You still have to pass a marijuana drug test to work there, for heaven's sake.
I hate to break it to you, but that's normal in the vast majority of companies. So far, I've only lived in two states where it was legal, and in both the laws specifically allowed employers to test for pot. I'm in healthcare, and the company I work for tests everyone on entry, and people randomly after that.
If it's ever legalized at the federal level, expect employer testing to be specifically allowed. Transportation companies, surgeries, heavy industry, and a lot of other companies will filter for this, either because they or their insurance companies don't want the risk.
We're talking tech here—the Digital Service—and I've never worked at a company that drug tested their programmers. Not once, since the 90s, during the full-swing War on Drugs.
Anyway, the marijuana test isn't the only antiquated, sclerotic thing about the USDS (and Federal employment in general). But it's certainly a representative example.
What security engineer worth his salt is going to accept half the pay to work for the government where things move at a snails pace?
Problems of red tape are not limited to only government ,it is function of most large organizations
Plenty of security engineers are constantly frustrated at the lack of security focus in corporate sector, investments are only made when it affects revenue . Even after all the ransomware companies some times do the bare minimum and buying insurance
Government on the other hand cares about security for different reasons, they take it lot more seriously. They don't sacrifice security in the interest of sales.
I would anyday prefer to work for some org where security actually matters not where it is inconvenience
https://www.nytimes.com/2020/12/17/us/politics/russia-cyber-...
Government doesn't care about the security of your personal information, hence why they treat their security engineers with contempt by offering them paltry wages and drowning them in red tape.
Most companies I know treat Security engineers similarly and pay not all that much higher. There is world of enterprise IT outside the silicon valley, the pay is not all the much higher. Despite all the recent threats and ransomware attacks security is not treated as it should be.
To your second, well, /shrug. A reasonable number of folk might well jump at the chance to have a job like that on their resume, and there's likely a fair amount of possible cross pollination w/ various folk in the DoD/military to bring up bodies and relevant expertise (i.e. security).