Most likely what's going on is a combination of outside help (contractors and collaborator tech companies) and hiring in established specialists to develop specific capacities. They will make competitive offers for specialized positions of "need". The rest is likely just careerists implementing well known processes with access to enormous computing resources.

Also, wrt the NSA, they do gobble up many of the top math PhD's, so that would explain their cryptography abilities. There's generally not a lot of industry demand for math phd's.