Scholarship for Service (SFS) FAQs

SFS General Questions

What is the Scholarship for Service (SFS)?

SFS is a scholarship program for undergraduate, graduate, and doctoral students in cybersecurity, computer science, or related fields at participating institutions. The scholarship, which is administered by the National Science Foundation, covers up to 3 years of education costs. In exchange for the scholarship, SFS students agree to work for the government in a cybersecurity position (either federal, state, local, tribal, or territorial) for a period of time equivalent to the length of their scholarship. SFS students also intern with various federal agencies and represent many of our CISA cyber interns! SFS students can also be hired noncompetitively after graduation for federal positions.

Which institutions participate in SFS?

Most colleges and universities do not participate in SFS. Florida has the most participating schools at eight. Several states and territories (Alaska, American Samoa, Iowa, Guam, Maine, Montana, New Hampshire, North Dakota, Northern Mariana Islands, Virgin Islands, West Virginia, and Wyoming) do not have any schools that participate. If you would like a comprehensive list of participating schools, you can check the participating institutions list on the SFS webpage.

Can I apply for SFS as an international student?

No, only U.S. citizens and lawful permanent residents/Green Card holders are eligible for this program. However, we can only employ U.S. citizens at CISA for our internships and positions.

How do I apply for the SFS program?

If you go to a participating school, you apply to the program through your school. If you are accepted into the program, you must sign the service agreement. CISA has no role in the application process.

What are the eligibility requirements for SFS?

U.S. citizen or lawful permanent resident
Enrolled as a full-time student at a participating university
Pursuing a bachelor’s, master’s, or doctorate degree in cybersecurity, computer science, information systems, etc.

What is the difference between an SFS student and an SFS post-graduate?

SFS students are currently enrolled at a participating university. SFS post-graduates have graduated from a participating university.

CISA SFS Internship Application Process

How can I become an SFS intern or post-graduate at CISA?: You apply via the SFS listing(s) on USAJOBS. We may have separate listings for current students and post-graduates. After we determine your eligibility and qualifications, hiring managers can select candidates they’re interested in.
What documents should I submit for my application?: You should submit your resume, an unofficial transcript (obtained within the past 30 days), and your SFS service agreement letter via USAJOBS. If selected, you will also need to submit an official transcript to us via email. If you are a post-graduate, we will need proof that you have graduated (i.e., a final transcript).
Where can I find my SFS service agreement letter?: You can obtain this information from the SFS website, by emailing sfs@opm.gov, or from your school’s SFS program.
What format should my transcript (unofficial or official) be in?: An unofficial transcript should have been requested within the past 30 days before your application. It MUST include the student’s name, name of the school, specific degree program, current GPA/academic standing, and past and current coursework. If you have multiple university degrees, you should provide a transcript for each degree program. If any of your transcript(s) is or are from a foreign university, you should also provide a translated version of the transcript. If your transcripts do not provide the information listed above, as well as proof of meeting the qualifications listed in the announcement, include additional official academic documentation that meets the requirements.
I’m not in SFS but want to apply for an SFS internship. Can I do that?: You cannot be selected or considered for an SFS intern position if you are not an SFS student. You are ineligible, and we recommend you look into other internship opportunities with us.
I submitted my application. Do you need anything else from me?: If we need any additional information from you, we will contact you via email.
When should I expect to hear back?: This can vary depending on the hiring managers involved. In general, if you are selected, you should expect to hear back before March. If you are not selected, you probably will not hear back from us.

CISA SFS Intern Experience

Are SFS internships part-time or full-time?

They can be both, but full-time is more common during the summer.

How long does the internship last for?

SFS internships last a minimum of 10 weeks. 10-12 weeks in the summer are common durations, though internships can be extended for up to 20 weeks.

Can I be an SFS intern in the fall or spring, not just the summer?

While most of our interns are summer interns, summer internships can be extended, and SFS interns can intern part-time when returning to their studies. This is less common than summer internships, as we find that Principal Investigators often prefer SFS students to focus on their studies over interning during the school year.

