The median cyber security professional reads the results of security scanners and then turns them into Jira tickets. That's not even remotely the same skill set that we're talking about here.
Most of the people working in government CNO are just operators. They're pushing buttons in a GUI when they're told to.
They aren't writing exploits or developing tools. Most (though certainly not all) of that work is done by contractors on very good money, or purchased from industry.
