.png)
Cybersecurity Job Titles Don't Tell the Whole Story
Employers need to know what candidates can actually do. A clearer framework for skills and proficiency can help connect recruitment, training and professional development.
ITSEC Asia
Two candidates apply for the same security analyst position. Both have relevant qualifications and list incident response among their skills. One can investigate an alert, correlate logs and explain when an incident needs escalation. The other understands the theory but has limited practical experience. On paper, they may look similar. At work, they will need different levels of supervision.
This is a challenge for cybersecurity workforce planning. Job titles and qualifications help describe a candidate's background, but employers also need a reliable way to assess practical capability and identify what someone must learn before taking on greater responsibility.
ENISA's European Cybersecurity Skills Framework provides a useful reference. Its 12 cybersecurity role profiles describe the responsibilities, skills, knowledge and competencies associated with different professional roles. ENISA is currently revising the framework to reflect developments such as AI and secure digital product lifecycles, with new proficiency levels planned to support clearer skills definitions, career pathways and workforce assessment. These issues will be discussed at its conference on 4–5 November 2026. ENISA
The principle applies beyond Europe: organizations need a consistent way to describe the work, assess the person and determine the next step in their development.
Define the work before measuring the person
A useful cybersecurity skills assessment starts with specific responsibilities rather than a long list of desirable traits. An SOC analyst may need to triage alerts, investigate suspicious activity and document findings. A penetration tester must be able to test systems within an authorized scope, validate vulnerabilities and explain their potential impact. A security architect needs to evaluate trust boundaries, access controls and system design.
Each role requires a different combination of knowledge and practical judgment. Treating them as interchangeable makes recruitment less precise and training less effective.
The US National Institute of Standards and Technology (NIST) addresses this problem through its NICE Workforce Framework for Cybersecurity. The framework describes cybersecurity work through work roles, competency areas and statements covering tasks, knowledge and skills. Its components were updated on 28 April 2026, including changes to work roles and competency areas. NIST
Organizations can use this kind of structure to turn a broad job description into observable expectations.
Assess proficiency through evidence
A practical assessment should show what someone can perform, how independently they can do it and where they still need guidance. A candidate applying for a junior SOC role might investigate a simulated alert, document the evidence and explain the decision to escalate. An experienced analyst could be assessed on handling ambiguous indicators, prioritizing several incidents and advising colleagues on response options.
Three elements make the process more useful:
- Task-based assessment: Evaluate work that reflects the actual responsibilities of the role.
- Clear proficiency levels: Define the difference between performing a task with supervision and handling it independently.
- Evidence of development: Record demonstrated skills, remaining gaps and the next learning objectives.
This approach also helps managers avoid two common mistakes: hiring someone based on credentials alone or sending an employee to another course without identifying the specific capability that needs improvement.
Connect assessment with professional development
A skills framework has limited value if it ends at recruitment. The same criteria should inform onboarding, mentoring, performance reviews and further training. When employees move into more complex roles, managers can identify which competencies they have demonstrated and which require more practice.
For Indonesia's cybersecurity workforce, this offers a practical way to align education with employer expectations while giving learners a clearer picture of their progress. Training providers can build learning pathways around defined competencies, and employers can assess whether those pathways produce the skills their teams need.
ITSEC Cyber & AI Academy supports cybersecurity and AI capability development through structured learning. Connecting education with practical assessments can help learners demonstrate their abilities and identify the next skills they need for professional growth.
Build your cybersecurity and AI skills with ITSEC Cyber & AI Academy.
References
- European Union Agency for Cybersecurity (ENISA). European Cybersecurity Skills Conference 2026. Event scheduled for 4–5 November 2026. Read the official ENISA event page
- European Union Agency for Cybersecurity (ENISA). European Cybersecurity Skills Framework (ECSF). Framework overview and current revision plans. Read the ECSF framework page
- National Institute of Standards and Technology (NIST). NICE Releases NICE Framework Components v2.2.0. Published 28 April 2026. Read the NIST announcement
