Matt Cowsert

Many transitioning service members assume that having a Top Secret clearance automatically qualifies them for any cleared role, but having a Top Secret clearance doesn’t guarantee access to every agency. In theory, all legitimate government clearances are to be accepted and transferable between and among government agencies; this process is called RECIPROCITY, and it is a policy meant to streamline the transfer of security clearances between agencies without requiring a new background investigation. But in reality, clearances don’t always transfer because one agency may not accept another agency’s investigation or adjudication, even if the clearance level matches. For reciprocity to apply: 🐿️ An individual’s new position cannot require a higher clearance than they currently possess. 🐿️ The prior investigation must still be current. 🐿️ The clearance cannot be based on a waiver or interim status. Reciprocity can be denied if the new agency requires a more thorough investigation or if new information comes to light during your background check. And even if your clearance is accepted, you still need to meet the rest of the job requirements like experience, technical skills, education, or certifications. Remember, you are competing with folks who meet 100% of the requirements AND have the RIGHT clearance level ready to go on day one of employment. So applying to jobs in which you only meet 50% of the requirements will not fly with most technical GovCon roles and you will most likely receive a rejection email. That’s why it’s CRITICAL to READ the job description carefully before applying to cleared roles. Good luck to everyone on the hunt for cleared roles. You've got this! Maloney out! ✌ #transitioningmilitary #secretsquirrels #veteranshelpingveterans

43

20 Comments

Fail of Fame: ClearanceJobs.com 1. CSP set to “Please Hack Me” default-src * blob: data: 'unsafe-inline' 'unsafe-eval' • This is the CSP equivalent of leaving your front door open with a neon “WELCOME” sign. • Allows any script from anywhere, runs any inline code, and even executes arbitrary strings with eval(). • Impact: Any XSS bug instantly becomes full account compromise, data theft, or drive-by malware. No browser-side safety net at all. 2. CORS Misconfiguration From Hell Access-Control-Allow-Origin: *.clearancejobs.com + Access-Control-Allow-Credentials: true • Wildcard origins aren’t valid with credentials — browsers should ignore it, but backend logic could still misapply it. • If improperly enforced server-side, this could let a malicious subdomain read authenticated API responses. • Impact: Potential data leakage of personal info, resumes, or job activity from logged-in users. 3. Permissions-Policy? Referrer-Policy? COOP/CORP? Nope. • Zero modern isolation headers to reduce the blast radius of a compromise. • Impact: Easy clickjacking, over-sharing of referral data, and no site isolation to contain injected code. 4. Audience Risk Profile Off the Charts • The user base isn’t random shoppers — it’s people with active or pending security clearances, working in defense, intel, and government. • Impact: An XSS or session theft here isn’t just personal inconvenience — it’s an espionage goldmine. 5. CloudFront Popcorn Machine • Sitting behind AWS CloudFront, so an attacker only needs one injection point in any origin server to serve malicious code globally in minutes. • Impact: Massive scale, instant reach, global compromise in one hit. 6. No Defense in Depth • No content isolation, no sandboxing, no enforced HTTPS beyond HSTS, and no selective resource loading. • Impact: Everything depends on backend code being flawless — and backend code is never flawless. Translation: Right now, any competent attacker who finds a small injection or misconfig on ClearanceJobs.com could: • Steal logins and personal data from people with active clearances. • Pivot to spear-phishing campaigns targeting high-value individuals. • Potentially harvest sensitive employment history that could be used for foreign intelligence targeting. Source:

