What Is the Cyber Excepted Service?

You apply to a DoD cyber job on USAJOBS. The posting says "CES" or "Cyber Excepted Service." The pay looks different. There are no GS grades listed. You see "pay bands" and wonder what that means for your salary.

You are not alone. Many veterans with IT and cyber backgrounds hit this wall. They know the GS-2210 IT Specialist series inside and out. But CES throws them off because it works differently from the General Schedule.

The Cyber Excepted Service is a separate pay and hiring system. DoD created it in 2016 under Title 10, Section 1599f. It covers civilian cybersecurity jobs across all DoD components. Army Cyber Command, the NSA, DISA, US Cyber Command, and the service cyber centers all hire under CES. DHS runs a similar Cyber Talent Management System (CTMS) for its own workforce.

CES exists because DoD could not compete with private sector cyber salaries under the old GS system. A GS-13 Step 1 in the DC area pays about $117,962 in 2025. A mid-level cybersecurity analyst at a defense contractor might pull $140,000 or more. CES gives DoD the flexibility to pay closer to market rates and hire faster than the traditional competitive service process.

How Do CES Pay Bands Work?

CES replaces the 15 GS grades with broader pay bands. Each band covers a range of work. Your exact salary within the band depends on your skills, experience, and how well you perform. There are no fixed steps like in the GS system.

That last part matters. Under GS, you wait for step increases on a set timeline. One year between Steps 1 and 2. Two years between Steps 4 and 5. Three years between Steps 7 and beyond. CES does not use steps at all. Your pay moves based on performance reviews, not time in grade.

The CES pay structure has five main developmental bands and two management bands:

The management bands (Supervisory and Executive) mirror Bands IV and V but add supervisory duties and pay premiums.

One big difference from GS: the pay bands overlap. A strong performer in Band II can earn more than a new Band III employee. This is by design. DoD wanted to reward skill and results, not just seniority.

Joshua Applied to 50+ Federal Jobs.
BMR Got Him Referred at GS-12 and GS-13.

"First time eligible at GS-12 AND GS-13. Referred to the hiring manager for both."
— Joshua, E-9, Army

OPM data built in — goes beyond the job announcement Full 2-page federal format for USAJOBS Tailored to every GS position you apply for

Get My Free Resume

2 free tailored resumes, cover letters & LinkedIn optimization

How Does CES Pay Compare to GS?

Veterans who understand the GS system often want a direct comparison. Here is how CES bands roughly line up with GS grades and real dollar amounts.

A GS-13 in 2026 earns $117,962 to $153,354 in the DC area (with locality). A CES Band III role covers that same range and goes higher. At the top of Band III, you could earn over $190,000. That is more than a GS-14 salary at most steps.

CES also still uses locality pay adjustments. If you work in the DC area, San Jose, or New York, your CES salary goes up just like it would under GS. The base pay band ranges get the same locality percentage on top.

This is similar to how AcqDemo pay works for the acquisition workforce. DoD has been testing pay band systems for years. AcqDemo proved the concept. CES applies it specifically to cyber roles.

What Are the CES Work Roles Under DoD 8140?

CES jobs are organized around the NICE Workforce Framework from NIST. DoD uses this framework through DoD Directive 8140 (which replaced the older 8570 directive). Each CES position maps to a specific "work role" that defines what you do and what qualifications you need.

There are over 50 NICE work roles. Here are the ones most common in CES postings that veterans apply to:

• Cyber Defense Analyst (CDA): Monitor networks, analyze alerts, respond to incidents. Band II or III. Common entry point for veterans with Security+ and network experience.
• Vulnerability Assessment Analyst (VAA): Run scans, find weaknesses, report findings. Band II or III. Veterans who ran vulnerability scans on military networks fit here.
• Cyber Defense Infrastructure Support (CDIS): Build and maintain defensive tools. Firewalls, SIEM systems, endpoint protection. Band II or III.
• Systems Security Analyst (SSA): Assess system security posture, write security documentation, manage ATO packages. Band II or III. Common for veterans who handled RMF or DIACAP.
• Exploitation Analyst: Offensive cyber operations. Band III or IV. Requires specific training and clearances. Veterans from military CNO units fit here.
• Cyber Operations Planner: Plan and coordinate cyber operations. Band III or IV. Officers and senior NCOs with cyber planning backgrounds are competitive.

