a government civilian employee or at a defense contractor. In addition, I've only applied to one job outside of the defense/intelligence sector. I'm planning on spending my entire career in this industry.

The notion that employers aren't allowed to talk about what they do is incorrect. I was a candidate for a position at a Department of Defense intelligence agency that specializes in signals intelligence, the protection of US communication and network systems, information security, and cryptography/cryptanalysis. At the time of the interview, I did not have the appropriate clearance to even enter their primary facility - I was interviewed off-site, in a remote location, and couldn't go much beyond the lobby and interview areas. However, I was able to ask questions about the type of work I would be doing - the office environment, the tools and technologies, and the problems being worked on (or problems representative of those being worked on). Often, it's not the problems that are classified, but the solutions to those problems and the capabilities generated. I was able to learn enough about what that particular team did to say that I was not interested in the position for moral and ethical reasons.

During the application and interview process, you should be able to learn enough about the position to be able to make an informed decision about what type of work you will be doing in the job. And learning about the work environment aspects of the job would be the same as any other job - ask about culture, benefits, opportunities for growth and development. In a government agency, those are often public information since it's consistent across agencies and departments. In a contractor environment, they'll be more than happy to discuss those things, since that's typically an HR topic that applies regardless of the project or program.

In terms of politics in the office, I've never encountered that, and when talking to friends of mine outside of the defense industry, it seems pretty similar in nature. I would suspect that this is more of a corporate culture thing rather than something that can be generalized to the defense industry or government contractors.

Security at work varies. Most places will provide people with an unclassified workspace in addition to workspaces in classified environments. At my desk, I have nearly free access to the Internet. However, in a classified environment, you don't have this access. Much of the work that I've seen done actually happens in unclassified environments and is then brought into classified environments because the actual, real-world data that the systems operate over is classified. The system itself might be proprietary, and sometimes even open source.

As far as getting a security clearance, the forms are somewhat time consuming. You need to often recount your jobs, addresses, friends, colleagues, and family going back 5-15 years depending on the type of clearance investigation. Depending on some of your answers, there might be interviews, polygraphs, and questionnaires to fill out. You can see the forms online, such as the SF-86 (PDF here), which is used for DoD Secret clearance (and perhaps other agencies as well - I'm only familiar with DoD).

Answer 2

I have a security clearance. Actual classified work is done on a segregated network (not connected to the internet), in rooms with special security provisions. However, most work is not actually classified. We do our work (developing software) in a regular office environment, and if we need access to classified data we go to the lab.

Most large companies have some IT restrictions; you are likely to find sites like YouTube, Facebook, and Blogspot blocked. However, that has nothing to do with security clearances.

If you interview at a company that requires a security clearance, the odds are very good that they will still be able to talk to you about the work in enough detail for you to decide whether you want to work there. Not everything that happens at such a company is classified.

If the entire facility is classified (it's one big class-lab), you won't be able to go through the door without a clearance.

Answer 3

I've worked in both the private sector and clearance-requiring defense projects over the course of my career. I like both, but I would say they are different.

There is no "one size fits all" in clearance-requiring work. I strongly advise that you consider each opportunity as it comes up.

Here's some points of variation:

• Security controls required for handling classified information. The sensitivity of the information and the nature of the project will dictate this. It will vary for both printed material and electronic material. It can be as easy as not taking paperwork out of the space you are working in or as hard as having to lock up any secret information in a safe before you leave.
• The nature of the work environment - can be anything from a totally isolated LAN to work on a corporate network that is not fundamentally different from any other company. I have yet to see or hear of a developer position that utterly denied employees ANY access to the Internet for legitimate work-related browsing purposes. Mileage varies significantly on the definition of "legitimate" and the level of network lockdown.
• The state of the technology. Unlike the current high profile companies in tech, the defense industry has a VERY long lifecycle. Equipping an entire service of the armed forces is not trivial. This is one of the few industries that still has a need for very legacy technology skills - if this is your cup of tea, the resources available internally are often BETTER than the resources on the Internet.
• Instrusiveness for background check varies by both the level of clearance, the type material being accessed, and the nature of the government branch for which you work. Be aware that not every war story you hear will apply to the procedures of the process you go through.

Things that don't vary - the quality of the people, the quality of the management. There are incredibly smart people in this industry, and some really great managers. And there are the polar opposites. For the most part, the awesome ones tend to keep a low profile and be very laid back... it's not an industry for flashy show-off personality types, as so much of the work is only seen by a limited community.

COTS technologies - while there is plenty of speciality code, COTS is as seductive to governments as to private companies. There are plenty of opportunities to stay on up to date, cross-marketable COTS products.

Things to ask before jumping on board

• options for work/life balance - are likely to be different. Companies are still looking for creative answers, but some of the physical protections of security are simply not available at home - so like any company - figure out the rules and the corporate culture before joining.

• the nature of the background check - they should know what level of clearance they want you to have. And how intrusive that will be. Also get a sense of how much higher your clearance needs may go. Often companies will start someone at a lower level, because it is expensive to upgrade clearances and the number of slots at higher levels is not infinite. So get both the hear and now answer as well as the in the future take.

