You build the next generation of cyber professionals by defining the work first, then training people against it. The NIST NICE Framework gives a shared vocabulary of work roles, tasks, knowledge and skills, so you can write real job descriptions, plan apprenticeships and measure growth instead of hiring for vague "security experience."
Why does the pipeline stall?
Most teams ask for senior people and offer no path for juniors. A job post lists ten tools, three certifications and five years of experience. Nobody fits, the role stays open, and the existing team absorbs the work.
The fix is less about recruiting harder and more about describing the job in terms a beginner can grow into. That is where a framework helps.
What is the NICE Framework?
NICE stands for the National Initiative for Cybersecurity Education, run out of NIST. Its framework, published as NIST SP 800-181, breaks cybersecurity work into categories, work roles, and building blocks called tasks, knowledge statements and skill statements. You can pick a role such as vulnerability analysis, read the tasks attached to it, and see what someone needs to know and be able to do.
It is a reference, not a certification. Nothing in it says who is qualified. It says what the work consists of, which is the part most hiring plans skip.
What does this look like in a small team?
Here is a constructed example. A 40-person software company has one security engineer and a backlog of dependency alerts. Instead of hiring a second senior engineer, the lead does three things.
- Picks one narrow work area, vulnerability triage, and lists the tasks: read an advisory, confirm whether the package is used, decide on fix or exception, record the decision.
- Hires a junior engineer from the platform team and pairs them for two sprints, with each task done together first, then alone with review.
- Writes the review criteria down, so "good triage" means something other than the lead's mood.
After a quarter the junior owns triage for low and medium findings, and the senior time goes to design review. No new tool was needed. The role was cut into teachable pieces.
How do you grow people beyond one role?
Work roles overlap. Someone who does triage learns secure coding review next, because the tasks share knowledge. Map the next role from the same framework and you get a ladder that is concrete: these tasks now, these tasks in a year.
Give people time and real work. Courses help with vocabulary. Skill comes from doing tasks with feedback. A capture-the-flag event is useful practice, but a pull request review on your own codebase is closer to the job.
Where can you find people you are overlooking?
Look inside first. Developers who already fix vulnerabilities, support engineers who handle phishing reports, and IT staff who run identity systems all do tasks the framework lists. Tell them the security roles exist and what they involve.
Outside, widen the filter. Drop degree requirements that the work does not need. Ask for a short practical exercise, such as reading a dependency advisory and explaining what they would do, instead of a trivia round.
How to check or apply this
- Choose one security function your team under-serves and read its tasks in the NICE Framework.
- Rewrite the job post around five to eight tasks, not a tool list.
- Define what "done well" looks like for each task, with an example.
- Pair a junior with a senior for the first two cycles, then move to review only.
- Review progress each quarter against the task list and add the next role's tasks.
- Track outcomes that matter to the business, such as time to triage and findings closed, not hours of training.
Tooling can shorten the learning curve when the junior sees context with each finding. Safeguard shows reachability and fix guidance next to a vulnerability, which makes triage easier to teach because the reasoning is visible. It does not replace mentoring.
Quick check
Is the NICE Framework a certification?
No. It is a reference that describes cybersecurity work as roles, tasks, knowledge and skills. It does not qualify or certify individuals.
Do juniors need a security degree?
Not for many roles. Define the tasks, test those tasks in a practical exercise, and train on the gaps.
Sources
Last reviewed: 18 October 2026.