Each work role has a code (like 511 for Cyber Defense Analyst). When you see a CES job posting, it will list the NICE work role. That tells you exactly what certs and experience they want.

What Certifications Do You Need for CES Jobs?

DoD 8140 replaced 8570 in 2023. The old system had simple categories: IAT Level I, II, III and IAM Level I, II, III. You matched a cert to a level and you were qualified.

DoD 8140 is more specific. It ties certification requirements to each work role. So the certs you need depend on the exact job you want, not just a broad category.

That said, some cybersecurity certifications show up across many CES work roles:

If you held 8570 certifications while on active duty, those still count. DoD grandfathered existing 8570-qualified personnel into the 8140 framework. But new hires and new positions use the 8140 work role mapping. Make sure you check which certs your target role requires under 8140, not the old 8570 categories.

Veterans separating from cyber MOSs (Army 17C, 25D, Navy CTN, Air Force 1D7X1, Marine 1721) often already have Security+ and sometimes CISSP. That gives you a head start. But do not assume your military training alone checks every box. Review the specific work role requirements on the CES job posting.

How Does CES Hiring Differ from Regular Federal Hiring?

CES uses "excepted service" authority. That means different rules from the competitive service process that covers most GS jobs. If you want to understand the full difference between these two systems, our guide on excepted service vs. competitive service for veterans breaks it down. Here is what changes and what stays the same.

What changes:

• Faster hiring: CES positions can skip some of the lengthy competitive service requirements. Hiring managers have more flexibility on timelines.
• Direct hire authority: Some CES roles use direct hire. The hiring manager can make an offer without going through the full certificate-of-eligibles process.
• No time-in-grade requirement: Under GS, you usually need a year at GS-12 before you can apply to GS-13. CES does not have this. If you qualify for a Band III role, you can apply straight to it.
• Performance-based pay movement: Your supervisor rates your performance and recommends pay increases. There is no automatic step increase schedule.

What stays the same:

• Veterans preference still applies. CES is excepted service, but veterans preference rules still apply to most CES hiring actions. Your 5-point or 10-point preference counts.
• Jobs post on USAJOBS. You still find and apply through USAJOBS. Look for "Cyber Excepted Service" or "CES" in the posting.
• Security clearance requirements. Almost every CES role requires a clearance. Many require TS/SCI. Having an active clearance from military service is a major advantage.
• Resume requirements. You still need a federal resume with hours per week, supervisor info, and detailed duties. The 2-page format still applies.

One thing that catches veterans off guard: CES positions sometimes do not list a GS grade equivalent. You might see "CES Pay Band III" with a salary range and nothing else. Do not let that confuse you. Look at the duties and required experience to figure out where it falls.

How Do You Apply for CES Positions?

The application process is similar to regular federal jobs but with a few differences worth knowing.

Your resume matters more in CES than in standard federal hiring. Because CES can move faster and hiring managers have more authority, the resume gets more direct attention. A strong resume with the right keywords can lead to an interview within weeks, not months.

Why Veterans Have an Advantage in CES Hiring

Veterans with cyber backgrounds are exactly who CES was built for. Here is why.

First, clearances. Almost every CES position requires TS/SCI. If you separated with an active clearance, you skip the 6 to 12 month investigation wait. That alone makes you more attractive than a civilian applicant who needs a new investigation.

Second, hands-on experience. If you worked in a military cyber unit, you have done things that civilian applicants read about in textbooks. Incident response on real networks. Vulnerability scanning on classified systems. Network defense against actual threats. That operational experience maps directly to CES work roles.

Third, veterans preference. CES is excepted service, but veterans preference still applies. Your 5-point or 10-point preference gives you an edge in the hiring process.

Fourth, the DoD culture. You already know how DoD operates. You understand classification levels, need-to-know, OPSEC, and the organizational structure. CES hiring managers value that because it means less onboarding time.

