A Top Secret / Sensitive Compartmented Information (TS/SCI) clearance is the single highest-use credential a cybersecurity professional can hold in the U.S. Labor market in 2026. The premium is not theoretical. ZipRecruiter’s aggregated postings for TS/SCI cybersecurity analysts in the Washington DC locality average $149,398 in 2026, against the Bureau of Labor Statistics OEWS Information Security Analyst national median of $124,910 in the May 2024 release. The ClearanceJobs 2024 Compensation Report places the cleared cyber premium at roughly $30,000 to $45,000 over commercial equivalents at the mid-career band, with a full-scope polygraph adding another $20,000 to $40,000 on top. That spread is the price the federal government, the intelligence community, and their prime contractors pay to access a workforce that has been investigated, polygraphed, and adjudicated to handle the most sensitive compartments of national security information.
The cleared cybersecurity hiring market is also unusual in that it is supply-constrained, not demand-constrained. The Defense Counterintelligence and Security Agency (DCSA) investigation throughput is a hard ceiling on how fast new TS/SCI holders enter the workforce, and the agency has been working through a multi-year backlog of initial and periodic-reinvestigation cases since the 2018 transfer of the security clearance mission out of the legacy National Background Investigations Bureau and the subsequent rollout of Trusted Workforce 2.0. The PRC’s Volt Typhoon campaign — the People’s Republic of China’s pre-positioning operations inside U.S. Critical infrastructure that CISA Director Jen Easterly confirmed in a February 2024 statement — accelerated cleared cyber hiring across the Department of Defense, the intelligence community, and CISA itself. That structural shortage is the reason a portable, current TS/SCI is worth more in 2026 than most of the certifications stacked on top of it.
What does TS/SCI actually mean, and how is it different from a plain Top Secret?
Top Secret is the third tier of the U.S. Government’s three-level collateral classification system, above Confidential and Secret. The investigative basis is the Tier 5 background investigation, governed by the Federal Investigative Standards and conducted by DCSA. SCI — Sensitive Compartmented Information — is not a clearance level. It is an access caveat layered on top of an existing Top Secret eligibility, granting read-in rights to one or more intelligence community compartments under the Director of National Intelligence’s authority. A TS/SCI holder has passed the Tier 5 plus the additional SCI adjudication standards defined in Intelligence Community Directive 704, and in most intelligence and DoD cyber roles will also have completed a counterintelligence or full-scope polygraph examination. The 13 adjudicative guidelines applied at every stage are codified in Security Executive Agent Directive 4 (SEAD-4).
The practical difference between a plain Top Secret and a TS/SCI is the set of contracts and program offices that will return your call. Cyber roles at the National Security Agency, the Central Intelligence Agency, the Defense Intelligence Agency, the National Reconnaissance Office, the National Geospatial-Intelligence Agency, and U.S. Cyber Command effectively require TS/SCI eligibility as a floor. Prime contractors staffing these programs — Booz Allen Hamilton, Leidos, ManTech, CACI, SAIC, Northrop Grumman, Lockheed Martin, Peraton, and the dozens of specialty cyber subcontractors operating inside their teaming agreements — price their cleared billets accordingly. Easterly framed the demand picture in plain language at the February 2024 Volt Typhoon press briefing: PRC actors “are positioning themselves on critical infrastructure” to disrupt rather than to spy — and the cleared workforce hiring posture across CISA, USCYBERCOM, and the service cyber commands has not slowed since. Our internal cybersecurity salary guide tracks the resulting spread quarter by quarter.
How much do TS/SCI cyber jobs pay in 2026, by role and locality?
Salary ranges below combine the BLS Occupational Employment Statistics for Information Security Analysts (SOC 15-1212) from the May 2024 release, the Office of Personnel Management 2026 General Schedule locality pay tables, the ClearanceJobs 2024 Compensation Report, and live posting data from ZipRecruiter, PayScale, Glassdoor, and CyberSecJobs anonymized user survey responses. Cleared figures assume an active TS/SCI; commercial figures are uncleared baselines for the same job title.
| Role (cleared cyber, 2026) | Commercial range | TS/SCI cleared range | Clearance premium |
|---|---|---|---|
| SOC Analyst, Tier 1 | $55,000–$78,000 | $75,000–$105,000 | +$20K–$27K |
| SOC Analyst, Senior | $85,000–$120,000 | $115,000–$165,000 | +$30K–$45K |
| Penetration Tester | $67,000–$151,000 | $95,000–$190,000 | +$28K–$39K |
| Cybersecurity Analyst, DC | $95,000–$130,000 | $130,000–$170,000 | +$35K–$40K |
| Security Engineer | $85,000–$160,000 | $120,000–$200,000 | +$35K–$40K |
Federal civilian roles follow the General Schedule and the 2210 Information Technology Management job series. In the DC locality, the OPM 2026 table places a GS-13 Step 5 at $138,024 and a GS-14 Step 5 at $163,104; the GS-15 Step 5 figure is $192,288. A polygraphed TS/SCI bench at NSA or the CIA Directorate of Digital Innovation routinely fills its mid-career cyber billets at GS-13 and GS-14. The Senior Executive Service range in 2026 runs $200,000 to $232,600, with the Executive Schedule IV cap at $197,200 governing most agency component heads.
