Technology & IT · Washington, DC
Washington employs 16,560 information security analysts, more than four times the national share, and every core IT role here pays above the U.S. median. Careerscape's IT recruiters serve the DMV from a remote, national team, matched to employers by industry instead of by city.
The market
No U.S. metro we cover leans on IT work like Washington does. BLS counts 16,560 information security analysts in the Washington-Arlington-Alexandria metro, a location quotient of 4.31: their share of local jobs is more than four times the national share. Network architects (2.58), database administrators (2.65) and web developers (2.71) are also far above the U.S. norm.
Depth is not the same as availability. The people with the right clearance and the right certifications for a DoD work role are a narrow slice of that pool, and they are the ones every contractor in the region is calling.
Careerscape's technology recruiters work for DMV employers remotely, as part of our national technology staffing practice. For the wider DMV labor market, clearance basics and local pay-range laws, see our Washington, DC recruiting page.
BLS pay data
May 2025 BLS figures for the Washington-Arlington-Alexandria, DC-VA-MD-WV metro. A location quotient above 1 means the role is more concentrated here than nationally.
| Occupation | Jobs in metro | Median pay · vs. U.S. | Concentration |
|---|---|---|---|
| Software Developers | 69,060 | $154,930+14% | 2.03 |
| Software Quality Assurance Analysts and Testers | 8,460 | $126,350+21% | 2.25 |
| Information Security Analysts | 16,560 | $148,950+15% | 4.31 |
| Network and Computer Systems Administrators | 9,920 | $125,430+27% | 1.57 |
| Computer Systems Analysts | 18,620 | $127,040+20% | 1.78 |
| Data Scientists | 9,260 | $132,200+10% | 1.75 |
| Computer and Information Systems Managers | 20,800 | $195,190+11% | 1.54 |
| Computer User Support Specialists | 18,510 | $77,860+26% | 1.28 |
| Computer Network Architects | 9,370 | $159,820+19% | 2.58 |
| Database Administrators | 3,730 | $108,750+4% | 2.65 |
| Web Developers | 3,840 | $134,350+45% | 2.71 |
The widest pay gaps are in web developers ($134,350 here against $92,650 nationally) and computer user support specialists ($77,860 against $61,860). Network and systems administrators earn a $125,430 median against $99,130. BLS does not separate cleared from non-cleared pay, so treat these as the floor for cleared searches, not the ceiling. Jobs and median annual pay for the Washington-Arlington-Alexandria, DC-VA-MD-WV metro area, all employers, from the BLS Occupational Employment and Wage Statistics survey (May 2025). “Vs. U.S.” compares with the national median. Concentration is the BLS location quotient: above 1.0 means the job makes up a bigger share of local employment than it does nationally.
DoD rules
Two Defense Department programs now shape IT hiring for many DMV contractors. DoD Manual 8140.03 sets qualification rules for the people doing cyber and IT work; CMMC sets security requirements for the companies holding the contracts.
| Rule | What it requires | Date | Hiring effect |
|---|---|---|---|
| DoDM 8140.03 | Cyber Workforce Qualification Program; replaced the 8570 framework | Effective Feb 15, 2023 | Contractor staff must be qualified for their work role when they start, with no grace period |
| 8140.03, cybersecurity element | DoD civilians and service members in cybersecurity roles qualified within 2 years | Feb 2025 | Government teams now expect contractor peers to match the same work-role standard |
| 8140.03, IT and other elements | Same deadline logic for cyberspace IT, effects, intelligence and enabler roles, within 3 years | Feb 2026 | Sysadmin, network and help desk roles on DoD contracts now carry qualification requirements too |
| CMMC Phase 1 | Level 1 or Level 2 self-assessment can be required for award | Nov 10, 2025 | Demand for compliance analysts who can run NIST SP 800-171 self-assessments |
| CMMC Phase 2 | Level 2 third-party (C3PAO) assessment required for award | Was set for Nov 10, 2026; suspended July 2026 pending a DoD review | Assessment-ready security staff remain an advantage, but the deadline is no longer fixed |
| CMMC Phases 3 and 4 | C3PAO also needed to exercise options; then all applicable contracts | Originally Nov 10, 2027 and Nov 10, 2028; now uncertain | Sustained demand for ISSOs, ISSMs and compliance engineers |
Under 8140.03, contractors are not required to meet resident (on-the-job) qualification requirements unless the component requires it and the contract says so. Check your contract's DFARS 252.204-7021 and 252.204-7025 clauses for the CMMC level. General information, not legal advice. Source: DoD Manual 8140.03 (WHS Directives); Foley & Lardner on the CMMC contracting rule; Skadden on the Phase 2 suspension.
