Can You Work in Cyber Security With a Felony?

You can work in cybersecurity with a felony conviction, but how easily depends on four things: what the offense was, how long ago it happened, whether the job requires a government security clearance, and how well you can document that you’ve changed. The industry has a persistent talent shortage, and many private employers weigh technical skill heavily against criminal history. A felony creates real hurdles, some of them steep, but it does not lock you out of the field.

Which Cybersecurity Jobs Are Realistically Open to You

The field is broad, and your record may disqualify you from one type of role while leaving others wide open. Sorting the roles by how much scrutiny they carry is the fastest way to see where to start.

Private-sector positions without clearance requirements are usually the most accessible entry point. SOC analyst, vulnerability scanner, and IT security support roles typically involve less intensive background screening, and many tech employers care more about whether you can do the work than about something that happened years ago. Freelance penetration testing and bug bounty work go further still: you can build a reputation on demonstrated skill with no background check involved at all.

Government and defense contractor roles are the hardest. Even junior federal cybersecurity jobs generally require at least a Secret-level clearance, and senior positions often demand Top Secret or TS/SCI access. A felony does not automatically disqualify you from obtaining a clearance, but the bar is high and certain offenses make approval nearly impossible.

Financial-sector cybersecurity carries its own extra scrutiny because of FINRA rules and banking regulations, covered further down.

The practical route for most people with a felony is to start in private-sector, non-cleared roles, build a track record of reliable work and continuing education, then consider expanding into more regulated areas once you have years of clean professional history behind you.

The Offense Matters More Than the Felony Label

Adjudicators, hiring managers, and certification boards all look at what you were convicted of, not just whether you were convicted. Some offenses sit right next to the daily work of cybersecurity and raise immediate trust concerns. Others have little bearing on your ability to protect computer systems.

Computer Fraud and Unauthorized Access

Convictions under the Computer Fraud and Abuse Act (18 U.S.C. § 1030) are the most directly damaging. The statute covers unauthorized access to protected computers, and first-offense penalties range from up to one year in prison for basic unauthorized access to up to ten years for offenses involving espionage-related intrusions.¹ When the crime you were convicted of is the same activity you’d be hired to defend against, employers and certification boards treat it as a direct conflict with the role.

Crimes of Dishonesty and the Banking Bar

Federal law under 12 U.S.C. § 1829 broadly prohibits anyone convicted of a crime involving dishonesty, breach of trust, or money laundering from working at or participating in the affairs of any FDIC-insured depository institution, unless the FDIC grants prior written consent.² The definition of “dishonesty” is broad and covers offenses where someone cheats, defrauds, or wrongfully takes property, including forgery, embezzlement, tax evasion, and even writing bad checks.³ Identity theft and wire fraud convictions are particularly harmful because they involve the same techniques used in cybersecurity work.

The prohibition is a lifetime ban with no automatic expiration, but the FDIC grants waivers. You can apply as an individual by filing Form 6710/07 with the appropriate FDIC Regional Office. The FDIC generally will not process your application until you’ve completed all conditions of your sentence. If approved, the FDIC issues a formal order, typically with conditions requiring you to provide the order to any bank you work with and to be covered by the institution’s fidelity insurance.³ The FDIC targets a 45-day turnaround after receiving the regional recommendation.

One important carve-out: Section 19 explicitly excludes drug possession offenses from the definition of “criminal offense involving dishonesty,” so those convictions do not trigger the banking bar at all.²

Offenses Treated More Leniently

Felonies unrelated to technology, fraud, or dishonesty face substantially less resistance. Older drug convictions, for example, are generally treated as less relevant to your ability to safeguard networks. The further back the conviction and the less it relates to the job, the easier the review becomes. A clean record stretching seven to ten years after conviction or release makes a meaningful difference to both employers and certification boards.

Federal Laws That Protect You During Hiring

Several federal laws limit how and when an employer can use your criminal history against you. None of them erase your record, but they force employers to slow down and evaluate you as an individual.

Title VII and the EEOC’s Individualized Assessment

Title VII of the Civil Rights Act of 1964 prohibits employment practices that disproportionately screen out applicants by race, color, religion, sex, or national origin without a legitimate business justification.⁴ Because criminal records correlate with certain demographic groups, blanket “no felons” policies can violate Title VII. EEOC enforcement guidance directs employers to conduct an individualized assessment weighing three factors from Green v. Missouri Pacific Railroad:

The nature and gravity of the offense. A computer fraud conviction raises more red flags for a cybersecurity role than an unrelated offense.
The time that has elapsed. A conviction from twelve years ago carries far less weight than one from last year.
The nature of the job. The employer must consider whether the offense actually relates to the duties of the position.

An employer who rejects you solely because a background check turned up a felony, without considering these factors, is exposed to a discrimination claim.⁵

The Fair Credit Reporting Act

When an employer uses a third-party service to run your background check, the Fair Credit Reporting Act governs the process. The screening company must follow reasonable procedures to ensure the accuracy of what it reports.⁶ Before an employer takes adverse action, such as rescinding a job offer, they must give you a copy of the report and a summary of your rights under the FCRA so you can dispute any errors before the decision becomes final.⁷ The Consumer Financial Protection Bureau has reinforced that screening agencies must have procedures preventing the reporting of information that has been expunged, sealed, or legally restricted.⁸

Fair Chance Act for Federal Jobs and Contractors

If you’re applying for a federal position or a role with a federal contractor, the Fair Chance to Compete for Jobs Act adds another layer. Federal agencies and contractors cannot ask about your criminal history before making a conditional offer of employment.⁹ Your qualifications get evaluated first; only after the employer decides you’re otherwise qualified can they pull your record. Many states have enacted similar “ban-the-box” laws that apply to private employers, though the details vary by jurisdiction.

Certifications: What ISC2 and CompTIA Actually Require

Industry certifications are often the gateway to cybersecurity jobs, especially if you don’t have a traditional degree. The two most common credentials handle criminal history very differently.

ISC2, the organization behind the CISSP, requires all candidates to subscribe to its Code of Ethics as a condition of certification.¹⁰ During registration you must answer whether you have ever been convicted of a felony. If you answer yes, ISC2’s Professional Conduct Committee reviews your documentation and rehabilitation evidence to determine eligibility. A conviction does not automatically disqualify you. ISC2 explicitly states that if your conviction has been sealed by a court or removed from your record, your eligibility will not be impacted.¹¹

What will get you into serious trouble is failing to disclose. ISC2 treats dishonesty during the application process as a separate ethics violation, and hiding a felony that the committee later discovers undermines the trust cybersecurity certifications are built on. Full transparency gives you the best chance of approval.

CompTIA, which administers Security+ and other foundational certifications, generally does not require a criminal background check as part of its exam registration. That said, employers who require Security+ may still run their own checks. The certification is a credential, not a clearance, and earning it doesn’t exempt you from an employer’s hiring standards.

Security Clearances

If you want to work in government cybersecurity or with defense contractors, you’ll almost certainly need a security clearance. This is where a felony creates the steepest challenge, though even here disqualification isn’t automatic.

Security clearances are governed by Security Executive Agent Directive 4 (SEAD 4), which establishes thirteen adjudicative guidelines investigators use to assess whether granting you access to classified information is consistent with national security.¹² The process starts with the Standard Form 86 (SF-86), a detailed questionnaire covering your personal history, finances, foreign contacts, and criminal record. Investigators then verify what you reported through interviews with references, employers, and neighbors.

Guideline J specifically examines criminal conduct to determine whether it reflects poor judgment or an unwillingness to follow the law. Adjudicators apply a “whole-person” concept, looking at the full picture of your life rather than fixating on a single event. Mitigation is possible if the criminal behavior happened long ago, occurred under unusual circumstances unlikely to recur, or if you can show clear evidence of rehabilitation.¹²

Financial issues receive separate scrutiny under Guideline F. If your felony involved financial misconduct, or if you carry significant debt from legal costs and lost income during incarceration, adjudicators will examine whether your financial situation creates a vulnerability to bribery or coercion. Mitigating factors include showing that the problems resulted from circumstances beyond your control, that you’ve received financial counseling, or that you’ve made a good-faith effort to resolve outstanding debts.¹³

If your application is denied, you receive a Statement of Reasons explaining why, and you can appeal through the Defense Office of Hearings and Appeals. Your Notice of Appeal must reach the Appeal Board within 15 calendar days of the administrative judge’s decision, and your appeal brief is due within 45 days of that decision.¹⁴ Complete honesty on your SF-86 is critical, because investigators are far more concerned about an applicant who lies about a felony than one who discloses it and demonstrates rehabilitation.

Financial-Sector Barriers

Financial firms operate under rules from the Financial Industry Regulatory Authority (FINRA) that create a hard barrier for certain convictions. Under Section 3(a)(39) of the Securities Exchange Act, all felony convictions trigger a statutory disqualification from associating with a FINRA member firm for a period of ten years from the date of conviction. This applies regardless of whether the felony was related to securities. During that ten-year period, the only path back is for a sponsoring firm to file an MC-400 application requesting FINRA approval, which triggers a formal eligibility proceeding.¹⁵ This makes financial-sector cybersecurity one of the hardest areas to enter with a felony conviction on your record.

In other regulated private-sector settings, compliance frameworks like SOC 2, PCI DSS, and HIPAA do not impose a blanket ban on hiring people with records. They require the company to conduct due diligence and document its risk assessment. A hiring manager who can argue that your specific conviction doesn’t pose a risk to the company’s data assets, especially with years of clean history behind you, can often get the hire approved through internal risk review.

Programs That Make Employers Say Yes

Two federal programs exist to make employers more willing to take a chance on someone with a felony record. Mentioning them in interviews can shift the cost-benefit calculation in your favor.

The Work Opportunity Tax Credit (WOTC) gives private employers a federal tax credit for hiring people from certain target groups, including qualified ex-felons. To qualify, you must have been convicted of a felony and hired within one year of your conviction or release from prison. The credit equals 25% of your qualified first-year wages if you work at least 120 hours, rising to 40% if you work 400 hours or more. With a $6,000 wage cap for non-veteran hires, the maximum credit is $2,400 per employee.¹⁶ That one-year window is tight, so bring this up early in the job search after your release.

The Federal Bonding Program provides fidelity bonds to employers at no cost, covering the first six months of employment. The standard bond is $5,000, with coverage up to $25,000 available when justified.¹⁷ These bonds insure the employer against losses from theft, forgery, or embezzlement by the covered employee. After six months, if no claim has been filed, the employer can continue coverage at standard commercial rates. Being bonded addresses a specific employer fear and can be the detail that tips a hesitant hiring manager toward yes.

Building Your Rehabilitation Record

Across every context in this article, the pattern is the same: decision-makers want to see evidence that you’ve changed. The stronger and more specific that evidence is, the more doors open.

The EEOC’s enforcement guidance provides a useful framework for the documentation that helps during an individualized assessment:

Post-conviction employment history showing you performed similar work without incident.
Education and training, including cybersecurity coursework, certifications, and degrees.
Character references from employers, instructors, community leaders, or probation officers.
Bonding status, which serves as third-party validation of your employability.
Time and age, since older age at the time of the offense and a long period of clean conduct both work in your favor.

The same types of evidence carry over to ISC2 ethics reviews, FDIC waiver applications, and security clearance adjudications.⁵ Start assembling this documentation early, even before you begin applying.

Sealing and Expungement

Getting your record sealed or expunged is the single most effective step you can take. ISC2 explicitly states that sealed or removed convictions do not affect certification eligibility.¹¹ The CFPB has directed background screening agencies to maintain procedures preventing the reporting of sealed or expunged records.⁸

At the federal level, the Federal First Offender Act (18 U.S.C. § 3607) allows expungement for first-time simple drug possession offenses, but only if you were under 21 at the time and received pre-judgment probation.¹⁸ That’s a narrow window. Most expungement opportunities exist under state law, and eligibility rules vary significantly. Court filing fees typically range from nothing to a few hundred dollars, depending on the state. Consulting a local legal aid organization about your eligibility is worth the effort, because the downstream impact on your career options in cybersecurity can be enormous.

Many states have also adopted Certificates of Rehabilitation or Certificates of Good Conduct that remove mandatory legal bars to employment. They don’t guarantee a job, but they represent an official determination that you’ve demonstrated rehabilitation, which carries weight during an individualized assessment.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
2
Office of the Law Revision Counsel. 12 USC 1829 – Penalty for Unauthorized Participation by Convicted Individual
3
Federal Deposit Insurance Corporation. Your Guide to Section 19
4
U.S. Equal Employment Opportunity Commission. Title VII of the Civil Rights Act of 1964
5
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII
6
Federal Trade Commission. What Employment Background Screening Companies Need to Know About the Fair Credit Reporting Act
7
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
8
Consumer Financial Protection Bureau. Fair Credit Reporting – Background Screening
9
Federal Register. Fair Chance To Compete for Jobs
10
ISC2. ISC2 Code of Ethics – Guidance for Cybersecurity Professionals
11
ISC2. Background Qualifications
12
Office of the Director of National Intelligence. SEAD-4 Adjudicative Guidelines
13
eCFR. Adjudicative Guidelines for Determining Eligibility for Access to Classified Information
14
DOHA OGC. A Short Description of the DOHA ISCR Appeal Process
15
FINRA. General Information on Statutory Disqualification and FINRAs Eligibility Proceedings
16
Office of the Law Revision Counsel. 26 USC 51 – Amount of Credit
17
U.S. Department of Labor. ETA Advisory – Training and Employment Notice No. 37-07
18
Office of the Law Revision Counsel. 18 USC 3607 – Special Probation and Expungement Procedures for Drug Possessors