Security Clearances for Cyber Jobs: UK SC, DV and US TS

Many of the best paid and most interesting cyber security roles in defence, intelligence, government and their supply chains are closed to anyone who cannot be cleared, and most candidates misunderstand how clearance actually works. You cannot buy a clearance, take a course for one or apply for one on your own: in both the UK and the US an employer or government sponsor starts the process because a specific post needs it. This guide explains the UK National Security Vetting levels (BPSS, CTC, SC, eSC, DV and eDV) and the US levels (Confidential, Secret, Top Secret and SCI access), what investigators look at, how long clearances last, how continuous vetting changes the picture and what a cyber professional can do to be a strong candidate. It is written for practitioners considering cleared work and for hiring managers writing job adverts for cleared posts. It is not legal or immigration advice; the official sources linked here are the authority. Facts were checked against UK government, DCSA, OPM and eCFR pages in November 2026.

Key takeaways

Clearance is sponsored, never self-applied. UKSV guidance says applicants need a sponsor, usually an HR officer or company security controller, and the DCSA states that individuals cannot apply for their own clearance.
The level follows the post, not the person. UK SC fits long-term, uncontrolled access to SECRET assets and DV fits frequent, uncontrolled access to TOP SECRET; in the US a clearance alone is not enough without a need to know.
Honesty outweighs a perfect past. GCHQ calls honesty the most important part of vetting, and a criminal record or past debt is judged case by case, while concealment is itself a reason for refusal.
Cyber behaviour is assessed directly. US adjudicative Guideline M covers misuse of information technology systems, and UK enhanced vetting includes an internet questionnaire, so unauthorised hacking, even "for learning", is a real risk to eligibility.
Clearances are reviewed and portable within limits. UK SC and DV have formal review periods, US personnel are enrolled in continuous vetting, and both systems allow clearances to transfer between sponsors under set rules.

Why clearance matters for cyber security careers

Cleared roles are not only in intelligence agencies. Security operations centres protecting classified networks, penetration testers working on defence systems, information system security officers on government programmes, cloud engineers supporting classified workloads and incident responders for national infrastructure all commonly need clearance. Defence suppliers also need cleared staff to work on contracts that involve classified material, which is why job adverts often say "SC required" or "active Secret clearance".

Market effect: because the employer carries the time and cost of sponsoring, employers often prefer candidates who already hold an active clearance that can be transferred. That makes a first cleared role the hardest step, and later moves easier.
Role design: the system security plan and access rules of a classified system decide who needs which level. If you are moving into this work, the Systems Security Officer Career Guide and the Security Control Assessor Career Guide describe two roles that almost always sit on cleared programmes.
Clearance versus screening: most private sector employers run pre-employment screening, not national security vetting. The Personnel Security and Background Screening Guide covers that baseline; this page covers government clearances only.

UK National Security Vetting levels

United Kingdom Security Vetting (UKSV), part of the Cabinet Office, describes itself as the single government provider of National Security Vetting (NSV). The UK protective marking scheme, the Government Security Classifications policy, has three tiers: OFFICIAL, SECRET and TOP SECRET. The clearance levels map to the access a post needs to those tiers. The table summarises the GOV.UK clearance levels page (last updated 23 September 2024).

Level	What the post needs	Main checks	Formal review
BPSS (Baseline Personnel Security Standard)	Not a clearance, but the prerequisite for every NSV level and the normal baseline for OFFICIAL work	Identity, right to work, employment history, unspent criminal records	Set by the employer
CTC (Counter Terrorist Check) and Level 1B	Proximity to at-risk public figures, access to material of value to terrorists, or unescorted access to establishments at risk of terrorist attack	BPSS, security questionnaire, records check, spent and unspent criminal records, Security Service records, interview only if concerns are unresolved	10 years, or 5 years for contractors without Facility Security Clearance (FSC)
SC (Security Check)	Long-term, frequent and uncontrolled access to SECRET assets and/or occasional supervised access to TOP SECRET	BPSS, questionnaire, records check, criminal records, credit and financial history via a credit reference agency, Security Service records; interview only exceptionally	10 years, or 7 years for non-FSC contractors
eSC (Enhanced Security Check)	Posts needing more assurance than SC but not DV, including some SECRET code word posts and posts designated for certain information systems	As SC plus financial and internet questionnaires, a full personal finance review and a detailed interview by a trained Investigating Officer	Not stated on the levels page
DV (Developed Vetting)	Frequent, uncontrolled access to TOP SECRET assets, or any access to TOP SECRET codeword material	BPSS, DV questionnaire, records and criminal checks, credit check, Security Service records, full finance review including a spouse or partner's joint position, Investigating Officer interview, referee interviews	No more than 7 years; the sponsor initiates renewal
eDV (Enhanced Developed Vetting)	A very small number of agreed posts needing assurance above DV	DV checks plus family and travel elements, supervisor interviews and a financial investigation	Not stated; requested only by a few sponsors with UKSV and Cabinet Office agreement

