They have a lot of "forward deployed engineer" roles which basically means staff with security clearances who get locked in SCIFs and provide on-site technical support.
Which is really why they keep getting hired: when you write into your contract "it stays on premises and technical support can't take logs off site" they agree to it (at a hefty mark up because all of that sucks to do).