You can close part of the skills gap by growing people you already employ. Engineers, system administrators and support staff know your systems. Use the NIST NICE Framework to define the role, test the skills you need, and plan training, instead of hunting for a rare hire with every credential.
What is the NICE Framework?
NIST describes the NICE Workforce Framework for Cybersecurity as a shared vocabulary, a common language that describes cybersecurity work and the knowledge and skills needed to do it. NIST says employers, educators, and service and tool providers in the public and private sectors use it to address the workforce gap.
Its listed uses include career discovery, education, hiring (widening the talent pipeline, writing job descriptions and assessing candidate skills), training and development, and workforce planning. The page says its components can be tailored to an organization's goals. It points to separate pages for work roles and for the detailed task, knowledge and skill statements, so read those before you adopt specific role definitions.
Why does internal talent work?
Constructed example: a platform team has a site reliability engineer who already owns the deploy pipeline and cloud accounts. She knows where secrets live, which services are exposed and who owns each one. Moving her toward an application security role means teaching threat modeling and triage. A new external hire would need months to learn the environment first.
The same logic fits a help desk lead who knows how accounts get reset and where social engineering lands, or a developer who reviews code carefully.
How do you define the role honestly?
Most postings ask for an unrealistic mix. The NICE Framework helps by separating work into roles and then into the knowledge and skills each needs. Pick the role you need this year, such as vulnerability triage or access review. Write down the tasks, then the skills. Cut the rest.
A short, specific description widens the pool, since people can see that they already hold half the skills.
What should a growth path include?
NICE lists apprenticeships, competitions and role-based training as development routes. Combine them:
- Shadowing on real incidents or reviews, which teaches judgment.
- A small owned project, such as running the dependency review for one product.
- Structured study aligned to the skills list, with time protected in work hours.
- A named mentor, and a review at ninety days.
What can go wrong?
Training someone and then giving them no time or authority to use it wastes both. Do not move a person into security on top of a full operations job. Also avoid ranking people by certificates alone. NIST frames the framework as a way to assess candidate skills, so test those skills with a practical exercise.
How to check or apply this
- List the two or three security tasks that matter most this year.
- Map each task to a NICE work role and read its task, knowledge and skill statements.
- Survey current staff for adjacent skills and interest.
- Write a short role description and share it internally first.
- Fund time, a mentor and a small owned project for each person.
- Review after ninety days against the skills list, and adjust.
Quick check
What is the NICE Framework?
A NIST framework giving a common language for cybersecurity work, with the knowledge and skills each kind of work needs.
Can the framework help write job descriptions?
Yes. NIST lists writing job descriptions and assessing candidate skills among its hiring uses.
Sources
Last reviewed: 18 October 2026.