Where the work is
Most tech employment runs west from the river along the Dulles Toll Road, with a second pole in Arlington and Alexandria. Companies named here are market context only.
Amazon's HQ2 opened its first phase, Metropolitan Park, in June 2023. Nearby, Virginia Tech's Innovation Campus in Alexandria offers master's programs in computer science and engineering.
The eastern end of the Dulles Technology Corridor. Large defense and government IT contractors, among them Leidos, SAIC, CACI, Booz Allen Hamilton and Peraton, are headquartered along this stretch, so cleared software, cloud and program roles concentrate here.
Further west on Route 267 and Route 7, a mix of contractor offices, telecom and internet infrastructure firms. Northern Virginia Community College's Loudoun campus is in Sterling.
Loudoun County, home to the stretch known as Data Center Alley, has one of the largest concentrations of data center buildings in the country, and data centers are a major source of county tax revenue. Facility, network and critical-environment technicians are the steady hires here.
George Mason University, one of Virginia's largest public universities, feeds software and security graduates into the Fairfax and Arlington employer base.
Federal agency headquarters, associations and the IT shops that serve them, plus Maryland's health and research agencies. Commercial software roles are thinner than in Virginia; government-facing roles are not.
Hiring advice
Practical points for technology hiring managers in DC, Northern Virginia and Maryland.
Under 8140.03, qualification is tied to a DoD Cyber Workforce Framework work role. A posting that says "Security+ required" without the work role invites mismatched candidates. Ask your contracting officer which role and proficiency level the seat maps to.
Contract staff must be qualified at the start of work, and many seats also need active access. If the work can begin unclassified while an investigation runs, say so: the pool widens considerably.
The Pentagon suspended the Phase 2 rollout of third-party Level 2 assessments in July 2026, but Phase 1 self-assessments and existing contract cybersecurity clauses still apply. Firms that wait for a new date will compete with every other bidder for the same assessment-ready security engineers.
With every core IT role above the U.S. median here, national salary bands lose candidates. Compare offers with the table above and our cybersecurity analyst and network engineer salary pages.
When program funding is uncertain, Contract staffing or contract-to-hire lets you staff a task order now and convert people once the option year is exercised.
Roles we recruit
Most come in cleared and non-cleared versions. Pay links go to our national Salary Guide.
Request talent
Tell us the role, the work location, any clearance or 8140 requirement, and when the seat must be filled.
Looking for a job instead? Submit your resume or browse open jobs.
FAQ
No. Careerscape is a national recruiting agency with a remote team and no DC-area office. Our technology recruiters specialize by industry and recruit for employers in DC, Northern Virginia and Maryland remotely. We send a short list of screened candidates, and the Employer Portal is where you compare them and schedule interviews.
DoD Manual 8140.03, effective February 15, 2023, set up the Cyber Workforce Qualification Program and replaced the older 8570 framework. It covers contractor personnel as well as DoD civilians and service members. Contractors must meet the foundational qualification for their work role when they start the work, while government staff get 9 months. Resident requirements apply to contractors only if the contract says so.
It is unsettled. Phase 1 began November 10, 2025, allowing solicitations to require Level 1 or Level 2 self-assessments. Phase 2, which would have required Level 2 assessments by a certified third-party assessor (C3PAO) for award from November 10, 2026, was suspended in July 2026 while the department reviews the program. Phases 3 and 4 were scheduled for 2027 and 2028. Check each solicitation's DFARS clauses for the level it actually requires.
In May 2025, BLS reported metro medians of $154,930 for software developers, $148,950 for information security analysts, $159,820 for computer network architects and $195,190 for computer and information systems managers. All of the core IT roles in our table run above the U.S. median. Check role-level ranges in our software engineer salary guide.
Yes. We recruit network engineers, systems administrators, facility and critical-environment technicians and data center managers for employers in Ashburn and the rest of Loudoun County, through direct hire, contract and temporary staffing. Operators there draw on the same pool of experienced technicians, so expect competition on pay and shift premiums.
Send us the requisition and the contract requirements. A technology recruiter will come back with a pre-screened shortlist matched to the work role.
How can we help?
We got it!
A recruiter will reach out shortly.
Application Submitted!
Thank you for applying. We'll review your application and get back to you soon.