CISA entered fiscal year 2025 with approximately 3,400 employees. By December 2025, that number had dropped to roughly 2,400 — a reduction of nearly 1,000 workers, or 29% of the entire agency workforce. Over 100 cybersecurity specialists were cut in a single action when DOGE scrapped the red team contracts. The agency’s election security program, which had operated since 2018, was eliminated along with its 14 specialized positions.

This is not a normal budget cycle. Analysts who’ve tracked government cybersecurity for decades have described it as the first time in the digital era that the U.S. government’s cyber defense capacity has measurably contracted rather than grown. Critical industry sectors — energy, water, financial services — rely on CISA for threat intelligence sharing, incident response support, and technical assistance. That capacity is gone.

For the professionals who lived through this, the immediate question isn’t historical. It’s: what do you do now?

What Actually Happened at CISA

The cuts came in waves, not as a single reduction. Early termination notices targeted employees who had already signed onto the federal government’s deferred resignation program — people who thought they had negotiated an off-ramp and instead found themselves cut without the agreed-upon terms. Disabled veterans were among those receiving termination notices.

The red team contract cancellations eliminated not just positions but institutional knowledge. CISA’s red teams conducted the kind of adversarial testing that hardened federal agency defenses against real attack patterns. Rebuilding that function — if the next administration chooses to — will take years.

The election security program’s elimination creates the most visible gap. With midterm elections in 2026, the 14 specialized positions that supported state and local election infrastructure security are simply gone. That’s not a capability that gets improvised by reassigning other staff.

What This Means for Federal Cybersecurity as a Career Path

The honest assessment: the federal cybersecurity career path is more volatile than it has ever been, and professionals considering it should factor in that volatility explicitly.

That said, “federal cybersecurity is risky” doesn’t mean “federal cybersecurity is over.” Several factors still make it viable:

  • Mission work is real. The professionals who choose federal careers generally know why they’re there. That hasn’t changed.
  • Clearances are an asset with long shelf lives. TS/SCI clearances remain extremely valuable in the private sector and take 18–24 months to obtain. Professionals holding active clearances are immediately deployable.
  • DoD and IC hiring continues. The cuts concentrated at DHS/CISA. Defense and intelligence community cyber hiring has not seen the same reduction and in some areas has accelerated due to the national security implications of weakened civilian cyber defenses.
  • Future administrations reverse course. The pendulum swings. Professionals who stay in or adjacent to the field will be well-positioned when rebuilding begins.

If you’re a student evaluating a federal career for the first time, this is a reasonable time to hedge: build a clearance path if you want, but also develop private sector-competitive skills simultaneously, rather than treating the two as mutually exclusive tracks.

How Former Federal Cyber Professionals Pivot to the Private Sector

For the professionals who are already out, here’s what the pivot actually looks like.

Skills That Transfer Directly

Federal cybersecurity work develops skills that private sector organizations struggle to hire for:

  • Threat intelligence analysis — CISA analysts worked with classified and unclassified intelligence that directly maps to threat intel roles at financial institutions, critical infrastructure operators, and MSSP threat intel teams
  • Incident response under pressure — Federal IR work involves coordinating with multiple agencies, managing political sensitivities, and operating with incomplete information. That’s directly applicable to enterprise IR roles
  • Red team tradecraft — The red teamers whose contracts were cut are among the most technically skilled offensive security practitioners in the country. Private sector demand for this skill set is extremely high
  • Election/OT security expertise — The election security specialists have operational technology (OT) security skills that transfer to industrial security, energy sector, and critical infrastructure protection roles

Positioning Your Clearance

A TS/SCI clearance is worth approximately $20,000–$40,000 in salary premium in the private sector, depending on role and industry. Position it correctly:

  • List it prominently on your resume and LinkedIn — cleared professionals use “TS/SCI” in their headline
  • Target employers with classified programs or government contracting arms: Leidos, SAIC, Booz Allen, MITRE, Palantir, and the big defense contractors all have cleared talent pipelines
  • Don’t assume your clearance will remain active indefinitely — it requires sponsorship. Move quickly to find a cleared employer if your clearance is active
  • Critical infrastructure sectors (energy, finance, healthcare) increasingly value cleared candidates even for unclassified roles because of the vetting history and trustworthiness signal

Industries Actively Hiring Former Federal Cyber Professionals

Financial services: Banks and financial institutions need threat intelligence analysts and IR professionals with the kind of sophisticated adversary understanding that comes from federal service. The financial sector faces nation-state threats directly and pays well for the expertise to understand them.

Defense contractors: Booz Allen, SAIC, Leidos, MITRE, and similar firms are essentially the private-sector extension of federal cybersecurity capacity and actively recruit CISA alumni.

Critical infrastructure operators: Energy companies, water utilities, and telecommunications providers are suddenly more aware that the federal backstop they relied on is thinner. They’re building internal capability as a result.

MSSPs and threat intelligence firms: CrowdStrike, Mandiant/Google, Recorded Future, and similar firms prize analysts with federal threat intelligence backgrounds. The salary jump going from GS-13/14 to a private sector threat intel role can be $30,000–$60,000.

Resume and Narrative Framing

The challenge for many federal professionals is translating classified or sensitive work into resume language that communicates value without violating NDAs or classification rules. The approach:

  • Describe the scale and impact of your work rather than specifics: “Supported incident response for 47 federal agency networks” is more compelling than technical jargon
  • Quantify where possible: number of agencies supported, volume of threat indicators processed, response time improvements
  • The mission context is a selling point: “Defended critical national infrastructure against nation-state adversaries” is a headline, not a liability

The Broader Lesson

CISA’s workforce reduction is a reminder that no career path — public or private — is permanently stable. Professionals who treated federal employment as a secure long-term default are recalibrating that assumption.

The counterweight: the skills that federal cybersecurity careers develop are genuinely hard to acquire elsewhere. The professionals coming out of CISA’s threat hunting, red team, and incident response functions are among the most experienced in the field. The market will absorb them.

If you’re one of them, the trajectory is clear: move fast on clearance sponsorship, target the industries that face the adversaries you understand, and lead with the mission context that private sector organizations struggle to replicate internally.

The government will eventually rebuild. But the private sector is hiring now.