The risk owner can review a clearance earlier or grant a shorter one. The GOV.UK page notes that UK residency may affect the checks that can be carried out, so a candidate who has lived abroad should expect the sponsor to discuss what can be verified. The detailed policy sits in HMG Personnel Security Controls (version 6.0, October 2022), which introduced Level 1B, amended the rules for transferring clearances and allowed virtual interviews.

US clearance levels and investigations

In the US, Executive Order 13526 defines the classification levels by the damage unauthorised disclosure could reasonably be expected to cause, and section 4.1 allows access only when three conditions are met: a favourable eligibility determination, a signed nondisclosure agreement and a need to know. For contractors, the Defense Counterintelligence and Security Agency (DCSA) runs investigations and adjudication.

Level	EO 13526 damage test	Typical cyber roles	Notes from DCSA
Confidential	"Damage" to national security	Rare as a job requirement on its own	Same investigation basis as Secret
Secret	"Serious damage"	SOC analysts, system administrators and ISSOs on classified networks, many defence contractor posts	Interim Secret possible after favourable SF-86 review, fingerprint check and proof of citizenship
Top Secret	"Exceptionally grave damage"	Intelligence community engineers, red teams and incident responders for national systems	Deeper investigation than Secret
SCI and SAP access	Not a level: controlled access within a level	Signals intelligence and special programme work	Requires special approval on top of eligibility

The questionnaire: applicants complete the SF-86, Questionnaire for National Security Positions (revised November 2016), through the eApp system. It asks for 10 years of residence and employment history with no gaps, and it warns that knowingly falsifying or concealing a material fact is a felony under 18 U.S.C. 1001.
Timing of sponsorship: DCSA allows processing once a person is hired into a job needing classified access, or with a written, accepted job offer where employment starts within 30 days of eligibility.
Citizenship: DCSA states that non-US citizens are generally ineligible; a Limited Access Authorization is possible in rare cases.
Investigation tiers: under the Federal Investigative Standards, Secret and Confidential eligibility normally rests on a Tier 3 investigation and Top Secret on a Tier 5 investigation.
Polygraph: some agencies and some SCI posts add a polygraph examination; the job advert usually states this, for example "TS/SCI with polygraph".

What vetting looks at, and what it means for cyber people

Both systems are risk judgements about trustworthiness, not pass or fail tests of a clean history. US adjudicators apply the "whole person concept" set out in 32 CFR Part 147: they weigh favourable and unfavourable information, the seriousness, recency and frequency of conduct and the likelihood of recurrence, and resolve any doubt in favour of national security. UK vetting looks at similar areas through questionnaires, records, finances and interviews.

