This is most definitely _not_ illegal if US citizenship is required to perform the job, which is the case in any job dealing with classified information.
Being a US citizen doesn't automatically mean you get all security clearances. There are many levels/variations of security clearance and job requirement should state what clearance they are looking for.