• what is the project's technology? What is the likelihood of shift between projects, and what other technology might be involved? They can't usually answer a specific "this project uses X/Y/Z questions. But they should be able to give you a sense as to whether the whole place is a JEE shop or if it's 10% .NET and 90% VAX programming!

• What is the response to a security violation? Everyone screws up once and a while - the big question is what does the company do in response? Knowing how this works before you go in may help you decide if this work is for you.

Answer 4

My first job after university was for a defence contractor. I moved on after a few years because even though I was working on defence systems rather than offence systems, I decided that it conflicted too much with my moral stance. This side of things is a personal decision that only you can answer.

When I moved into the commercial sector, there was little difference. Work I did was covered under Non disclosure agreements rather than under The Official Secrets Act but the onus on me was still to keep the confidences of my employer with regard to my work.

In either environment I could talk about how I was treated, complain about tight schedules, and bemoan (in non specific terms) customers changing their specifications all of the time, and in neither environment could I talk about who my customer was or what I was helping to build for them.

Anywhere with serious security concerns will have specific policies to address those concerns. Whether you are working on missile guidance systems or anti-virus software, there may be some networks with no connection to the Internet. You may even have to work inside a TEMPEST hardened vault, where you are searched for phones/memory sticks before you are allowed entry. In a commercial environment though, you could easily be stuck in a back room or basement with no natural light and a proxy server set up by a BOFH.

Alternatively, you may just have a desk with a multiple computers, and an air-gap between them, so all you have to do to switch from a secure network computer to internet capable computer is to swing from one keyboard to another. Sure, you lose being able to copy/paste between them (compared to using a VPN to access a more secure network) but it doesn't impact on productivity that much.

Ultimately, a security vetted job is not really any different to any other job, it's just that the priorities and consequences can be rather different. If you don't think you can cope with it ethically, steer clear, otherwise keep your nose clean and you could get to work on some interesting and unique projects.

Answer 5

I spent 15 years in the defense industry, and I think the most relevant thing I can tell you about the effect of security on your work environment is that it varies a lot.

I regularly found that directives from the Pentagon seemed pretty reasonable and sensible to me. Than our local base security people would interpret them in what I considered bizarre ways.

For example, there was a Pentagon directive that said that you shouldn't download software from unknown or untrusted sites and install it on government computers. Well that seemed like plain common sense to me: don't download a game from hackers-are-us.com and install it on a secure system. I had no problem with that. Our base security people interpreted that to mean that we could not use any open source software.

Example 2: The Pentagon said not to do development work on production systems. Again, an obvious common sense rule that most developers would say "duh". Our base security people interpreted that to mean that you could not have production and development systems on the same network, i.e. we were not allowed to do development work on the base network. So we said okay, we'll just set up a private network for development. No, they said, all computers on base must be connected to the base network so we can administer security policies. So how are we supposed to do development? They didn't have an answer. Danced around that for years.

My point being, how the rules are interpreted may well vary between bases, companies, etc.

On the positive side, I once attended a lecture on security where they said that security rules must strike a balance between being strict enough to keep unauthorized people out while being loose enough that authorized people can do their jobs.

Like almost anywhere in life, I guess, there are rational people and there are insane people.

Answer 6

Security Policies

Security policies for classified work vary greatly depending on the classification level of the program, the company, and the actual personnel who establish the security policies. At one extreme are programs where the vast majority of work is unclassified and performed on unclassified networks and can be freely discussed except for very specific technical details. In cases like this even entire software specifications and algorithm documents could be unclassified and only actual performance numbers would be protected. In those cases your work might be entirely in the white world and only become classified when it was paired with classified inputs. In a situation like this you'd be able to talk about a great deal and learn quite a bit about the potential job before starting.

On the other end of the spectrum are programs whose very names are classified. Almost all program work will occur on dedicated networks without an internet connection and with tedious, one-way processes for moving information onto them from the unclassified side (e.g. burning CDs). In this type of environment you may only have access to the internet at kiosk-type computers far away from your normal desk or lab work environment, which would prevent you from using google or Stack Overflow while you work. Furthermore, the hardware and software configuration of the equipment on the network is closely monitored and cannot be changed without extensive paperwork. This means the machines are often slow and obsolete, hard drive space is often at a premium, software is out-of-date and infrequently patched, and getting new software to help you do your job goes from a huge pain that makes it likely not worth the effort to straight-up impossible. In part it is this environment that underlies the incredible cost of defense programs.

Clearance process

The clearance process is also a function of the type of clearance. At the most basic it's a questionnaire about where you lived and worked. Lots of paperwork but not to bad and if you haven't spent significant time abroad or have contacts with foreign nationals it's straightforward. For higher-levels there are more questions that go back further and the process will involve in-person interviews with investigators, who will also talk to friends and family and ultimately with people who you know whose names you did not provide. Polygraphs might be required, both initially and periodically and you may have to get prior permission to go on foreign travel.

Risk and Reward

So there can be clear downsides to working in a classified environment and for many it is not their cup of tea. That said, there are things developed in those environments that are lightyears ahead of anything happening in the outside world. The trouble and inconvenient is often overwhelmed by the compelling nature of working on and solving these problems and being able to work closely with world experts in particular technologies and fields.