JAMAL ELMELLAS at Focus-on-Security asks: should you be using a cyber-security careers framework?

The cyber-security skills shortage has shone the spotlight the recruitment process and found it wanting. It’s clear there’s a real disconnect between the needs of the team and what HR then advertise for, with criticism levied at unicorn job descriptions featuring a string of skillsets as long as a proverbial arm.

But this disparity is also down to the way in which the cyber-security sector has evolved.

The remit of job roles such as CISO has changed over time while others, from DevSecOps to Cloud Analyst, have arisen in response to technological innovation. Yet there’s little consensus over what the skills needed for these roles actually are, with different employers advertising for different capabilities and qualifications for the same role.

These discrepancies make it very difficult for candidates to build their careers but they also lead to a confused market. Employers need to know the skills associated with specific roles in order to build an effective team and to carry out future workforce planning but this is nigh impossible to do without structured roles.

However, there is help at hand in the form of career frameworks. These have been developed to bring some much-needed clarity to the market and promise to help improve hiring practices and retention by more accurately matching candidates to roles.

But how do these frameworks work, what’s available and what are the differences?

US, UK and EU

In the US, the National Initiative for Cyber-security Education (NICE) from NIST acknowledges that there are a wide array of starting points and combinations of learning and experience that can act as an entry point into the sector. It’s used by federal partners but adoption in the commercial sector has been growing since the framework was revised in 2020.

The foundation of the framework are Task Knowledge and Skills (TKS) statements which describe how the work is performed and what is needed to do it. Achieving these leads to are then used to build Competencies which then form part of the job description.

At the very top of the framework are Work Roles. There are seven categories (analyse, operate and collect, investigate, protect and defend, securely provision, oversee and govern, and operate and maintain) covering 33 specialty areas and 52 work roles. However, note that a single job may consist of more than one work role. 

The NICCS has developed a Cyber-Career Pathways Tool to enable users to interact with the framework more easily. This allows the user to choose from one of five cyber-security workforce areas (IT, Cyber-security, Cyber-effects, Intel, and Intelligence, which then reveals a subset of roles and their related counterparts called a galaxy. Clicking on a job role provides a range of information such as tasks, Knowledge Skills Abilities (KSAs), capability indicators, and common relationships to other jobs. It’s great fun and provides a wealth of resources.

Closer to home, the UK Cyber-Security Council has developed a Cyber-Career Framework, covering 16 specialisms. Clicking through to learn more on any one of these will reveal more details on working life, responsibilities (which also contains details on job titles and salaries), knowledge, skills, moving on (both vertically and laterally into related jobs), and qualifications. The frameworks is still very new (so much so that the Qualifications section is empty/still under development) and it’s much simpler to use than NICE.

In February 2023, the Council launched its Career Mapping Tool which aims to allow those with transferable skills to find out how they can get into cyber-security as well as providing those already in the sector with route pathways.

Akin to an interactive quiz, it takes the user through 19 cyber-security skills and asks them if they are unfamiliar, have some knowledge or advanced knowledge in that area. The results provide a compatibility percentage against three disciplines: Cryptography and communications, Digital forensics, and Secure system development.

In Europe, ENISA launched the European Cyber-security Skills Framework (ECSF) in September and has since put together an Ad Hoc Working Group to facilitate its uptake and evolution.

The ECSF comprises a Roles document with 12 job categories and their associated missions, tasks, skills, knowledge, and competencies, and a Manual. The Roles document is extremely clear and could easily be used to help formulate job descriptions.

The Manual includes three examples and seven use cases to help organisations see how the framework can be implemented. It’s already being promoted by ISACA and the ECSO (European Cyber Security Organisation), both of whom contributed use cases along with (ISC)2.

The value to candidates and employers

All three frameworks offer value in that they structure the demands of different roles by outlining its demands, skillsets and the knowledge needed to perform it but the UK and US versions offer more insight into entry points and career development. They are living documents and so could provide insight into the future wants of employers – we might see Generative AI prompting added to remits, for instance.

From a candidate’s point of view, the frameworks allow them to take their existing skills, explore potential avenues and look at how they can supplement those skills to develop their careers. Plus there’s the expectation that technology providers may well use these to identify the skills needed to operate their solutions, helping candidates to see which they need to learn to use.

For employers, these frameworks can really help to focus recruitment efforts in a number of ways.

Firstly, they can be used to fill the gaps in the team by identifying what skills the business has versus those it needs. This means the skills then dictate the role needed and these details can then be used to compose more accurate job descriptions.

They can also be used during the interview process to evaluate the competencies of candidates. This means there is likely to be a much higher chance that the candidates selected will meet the needs of the business.

But these frameworks can also boost retention. By using them to determine the skills gaps and competencies of a given individual, it’s possible to create personal career progression plans and to invest in the future of that employee, helping to ensure they’ll remain onboard.

As these frameworks become more widely used and embedded within the industry, I’m sure a time will come when we’ll wonder how we ever did without them. However, right now, they’re a key differentiator for employers and one they can use to beat the skills shortage.

• Elmellas is Chief Operating Officer for Focus-on-Security