DOD official: We need to drop the cybersecurity talent hiring window to 25 days

Mark Gorak outlined that the department has seen a drop in the time it takes to hire, but much more work is needed.

The Department of Defense is seeking to address persistent shortages in its cyber workforce by reducing the time to fill vacant cybersecurity jobs to 25 days. The target, outlined by a senior official during a recent discussion, comes as the department faces a shortfall of nearly 20,000 cyber professionals within its ranks, a figure that reflects broader national trends.

Mark Gorak, who manages the DOD’s cyber workforce, described the scale of the challenge Thursday at FedTalks, produced by Scoop News Group. He noted that the department’s cyber component alone consists of approximately 245,000 personnel, while the wider Department of Defense encompasses about 4 million. The vacancy rate, which recently dropped below 10%, remains a significant concern, as the nation as a whole is estimated to be short by 500,000 to 700,000 cyber experts.

Efforts to accelerate hiring have already yielded some results. The department currently averages 70 days to hire, a figure that compares favorably to the federal government’s 80-day benchmark but lags behind the private sector, where technical hiring can take as little as 46 days. The new 25-day target, if achieved, would represent a substantial shift in federal hiring practices.

Central to the department’s strategy is a move toward skills-based hiring. Gorak emphasized a departure from traditional requirements such as advanced degrees, certifications, or lengthy experience. Instead, candidates will be evaluated on their ability to perform job-specific tasks, often through the use of cyber ranges — simulated environments designed to assess technical proficiency. The department is developing 30-minute assessment ranges to quickly determine whether applicants can meet the demands of the role.

“My number one goal is skills-based hiring in the department,” Gorak said. “I don’t care what your occupational series is. I don’t care what your [Military Occupational Specialty] is. I care about what you do and if you’re qualified to do it.”

The shift comes amid rapid technological change, particularly in artificial intelligence. The official noted that the department is updating its work roles and the associated knowledge, skills, abilities, and tasks (KSATs) every 90 days to keep pace with evolving cyber threats and tools. The use of AI is being encouraged within the workforce, with Gorak acknowledging that many federal employees have yet to adopt such technologies in their daily work.

“Right now, AI is exponentially increasing,” he said. “Every month, right now, we’re changing our AI capabilities. We have to keep up.”

The department’s approach also involves collaboration with industry, academia, and other government partners. Gorak, who now leads the newly established Cyber Academic Engagement Office, underscored the need for a broad coalition to address the workforce gap.

“Congress gave me a task. I appointed a director. I don’t have funding, I don’t have resources, I don’t have people,” he said. “I firmly believe we need industry, academia, civilians and military to solve our challenges.”

Open-source security is posing challenges governments can’t easily solve

A diffuse landscape, fruitful targets, companies not stepping up, AI’s influence and flagging U.S. government efforts all figure into a shifting threat.

DOD wants to integrate cyber in all operations, and integrate security into AI

Trump officials are steering a cybersecurity scholarship program toward AI

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure