A secure resume for cleared work must be completely unclassified, specific enough to prove your qualifications, and stripped of personal data that an employer does not need at the application stage. The goal is not to make your experience mysterious. It is to replace protected details with useful, defensible context.

What makes a secure resume for cleared work?

A secure resume separates two risks. One is exposure of your personal data. The other is disclosure of protected work information. Password-protecting a file may limit access in transit, but it cannot make unsafe content appropriate for public distribution.

Start with the content. An undated legacy NSA resume handout, which still uses the former For Official Use Only terminology, says resumes must be completely unclassified and must not knowingly contain operationally sensitive, classified, or FOUO information. The handout applies to NSA-related material and is not a universal rulebook. It remains a useful conservative model for reviewing cleared experience.

The personal-data risk is ordinary identity theft and job fraud. A recruiter needs a way to contact you, not your complete identity file. Resume privacy therefore begins before file encryption: disclose only what supports a hiring decision, through a recipient and process you have verified.

How do you inventory details before redacting them?

Make a working copy that never leaves your controlled workspace. Highlight sensitive nouns, numbers, and combinations first. Then rewrite each marked passage from scratch rather than deleting isolated words and hoping the remainder is safe.

Review every experience entry through five lenses:

• Names: program names, covernames, client organizations, supported components, supervisors, vendors, and partner units.
• Places: installation names, facility identifiers, cities, deployment sites, buildings, and travel patterns.
• Systems: platforms, architectures, data sources, vulnerabilities, configurations, collection methods, and classified applications.
• Missions: targets, operations, capabilities, gaps, priorities, and supported decisions.
• Scale: staffing, budgets, volumes, frequencies, timelines, readiness figures, and performance results that could reveal capacity.

Combinations matter. A generic job title, a narrow location, a unit, and a technology may reveal far more together than any field reveals alone. Read each bullet as an outsider would, then read the entire chronology for patterns. The broader advice in what to leave off a cleared resume is a useful final omission check, but a redaction pass should preserve job-relevant evidence wherever it safely can.

How should you replace program and client names?

Replace a protected proper noun with the work’s unclassified function and organizational context. The substitute should tell a recruiter what kind of problem you handled, at what professional level, and with which transferable skills. Do not create a coy pseudonym that invites guessing.

For example, “Project [redacted] for Client [redacted]” communicates almost nothing. A safer and more useful construction might be “supported an authorized federal mission customer with systems-engineering analysis,” if every part of that description is approved for public use. Another might be “led requirements coordination for a restricted defense program,” but only when “restricted defense program” itself is an appropriate description under your guidance.

The NSA document permits unclassified project descriptions without project names and notes that covernames may be meaningless outside the cryptologic community. Translate the label into an approved description of your contribution while preserving useful skills and removing protected associations.

How can you generalize locations without becoming vague?

Use the least precise location that still explains the working conditions. “Overseas field location,” “domestic customer site,” or an approved region may establish mobility, deployment experience, or environment without connecting a sensitive activity to a precise place.

Location is not just the city line beneath an employer. Search project bullets, travel statements, file names, portfolio captions, and employment dates. A harmless-looking city can become revealing when paired with a mission, system, or customer. The NSA guidance permits general terms such as field site or overseas location in relevant circumstances and says that, in most instances, a specific field-site location may not be stated.

Do not copy those exact generalizations automatically. Your controlling source may be a classification guide, contract security instruction, agency policy, nondisclosure agreement, or a determination from a security office. If a location is necessary to establish availability for a job, put your current broad job-search geography in the header instead of exposing a past sensitive site.

How do you describe systems, missions, and results safely?

Build bullets from four parts: an approved action, a safe technology or discipline, a general operating context, and a non-sensitive outcome. Stop whenever a detail would disclose capability, vulnerability, collection, target, capacity, or protected association.

A recruiter can assess “performed Linux administration in a controlled enterprise environment” without knowing the internal platform name or configuration. “Developed analytic workflows supporting authorized mission requirements” may carry useful skill evidence without exposing a target or data source. These are patterns, not preapproved phrases. Each underlying fact still must be releasable in your circumstances.

Be especially careful with impressive metrics. NSA’s resume guidance bars specified infrastructure details about strength, budget, or structure and gives staffing and office or project budgets as examples. A number that proves scale to a recruiter may also expose capacity. If an exact metric is not approved, describe the outcome qualitatively or use an authorized broader measure. Do not invent a range; a disguised number can remain sensitive and can also misrepresent your record.

Keep technical specificity where it is genuinely public and safe. Languages, commercial tools, methods, and certifications can show fit, but their combination with an employer, date, customer, or mission may change the disclosure picture. For a stronger presentation after the security pass, apply the evidence-focused techniques in these cleared-resume writing tips.

