House Cybersecurity Subcommittee Hammers DHS on Staffing Delay

House Cybersecurity Subcommittee members hammered Department of Homeland Security officials at a hearing Wednesday for failing to fill cybersecurity vacancies. One DHS official blamed the delay partly on a pay-scale system designed in the 1940s, preventing the agency from hiring top talent.

Congress authorized DHS to address cybersecurity staffing shortages in 2014, but the agency is on pace to complete staffing in April 2019. Homeland Security Committee ranking member Bennie Thompson, D-Miss., noted in opening remarks that Assistant Secretary-Cybersecurity and Communications Jeanette Manfra testified in October that 24 percent of the fully funded cybersecurity workforce billets at DHS’ National Protection and Programs Directorate were unfilled. Thompson said maintaining a cybersecurity workforce is a national imperative, given everyday threats from Russia, Iran, North Korea and China. GAO Director-Information Security Issues Gregory Wilshusen told lawmakers that DHS “needs to take urgent action to identify” its staffing needs.

DHS Chief Human Capital Officer Angela Bailey said the agency knows what its critical needs are across 33 specialty areas, but it’s difficult to recruit and retain top-level talent when the pay scale means bachelor's degree holders make a few dollars above minimum wage in some states. The agency is designing a new personnel system and has briefed the White House and the Office of Management and Budget, and DHS is set to brief the Office of Personnel Management next week, she said. Bailey said the department knows it can no longer “Band-Aid” a 20th century personnel system. She said the candidates for cyber positions aren't necessarily looking to have 30-year careers with government. The approach is to retain employees for three to five years before they leave for the private sector, but DHS would like to see them eventually return, she said.

Rep. Tom Garrett, R-Va., is “incredibly frustrated” by delays, warning that U.S. enemies aren't holding off on finding ways to exploit American infrastructure. He said a cascading cyberthreat could kill half the U.S. population in a year. He asked Bailey if anyone has been fired or promoted after having failed to fulfill tasks associated with staffing, and what fears employees have if they don’t complete goals. Bailey said no one associated with the effort has been fired or promoted, and employees aren't living with fear but disappointment they can’t accomplish their goals because of competing priorities. NPPD Office of Human Capital Director Rita Moss said the agency continues to hire at a high level, but it’s suffering from attrition. Wilshusen said DHS first should to identify critical needs and determine which skill sets are required. Hiring those individuals won’t be easy, he said, because cyber professionals are in demand.