Which agencies and primes hire the most TS/SCI cyber talent?
Roughly six federal customers and a dozen prime contractors drive the bulk of TS/SCI cyber demand. On the federal side: the National Security Agency is the largest single buyer of cleared cyber labor, followed by U.S. Cyber Command, the Defense Information Systems Agency (DISA), the Defense Intelligence Agency, the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation Cyber Division. The National Reconnaissance Office, the National Geospatial-Intelligence Agency, and the Department of Energy’s national labs round out the high-end intelligence and weapons-program cyber pipeline. FBI Cyber Division Assistant Director Bryan Vorndran testified before Congress in March 2024 that PRC state-sponsored intrusions had reached “every sector you can think of,” framing the operational tempo the FBI’s cleared cyber workforce is hiring against.
On the prime contractor side, Booz Allen Hamilton, Leidos, ManTech, CACI, SAIC, Northrop Grumman, Lockheed Martin, Peraton, KBR, and General Dynamics Information Technology carry the largest cleared cyber rosters by headcount. Specialty cyber houses — Parsons, ARSIEM, Govini, Two Six Technologies, Parry Labs, and Anduril’s cyber teams — recruit aggressively against the primes for senior reverse engineers, exploit developers, and offensive cyber operators billable on USCYBERCOM and intelligence community task orders.
The cleared cyber labor pool the FBI and the rest of the intelligence community draw from is, by every measure, undersized. Rob Joyce, who served as NSA Director of Cybersecurity until April 2024 and as the White House Cyber Coordinator before that, has argued publicly through long-form LinkedIn posts and his keynote at the RSA Conference 2024 that adversary tempo is outpacing the cleared talent pipeline — particularly for offensive cyber operators and reverse engineers who can transition smoothly between commercial threat-intel work and SCI-compartmented mission work. The Trusted Workforce 2.0 throughput improvements at DCSA help on the margin, but Joyce’s framing is the working assumption inside agency hiring shops: TS/SCI billets stay open longer than commercial cyber billets, and they pay a premium specifically because of that supply gap.
| Agency (2026) | Headquarters | Cyber mission focus | Typical clearance bar | Common career-entry route |
|---|---|---|---|---|
| NSA | Fort Meade, MD | SIGINT, cryptanalysis, cyber operations, defensive cyber | TS/SCI with full-scope polygraph | NSA Development Program; civilian direct hire; service cryptologic ratings |
| USCYBERCOM | Fort Meade, MD | Defensive + offensive cyber operations; National Mission Force | TS/SCI; full-scope poly for some mission elements | Military cyber career fields; civilian DoD 8140 billets |
| DISA | Fort Meade, MD | DoD network defense, DODIN operations, JFHQ-DODIN | TS/SCI for most cyber billets | Civilian GS-2210; prime contractor task orders |
| CISA | Arlington, VA | Critical infrastructure protection, federal civilian cyber defense, JCDC | Secret minimum; TS/SCI for many hunt and JCDC roles | Cyber Talent Management System direct hire; GS-2210 |
| FBI Cyber Division | Washington, DC | Criminal + national-security cyber investigations; attribution | TS with SCI eligibility | Special Agent route; computer scientist civilian path |
| DIA | Joint Base Anacostia-Bolling, DC | All-source intel; Defense Cyber Crime Center support | TS/SCI; CI polygraph standard | DIA civilian; service intelligence MOS transfer |
What certifications matter most for a TS/SCI cyber career?
The Department of Defense’s DoD 8140 directive sets the qualification baseline for cyberspace work roles on DoD networks, and a TS/SCI holder targeting a federal billet should treat 8140 alignment as table stakes. CompTIA Security+ at $404 and roughly 90 prep hours is the most common entry-level 8140 box-check. CISSP, at $749 and roughly 150 prep hours through ISC2, becomes mandatory for most IAT Level III and IAM Level III roles. Offensive operators — red team, exploit development, vulnerability research — lean heavily on Offensive Security’s OSCP (delivered through the PEN-200 course/exam bundle), and the GIAC stack — GCIH, GCFA, GPEN — is the dominant SANS-aligned credentialing path inside the intelligence community.
| Certification (2026) | Issuer | List cost (2026) | Typical prep | DoD 8140 |
|---|---|---|---|---|
| Security+ | CompTIA | $404 | 90 hrs | Yes — IAT II baseline |
| CySA+ | CompTIA | $404 | 120 hrs | Yes — CSSP Analyst |
| CISSP | ISC2 | $749 | 150 hrs | Yes — IAT III + IAM III |
| OSCP | OffSec | $1,649 (PEN-200 bundle) | 300+ hrs | Yes — CSSP Auditor |
| GCIH | GIAC | $979 challenge / $2,499 via SANS | 120 hrs | Yes — CSSP Incident Responder |
For toolchain-specific credentials, the cleared market has converged on a handful of platforms: Splunk dominates SIEM workflows across DoD networks, CrowdStrike Falcon is the EDR of record across many intelligence community endpoints, and offensive operators are expected to be fluent in Kali Linux tooling. Vendor specialty certs do not replace 8140-aligned credentials, but they accelerate billable utilization the moment a recruiter places you on a task order.
How do you get sponsored for a TS/SCI if you do not have one?
The blunt answer: by getting hired into a billet that is funded for a Tier 5 plus SCI investigation. The U.S. Government does not issue clearances to individuals. It issues them to people occupying specific positions on contracts or in federal civil service slots that have a need-to-know justification. That means the most reliable path to a first TS/SCI is to identify a hiring agency or prime contractor with current TS/SCI requisitions, apply against the interim Secret eligibility most cyber roles allow you to start under, and let the sponsor walk you through the SF-86 (eApp), the Tier 5 investigation, the SCI adjudication, and any program-specific polygraph.
The single biggest accelerator is a prior military or federal cyber background. Service members coming out of Air Force 3D0X3 Cyber Surety, Marine Corps 0689 Cyber Security Technician, or Navy CTN Cryptologic Technician (Networks) billets routinely separate with a current TS/SCI already in hand — or with a recent enough investigation that DCSA can crossover the eligibility within weeks rather than months. Our service-to-civilian guides for 3D0X3, CTN, and 1N4X1A Cyber Intel Fusion Analyst walk through which billets translate cleanest into civilian cyber roles.
What does the TS/SCI investigation actually look like in 2026?
The Tier 5 investigation is the most thorough background check in routine government use. DCSA investigators reconstruct a complete 10-year (sometimes 15-year) personal history covering residences, employment, education, foreign travel, foreign contacts, financial records, criminal history, drug use, and psychological history. Investigators interview the applicant in a Subject Interview, then independently contact references including supervisors, neighbors, and personal sources nominated on the SF-86. Adjudicators apply the 13 adjudicative guidelines from Security Executive Agent Directive 4 against the resulting Investigative Service Provider report.
SCI eligibility layered on top adds the ICD 704 adjudication. Most intelligence community programs and several DoD compartments require a counterintelligence (CI) polygraph; NSA and CIA Directorate of Operations programs add a lifestyle scope or full-scope examination covering drug use, foreign contacts, and personal conduct. Total elapsed time from SF-86 submission to badge-in-hand in 2026 typically runs 12 to 18 months for an initial TS/SCI with polygraph — down from the 18 to 24 months that was common during the 2018-2020 DCSA backlog peak per Federal News Network’s DCSA coverage, but still measurably longer than a Secret-only Tier 3 case. The DCSA Trusted Workforce 2.0 rollout has compressed many cases by transitioning periodic reinvestigations to continuous evaluation, but the initial-investigation queue remains the binding constraint.
| Clearance level (2026) | Investigative tier | Polygraph required | Typical processing time | Cleared cyber premium vs commercial |
|---|---|---|---|---|
| Public Trust | Tier 1 / Tier 2 | None | 2-6 months | +$5K-$10K |
| Secret | Tier 3 (T3) | None | 3-9 months | +$10K-$20K |
| Top Secret (collateral) | Tier 5 (T5) | None standard | 8-14 months | +$20K-$35K |
| TS/SCI (CI poly) | Tier 5 + ICD 704 SCI | CI polygraph | 12-18 months | +$30K-$45K |
| TS/SCI (Full-Scope poly) | Tier 5 + ICD 704 + lifestyle scope | Full-scope (CI + lifestyle) | 14-22 months | +$45K-$70K |
Where in the United States are TS/SCI cyber jobs concentrated?
Three geographies account for the overwhelming majority of TS/SCI cyber demand. The Washington DC National Capital Region — Fort Meade for NSA and USCYBERCOM, Langley for CIA, the Pentagon for OSD and the Joint Staff, Springfield for NGA, Chantilly for NRO, and the contractor corridor along Tysons, Reston, Herndon, and Columbia — is by far the largest single cleared cyber market. Colorado Springs is the second concentration, anchored by U.S. Space Command, Space Force, and the cyber elements of NORTHCOM. Hampton Roads, Virginia, picks up Fleet Cyber Command (FLTCYBER) and Joint Force Headquarters-Cyber for the Navy.
