Cybersecurity Hiring Starts With the Work, Not the Job Title

Ask five employers what a security engineer does and you'll get five different answers. One writes detections, another reviews cloud architecture, a third administers identity, and another spends most of the week chasing tickets. Then everyone wonders why hiring takes months and new employees need another six months to become useful. I'd rather start with the work. The NICE Framework describes cybersecurity work through tasks, knowledge, and skills, which is considerably more useful for workforce planning than an impressive-sounding title (Petersen et al., 2020).

For a detection engineer, I would identify the telemetry they need to understand, the questions their analytics must answer, and the conditions under which a rule should be changed or retired. For an incident commander, the work is different: prioritizing incomplete evidence, authorizing containment, coordinating teams, and keeping leadership accurately informed. These roles overlap, but they are not interchangeable. A sensible job description identifies expected outputs, tools, decision rights, and the operating conditions under which the person must perform.

This also exposes an expensive hiring habit: expecting one person to be an incident responder, cloud architect, penetration tester, privacy lawyer, software engineer, and security executive. Those combinations occasionally exist, but designing a job around an imaginary superhero is not workforce strategy. It is a way of leaving a vacancy open while the actual work goes undone.

Once the work is defined, training can address what the team cannot yet do. NIST's 2024 learning-program guidance emphasizes lifecycle management, behavior change, and evaluation rather than treating training as a one-time event (Merritt et al., 2024). I want people to demonstrate skills in realistic tasks: investigate a compromised identity, explain the evidence, defend a containment decision, or review a proposed architecture for failure paths. A course-completion certificate is evidence of participation. It is not automatically evidence of operational competence.

I would design assessment around the actual job, with enough variation that people cannot simply memorize the answer. The exercise should reveal where someone can perform independently, where they need supervision, and where the training program has failed to prepare them. NIST's measurement guidance offers a useful structure for making such evaluation repeatable (Schroeder et al., 2024). The point is not to reduce a professional to a number; it is to know whether the organization can depend on the skill when it matters.

The Cybersecurity Framework connects governance and operational outcomes, which helps explain why workforce capability matters beyond human resources (National Institute of Standards and Technology, 2024). A team may have adequate headcount but lack the authority to isolate a system. It may have strong technical specialists but nobody capable of leading a complex response. It may own excellent tools but have no one trained to maintain their detections. The control catalog provides relevant requirements for roles, responsibilities, and awareness, but satisfying a documentation requirement is not the same as demonstrating readiness (Joint Task Force, 2020).

A workforce gap analysis should therefore identify the work that is failing, the consequences, the available internal capacity, and the most practical route to closing the gap. Sometimes that means hiring. Sometimes it means training, changing authority, simplifying architecture, or stopping a low-value activity that consumes the entire team. It may also mean telling leadership that a desired capability cannot be delivered safely with the current staffing model, even if the spreadsheet says every position is filled.

Give me the tasks that matter, the environment your people operate, and the decisions they're expected to make. I can help turn those into hiring criteria, a credible education program, and practical assessments. The result should be a team capable of doing the work, not a binder full of course completions.