Area	US guideline (32 CFR 147)	UK check	What a cyber candidate should know
Use of IT systems	Guideline M: misuse of information technology systems, including unauthorised entry, modification, destruction or denial of access to information, and introducing or removing hardware, software or media where rules prohibit it	Internet questionnaire at eSC; interviews cover personal, professional and online life (GCHQ)	Testing systems without written authorisation, cracking accounts you do not own or running tools on an employer network against policy are exactly the conduct this guideline describes. Keep lab work on your own kit and keep written scope for every engagement
Finances	Guideline F: financial considerations	Credit and financial history from SC; full finance review at eSC and DV	Debt is assessed for vulnerability to pressure; unexplained affluence, including from cryptocurrency, should be documented
Foreign contacts and influence	Guidelines B and C: foreign influence and foreign preference	Questionnaire, Security Service records; family and travel elements at eDV	International conference contacts, bug bounty platforms and overseas collaborators are normal, but must be declared accurately
Personal conduct and honesty	Guideline E: personal conduct	UKSV can refuse or withdraw clearance for lying or withholding	Omissions found later are often treated more seriously than the original issue
Criminal conduct and drugs	Guidelines J and H	Spent and unspent criminal records; GCHQ applies a no-drugs policy from the moment of application	Computer misuse offences are especially relevant to cyber roles
Security behaviour	Guideline K: security violations	Records check of security records	Past handling of sensitive data at work, including data loss incidents, can be reviewed

The full list in 32 CFR 147 runs from Guideline A (allegiance to the United States) to Guideline M; the intelligence community reissued the guidelines as Security Executive Agent Directive 4. A single adverse matter does not by itself decide the case, but a recent or recurring pattern can.

How to get cleared: a practical route

Target posts that sponsor. Look for adverts saying the employer will sponsor clearance or that candidates must be "eligible for SC" or "able to obtain a Secret clearance", rather than "active clearance required". Government departments, defence primes and their managed service providers sponsor most first clearances.
Check basic eligibility before applying. In the US that means citizenship. In the UK, confirm with the recruiter what residency history the post's level needs, because UK residency affects which checks can be completed.
Get your records in order. UKSV asks applicants to prepare identity documents, name change documents, three months of bank and card statements, loan details and payslips. For the SF-86, assemble 10 years of addresses, employers, references and foreign travel with no gaps.
Complete BPSS or pre-employment checks. In the UK the sponsor completes BPSS first, then creates the NSV application in the National Security Vetting Solution.
Prepare for the interview honestly. UK eSC and DV interviews usually last about three hours and are mostly held by video call; US investigations include subject interviews. Answer fully, including about online activity and security research.
Do not resign early. UKSV advises applicants not to leave their current job until the sponsor confirms clearance is granted and a start date is set. Neither system publishes a guaranteed timescale.
Know the appeal route. In the UK, employees and contractors can appeal a refusal or withdrawal internally and then to the Security Vetting Appeals Panel, notifying it in writing within 28 days; applicants without a job offer cannot. In the US, a denied or revoked contractor can request a DOHA hearing and appeal, and may reapply one year after the final decision.

Keeping a clearance: aftercare, continuous vetting and transfers

UK aftercare: UKSV states that all clearances are kept under review. Holders report changes of personal circumstances (CPC form) and sponsors must tell UKSV when someone no longer needs clearance or leaves. DV renewal is due at intervals of no more than seven years.
US continuous vetting: DCSA enrols DoD personnel in Continuous Vetting under Trusted Workforce 2.0, using automated record checks and business rules, and requires an updated SF-86 every five years.
Portability: DCSA says clearances generally transfer between federal agencies because all use the same adjudicative guidelines, with reciprocity encouraged by OMB and the DNI through SEAD 7. In the UK, HMG Personnel Security Controls sets the rules for transferring clearances between sponsors.
Lapse: a US contractor clearance remains in effect while the person stays with the cleared contractor and needs access; DCSA tells Facility Security Officers to reduce clearances that are no longer needed. Leaving cleared work for a long period can mean a fresh application later.

Decision guidance: is cleared work right for you?

If you...	Consider	Trade-off
Are early in your career and eligible	Graduate or apprentice schemes in government or defence that sponsor SC or DV	Long lead times and restrictions on what you can say publicly about your work
Hold private sector experience and want stable demand	Defence supplier or managed service roles advertised as "eligible for SC" or Secret	Offers can be conditional for months; on-site working on classified systems is common
Do public research, conference talks or bug bounties	Cleared roles remain possible, with full declaration and pre-publication rules	Some posts restrict publishing, travel or foreign collaboration
Have lived abroad recently or hold another nationality	Ask the sponsor early what checks the post's level needs	US posts generally need citizenship; UK checks depend on what can be verified
Want flexible remote work and open source visibility	Uncleared commercial roles, or OFFICIAL work needing only BPSS	Fewer public sector and defence opportunities

Small versus large employers: large departments and defence primes have dedicated vetting teams and sponsor routinely. Small consultancies often need a government customer or a prime to sponsor, so ask in the interview who the sponsor will be and whether the firm holds a Facility Security Clearance (UK) or facility clearance (US).