Outside those three, you will find pockets of TS/SCI cyber demand around the Texas Cryptologic Center in San Antonio, the Georgia Cryptologic Center at Fort Eisenhower (the Army’s October 2023 redesignation of Fort Gordon), the Hawaii Cryptologic Center at Wahiawa, and federally funded research and development centers like MITRE in Bedford and McLean, Sandia in Albuquerque and Livermore, and the Johns Hopkins Applied Physics Laboratory in Laurel.
How do you keep a TS/SCI portable and current?
A clearance is not yours. The sponsoring agency or contracting facility owns it. When you change employers, the new sponsor must crossover the eligibility — effectively re-reading you into their facility under their Facility Security Officer. That crossover takes days to weeks if your eligibility is current, much longer if it has lapsed. The single biggest mistake mid-career cleared professionals make is letting a 24-month period elapse between cleared engagements without remaining in DCSA continuous evaluation under Trusted Workforce 2.0. After 24 months out of cleared work, DCSA typically requires a fresh investigation rather than a debrief-and-reinstate per the agency’s published policy on reinstatement windows.
Frequently asked questions
Can I get a TS/SCI without a college degree?
Yes. Neither the Tier 5 investigation nor the SCI adjudication under ICD 704 has a degree requirement. Many cleared cyber operators enter the workforce through military cyber career fields and never complete a four-year degree. The degree question is a hiring-manager filter, not a clearance filter — and many federal cyber roles waive degree requirements in favor of certifications like CISSP, GIAC, or OSCP plus relevant cleared experience under DoD 8140 alignment.
Will marijuana use disqualify me from a TS/SCI?
Recent marijuana use creates a material adjudicative concern under Security Executive Agent Directive 4 Guideline H. ODNI guidance issued in December 2021 directed adjudicators to evaluate past use in context rather than apply a per se bar, but most intelligence community polygraph programs still expect multi-year abstinence (commonly 12 to 24 months) before submission. Fabricating non-use on the SF-86 or on polygraph is a far larger problem than past use itself.
How much does a polygraph add to a TS/SCI salary?
A clean counterintelligence polygraph adds roughly $10,000 to $20,000 over a non-polygraphed TS/SCI of equivalent role, per the ClearanceJobs 2024 Compensation Report. A full-scope polygraph — CI plus lifestyle — can add another $15,000 to $25,000 on top of that, particularly in NSA and CIA contract ecosystems where full-scope is the entry bar for certain compartments. Total polygraph premium over a commercial baseline frequently reaches $40,000 to $60,000 for senior roles.
Can foreign nationals or dual citizens get a TS/SCI?
U.S. Citizenship is a hard prerequisite for any TS/SCI. Dual citizenship is not an automatic disqualifier but is treated under SEAD-4 Guideline B (Foreign Influence). Most intelligence community adjudicators expect dual citizens to renounce the foreign citizenship or at minimum surrender the foreign passport to their FSO as a condition of SCI access.
How long can a TS/SCI stay active after I leave a cleared job?
Eligibility is administratively debriefed when you leave the sponsoring program. Reinstatement without a new investigation is generally available for up to 24 months from debrief date, provided no derogatory information has surfaced and your continuous evaluation under Trusted Workforce 2.0 remains in good standing. Past 24 months, DCSA typically requires a fresh Tier 5 investigation rather than a paper-only crossover.
Which agencies are easiest to break into as a first TS/SCI hire?
CISA’s Cyber Talent Management System direct-hire authority and DISA’s civilian GS-2210 pipeline are the lowest-friction federal on-ramps for first-time TS/SCI candidates. On the contractor side, Booz Allen Hamilton, Leidos, and CACI run the largest “uncleared-to-cleared” sponsorship programs for entry-level cyber analysts — they will sponsor an interim Secret on day one and walk a candidate through the Tier 5 plus SCI investigation while billing them on a Secret-tier task order until the full clearance adjudicates.
Where to look next
- Cybersecurity salary guide — the underlying 2026 compensation tables this article draws from.
- Google Cybersecurity Professional Certificate — the most accessible on-ramp credential for career changers entering cleared cyber.
- Splunk for cleared SOC analysts — toolchain-specific skills guide for the dominant SIEM in cleared environments.
- CrowdStrike for cleared endpoint security — EDR skills that translate directly to intelligence community programs.
- Kali Linux for cleared penetration testers — offensive-side toolchain primer.
- 3D0X3 Cyber Surety to cleared civilian — transition guide for Air Force cyber technicians.
- CTN to cleared civilian — transition guide for Navy network cryptologic technicians.
- 1N4X1A Cyber Intel Fusion Analyst — transition guide for the Air Force fusion analyst billet.
- ICS/SCADA cybersecurity careers in the defense sector — cleared OT specialization companion.