Which personal information should you remove?

Use a professional email address, a reachable phone number, and broad location information sufficient for hiring logistics. Leave out government identification numbers, financial information, birth details, and document images. Do not attach forms from a prior investigation or onboarding process.

A Federal Trade Commission job-scam warning says scammers may seek a driver’s license, Social Security number, or bank-account number before an interview. It also says real employers will not ask for that kind of information before they have interviewed and hired you. For federal applications, the OPM privacy assessment for USAJOBS says the service advises job seekers not to put classified or government-sensitive information, a Social Security number, photos, or specified personal information in a profile or resume. Verify the recruiter independently through the employer’s official contact path before moving beyond normal application information.

State your clearance level at the appropriate authorized level and, if you choose, that you have had a polygraph and its date. The legacy NSA handout allows an appropriate clearance level, an Agency Special Background Investigation, and a polygraph with its date, while barring other clearance information. Leave out compartments beyond your stated level, program names and other investigation detail unless your security office says otherwise.

Do profiles and uploaded copies need the same review?

Yes. The safest resume can be undermined by a more detailed public profile, cached biography, conference page, portfolio, or old job-board upload. Reconcile the whole public record and restrict visibility where the platform gives you that control.

Search your name and recurring phrases from past resumes. Inspect downloadable files, profile attachments, personal sites, association biographies, code repositories, slide decks, and social posts. Remove stale copies you control and request corrections from site owners when you do not. Search results may persist after deletion, so the first objective is to stop further distribution.

Use privacy controls for employment discretion as well as security. If you need to reduce exposure to a current employer, follow the board-specific steps for blocking your current employer on ClearedJobs.Net. That control addresses profile visibility; it does not authorize protected content or replace a security review.

When should you request official prepublication review?

Check the obligations tied to your employment, access, nondisclosure agreements, and agency or contract before sharing the resume. If review may apply, contact the designated security or prepublication-review office. Do not assume that removing classification markings makes an internal document public.

The NSA prepublication-review page says its process covers resumes, cover letters, biographies, and curricula vitae for NSA affiliates, and it requires full and final material rather than partial drafts. Its scope includes current and former personnel and specified contractor relationships. That is NSA’s process, not a statement that every cleared worker follows the same submission route.

For people with access to covered intelligence, Intelligence Community Directive 711 lists resumes among non-official material that may need prepublication review when a fully informed person might reasonably deem the material to contain or derive from covered intelligence. Current IC personnel submit to their home or employing IC element, and former IC personnel submit to their last employing IC element. People who were not employed by an IC element, including industry personnel, should contact the employing entity’s security office or DCSA to identify the IC element or department that sponsored the clearance.

For cleared industry, 32 CFR 117.15(h)(8) obliges the cleared contractor to clear public disclosures about a classified contract as the contract’s security specification or government contracting activity directs. Paragraph (h)(8)(ii) lets the contractor skip approval for items such as the fact of the contract, its subject or item type in general unclassified terms, and information already approved for public disclosure, unless the government contracting activity prohibits release. Ask your FSO how the company rule and contract guidance apply to your personal resume.

Do not confuse authorized sharing, declassification, or removal of a marking with public-release approval. The National Archives CUI Registry glossary explains that authorized dissemination outside the executive branch does not by itself constitute public release; the designating agency’s official process controls that release. Your security office can identify which process applies to the resume language at issue.

Submit what the responsible office requests and keep its written determination with the exact version reviewed. Approval of one version should not be stretched to cover later additions. When in doubt, ask your security office a narrow question tied to the actual language you want to use.

Frequently Asked Questions

Should I put “classified program” on my resume?

Only use a description that is authorized for public release under the guidance that controls your work. Even a broad label can create a protected association in context. Ask the responsible security or review office when the status or wording is uncertain.

Can I replace a customer name with “confidential client”?

That phrase may protect the name, but it gives a recruiter little evidence. If authorized, describe the customer type, your function, and the relevant work environment. Do not use clues that allow the reader to reconstruct the identity.

Does password protection make an unsafe resume acceptable?

No. Encryption can control file access, but it does not change the classification, sensitivity, or release status of the contents. Complete the content review first and share only through a verified hiring channel.

Should I list my exact clearance and access?

State the clearance level you are authorized and expected to disclose. Legacy NSA guidance also allows stating that you have had a polygraph and its date. Leave out program names, compartments beyond your stated level and other investigation detail unless your governing guidance or security office permits them.

What should I do before sending the final file?

Run one last noun-and-number pass, compare the resume with public profiles, verify the recipient independently, and obtain required review. Save the approved version separately so later edits cannot be mistaken for reviewed text.