For hiring managers: writing and filling cleared posts

Set the level from the access, not the job title. Use NIST SP 800-53 control PS-2 (Position Risk Designation) logic: assess what the post can see or change, then choose the lowest level that covers it. Over-specifying DV narrows the pool and slows hiring.
Say whether you sponsor. "Active SC required" excludes most new entrants; "SC eligible, sponsorship provided" widens it.
Do not ask candidates to apply themselves. Both systems require the sponsor to start the process.
Remember that clearance is not authorisation. Access to systems still needs need-to-know, signed access agreements (PS-6) and account approval. Administrators of classified networks also hold privileged and service accounts; govern them as you would anywhere else, as covered in the Insider Threat Programme Guide.
Plan for offboarding. When a cleared employee leaves, tell the vetting authority, debrief them and remove access promptly (PS-4).

Common failure patterns

Omitting "minor" things: leaving out an old debt, a short overseas job or a past drug use on the questionnaire. Concealment is grounds for refusal in the UK and a felony risk on the SF-86.
Unauthorised security testing: scanning or accessing systems without written permission, including former employers' or friends' systems, maps directly to Guideline M and can also be a computer misuse offence.
Resigning before the clearance is granted: UKSV explicitly warns against leaving a current job before the sponsor confirms the start date.
Gaps in history: the SF-86 asks for 10 years of residence and employment with no gaps; unexplained gaps delay investigations.
Undeclared changes after grant: new partners, significant debts, foreign travel or contacts not reported through aftercare or continuous vetting channels can lead to review or withdrawal.
Treating clearance as a qualification: listing a lapsed or inactive clearance as if it were current misleads employers; state the level, the date and whether it is active.

Framework mapping for employers

Framework	Reference	How it relates
NIST SP 800-53 Rev 5	PS-2 Position Risk Designation; PS-3 Personnel Screening; PS-3(1) Classified Information	Designate positions by risk and screen before access; PS-3(1) covers clearance for classified information
NIST SP 800-53 Rev 5	PS-4 Personnel Termination; PS-5 Personnel Transfer; PS-6 Access Agreements; PS-7 External Personnel Security	Offboarding, moves between posts, nondisclosure agreements and contractor requirements
NIST CSF 2.0	GV.RR-04	Cybersecurity is included in human resources practices, including screening
ISO/IEC 27001:2022 Annex A	A.6.1 Screening; A.6.6 Confidentiality or non-disclosure agreements	Background verification proportionate to the classification of information accessed
US policy	EO 13526 s4.1; 32 CFR Part 147	Access conditions and adjudicative guidelines
UK policy	HMG Personnel Security Controls; Government Security Classifications	NSV levels, aftercare and classification tiers

For the full control family see the NIST SP 800-53 PS Personnel Security page.

Measuring a cleared hiring pipeline

Time to clearance: median days from sponsor submission to grant, by level.
Offer drop-out rate: share of conditional offers withdrawn by candidates while vetting is pending.
Over-specification rate: share of posts whose required level is reduced after a PS-2 style access review.
Aftercare timeliness: share of changes of circumstances reported within the sponsor's required period.
Leaver notification: days from a cleared person leaving to notification of the vetting authority and access removal.

Practitioner checklist

Confirm the clearance level the post needs and whether the employer sponsors it.
Check citizenship (US) or residency history questions (UK) with the recruiter before applying.
Gather 10 years of addresses, employers and travel, plus recent financial statements.
Keep all security testing on your own equipment or under written authorisation.
Declare everything relevant, including foreign contacts, debts and online research activity.
Do not resign from your current role until the clearance and start date are confirmed.
After grant, report changes of circumstances promptly and keep a record of your clearance level, sponsor and review date.
For hiring managers: set the level by access, state sponsorship clearly and plan leaver notification.

Security Clearances for Cyber Security Jobs: How UK and US Vetting Works for Candidates