22

11 Comments

Thinking about starting an LLC? Here’s a quick guide—and why it matters. When I transitioned out of the military and launched S2 - Stalker Solutions LLC., I wanted to build something lasting—something that could scale, employ Veterans, and support national security. But first, I had to get the foundation right. That began with forming an LLC. If you're thinking of doing the same, here are a few key things to know: What is an LLC? A Limited Liability Company (LLC) is a flexible business structure that protects your personal assets while offering several options for how you pay taxes. It’s popular with startups, small businesses, and independent contractors because of its simplicity and adaptability. LLC Tax Classifications—Choose What Works Best for You: When you form an LLC, the IRS doesn’t assign a unique tax category. Instead, you choose how you want the IRS to treat your business for tax purposes: Sole Proprietorship (Default for single-member LLCs) Income is taxed once—on your personal tax return. Simple to file, but you pay self-employment tax on all profits. Partnership (Default for multi-member LLCs) Income passes through to members and is taxed at individual rates. Requires a partnership return and K-1 forms for each member. S-Corporation (S-Corp) Election You can elect for your LLC to be taxed as an S-Corp using IRS Form 2553. You pay yourself a reasonable salary (subject to employment tax) and can take remaining profits as distributions (not subject to self-employment tax). Great for businesses that generate consistent income and want to reduce tax liability. C-Corporation (C-Corp) Election Less common for LLCs, but possible using IRS Form 8832. Profits are taxed at the corporate level, and again when distributed to owners (double taxation). May be beneficial for businesses seeking venture capital or planning to reinvest profits. Benefits of an LLC: Liability Protection – Separates personal assets from business debts or lawsuits. Tax Flexibility – Choose how you're taxed based on your goals. Simplicity – Fewer administrative requirements than corporations. Credibility – Looks professional and opens doors with banks, partners, and clients. Ownership Flexibility – No limit on number or type of members. But I didn’t figure this all out on my own. Special thanks to the Veterans who helped me along the way: David Saroli, my American Corporate Partners (ACP) mentor Greg Smith, teammate from National Defense University Audie Cooper, CEO of JCTM Their guidance helped me take the right steps to build something real. Veterans—there’s more out there than going back to work for someone else. You’ve got options. Whether it’s entrepreneurship, contracting, consulting, or starting your own business—there are resources, networks, and programs built to support you. Make the choice that’s best for you—but make sure you know the choices you have.

190

30 Comments

Pentagon leaders are crafting a plan to shake up how they buy and field technology, with Defense Secretary Pete Hegseth starting things off by potentially directing that the department adopt the Software Acquisition Pathway (SWP) as the preferred method for software development. In a draft memo obtained by Breaking Defense, Hegseth calls on the department to adopt the Software Acquisition Pathway, a practice created in 2020 to accelerate software development by implementing best practices from the private sector. At its core SWP is a streamlined method for procuring software programs bespoke to DoD requirements. Through the SWP organizations can deploy capabilities into platforms within six months or less, DoD has previously stated that the goal is to speed this process up into hours or days. The memo also directs the use of Commercial Solutions Openings and Other Transactions as the “default solicitation” and award avenue for acquiring capabilities.

35

2 Comments

You never really know if something you write will have any impact. Most of the time, I write for my own good; to clarify my thinking — to make sense of an issue, test my assumptions, and sometimes share ideas. That’s why I wrote “An AI-Ready Military Workforce.” I was very pleased — and a bit vindicated — to learn that this article has been used in a The Johns Hopkins University executive education course for General Officers and senior leaders focused on AI and organizational readiness. It’s a reminder that writing remains one of the best tools we have for thinking through complex problems — and that it’s worth sharing your work, even when you’re not sure where it will go. Original article here: https://lnkd.in/eF8yt3Wc

75

8 Comments

For years, senior military leaders have shared their reading lists. In today’s era of generative AI, where large language models are reshaping workflows, I would love to see leaders share the LLM prompts they and their staffs find most useful. Such insight would both accelerate adoption and signal the importance of building an AI-fluent workforce.

28

1 Comment

What struck me about this episode is that, while the author is part of a task force to overhaul the FAR, there's evidence that the FAR isn’t the primary culprit for the DoD’s inability to execute agile acquisition. It’s almost entirely cultural, where risk avoidance and leader’s poor understanding of OTAs are the main culprits. As the Navy Shore Enterprise looks to flex its acquisition muscles in the face of staffing cuts, understanding the future regulatory environment AND the current acquisition culture that could undercut even drastic de-regulation seems important. https://lnkd.in/eUbhSNgK

9

1 Comment