If you are separating from an Army 17C, 25D, Navy CTN, Air Force 1D7X1, or Marine 1721 MOS, CES roles are a natural fit. But you do not need a cyber MOS to qualify. Veterans from IT and signals backgrounds also compete well if they have the right certs and clearance.

How Does CES Compare to Other Non-GS Pay Systems?

CES is not the only alternative pay system in the federal government. Understanding how it stacks up helps you decide where to focus your job search.

Title 38 pay covers VA healthcare workers. It also uses a different pay structure from GS, but it focuses on medical professionals like doctors, nurses, and pharmacists. Very different workforce from CES.

AcqDemo covers the DoD acquisition workforce. It uses pay bands like CES and also ties raises to performance. If you have contracting, program management, or engineering experience along with cyber skills, you might see positions under both CES and AcqDemo.

Here is how the systems compare at the senior level:

CES and AcqDemo look similar on paper. The key difference is workforce scope. CES is only for cybersecurity roles. AcqDemo covers the broader acquisition community (contracting officers, engineers, program managers).

What Should Your CES Resume Look Like?

A CES resume follows the federal resume format. That means more detail than a civilian resume. Hours per week, supervisor contact info, and specific duty descriptions are all required. Target 2 pages, the same as any federal resume in 2026.

But CES resumes need extra attention in a few areas:

Lead with clearance and certs. Put your clearance level and DoD 8140 certifications at the top of your resume. CES hiring managers scan for these first. If they do not see them right away, your resume sinks in the pile.

Use NICE Framework language. The job posting will reference a specific work role. Use that language in your resume. If the posting says "Cyber Defense Analyst," your resume should show experience in "cyber defense analysis," "network monitoring," "incident response," and "threat detection." Match the framework terms.

Quantify your cyber experience. How many endpoints did you monitor? How many incidents did you respond to per month? What was the scope of the network you defended? Numbers give hiring managers context. "Monitored 15,000 endpoints across 4 sites" beats "Monitored network activity."

Show tool proficiency. List the specific tools you used: Splunk, Wireshark, Nessus, Tenable, CrowdStrike, Carbon Black, or whatever your unit ran. CES hiring managers want to see hands-on tool experience, not just concepts.

BMR's Federal Resume Builder handles the federal formatting for you. It adds hours per week, supervisor fields, and duty structure. You focus on matching your experience to the CES work role requirements.

Where Are CES Jobs Located?

CES positions cluster around major DoD cyber installations. But remote and telework options have expanded since 2020.

The biggest CES hiring locations:

• Fort Meade, MD: Home of NSA, US Cyber Command, and Army Cyber. The single largest CES hiring hub.
• Fort Eisenhower, GA (formerly Fort Gordon): Army Cyber Center of Excellence. Growing CES presence.
• San Antonio, TX: Joint Base San Antonio is home to 24th Air Force (now 16th Air Force) and DISA elements.
• Fort Huachuca, AZ: Army Intelligence and Cyber. Network Enterprise Technology Command.
• Pentagon / Arlington, VA: DoD CIO office and policy-level CES positions.
• Colorado Springs, CO: NORAD and NORTHCOM cyber elements.

Remote work varies by agency and clearance requirements. Unclassified CES work sometimes allows telework. Positions requiring daily access to classified networks (SIPR/JWICS) usually require on-site presence. Check each posting for the work location and telework policy.

What to Do Next

If you have a cyber or IT background from the military, CES jobs should be on your radar. The pay is competitive. The hiring process moves faster than traditional federal hiring. And your clearance plus operational experience give you a real edge.

Start by searching USAJOBS for "Cyber Excepted Service" in your target agencies. Look at the work roles and cert requirements. If you need to fill a cert gap, check our guide on cybersecurity certifications for veterans.

When you are ready to apply, build your federal resume around the specific CES work role. Match your military experience to the NICE Framework language. Put your clearance and certs at the top. Quantify everything.

BMR's Federal Resume Builder formats your resume for federal applications and helps you translate military experience into the language hiring managers look for. Two free tailored resumes. Built by a veteran who spent six federal career fields figuring out what works.