I am based outside of Arlington, VA. Do you have any internships in my location or remote internships?

Most of our SFS interns are fully remote. However, we have the most opportunities for hybrid or in-person internships in the National Capital Region since we have more staff located here. We do occasionally have in-person or hybrid positions outside of headquarters at our regional offices, such as in Boston, MA.

Is there a difference between remote work and telework?

In the government, remote work and telework are different things. Remote work is a fully-remote position and is listed as such on the job announcement. Remote workers rarely go into an office, if ever. Non-remote positions will have a location listed on the job announcement. Most CISA positions are telework-eligible. Teleworking means that you work remotely part of the time but also report to an office on a routine basis. For instance, you may work remotely most of the time but come in on one day a week, etc.

If you are within 50 miles of our Arlington, VA headquarters, CISA telework policy states that you MUST come in at least 1 day a week, regardless of whether or not your position is remote or in-person. Some positions may require you to come in more if, for instance, the position requires working in a secure facility.

What do SFS interns do?

At least 20% of an SFS internship must be cyber-focused. In the past, SFS interns have:

developed ransomware vulnerability guidance for K-12 stakeholders, enhancing awareness of critical vulnerabilities and reducing the time to mitigate vulnerabilities prior to ransomware encryption.
developed a strategy that reduced the time to process vulnerability disclosure information by 30%, with research that analyzed 7,100 vulnerabilities and 2,546 published advisories.
developed automations for the Risk and Vulnerability Assessment Reporting Engine, reducing the need for manual reporting activities and saving time on assessments.
analyzed assessment surveys to evaluate how often the customers implemented CISA’s risk reduction recommendations.
performed market research, capability, and legal analysis to enhance operations through the integration of open-source information and tools.
developed an automated tool using Python to parse scanning data, directly update vulnerability findings and optimizing assessment completion times.
developed automated scripts to monitor the data quality and completeness trends for CVEs. Through this analysis of security.txt file adoption, we identified thousands of sites and leveraged this critical technology to uncover security.txt information used to analyze cybersecurity maturity.
enhanced the Micro Evaluation Security Assessment (MESA) tool to improve our success criteria for regional transition. This is a new tool being developed that enables assessment execution scaling.
used Packer, Ansible, and Terraform to automate the creation of virtual machines.
enhanced vulnerability open-source information gathering and security researcher partnership efforts. This analysis enabled VM to implement an operationally dynamic communication method with valuable security researchers.
created training materials on various platforms for vulnerability hunting.
designed a tool to monitor changes in externally facing web applications for federal agencies. This tool helped the Federal Attack Surface Testing (FAST) service prioritize operational testing.
automated the RustPacker and PythonLoader family of phishing payloads. This tool significantly simplified the assessment teams' work, saving hours of manual effort for each assessment.

SFS Hiring Events

Does SFS host hiring events?: Yes, the Office of Personnel Management (OPM, the agency that runs the SFS program) hosts 1-2 private hiring events for SFS students and post-graduates per year. There is an in-person career fair in Washington, D.C. every January and a virtual career fair in October. Individual agencies also occasionally host virtual informational sessions. If you are not in the SFS program, you cannot attend these events.
What should I expect at an SFS hiring event?: You should expect to speak to multiple representatives and hiring managers from federal agencies and other entities. Some candidates may be interviewed. Others may receive tentative job offers on the spot, though that is uncommon at CISA.

Contact Information

I have questions about the SFS program/internship that can’t be answered on this website. How can I contact you?: If your question isn’t CISA-specific, you can reach out to sfs@opm.gov. If your question is CISA-specific, we encourage you to consult this website, the job listing, and any other prior communications you have received from us before reaching out, but you can contact us at student.careers@cisa.dhs.gov. Otherwise, the response you will receive will not be any different from information on this website unless you have been previously contacted by us or selected for an internship.