# Cyber Workforce Development Programs: How to Build One (Skills Matrix, NICE Framework, Career Paths)

> Build a cyber workforce development programme in seven steps: define roles with the NICE Framework, build a skills matrix, assess with practical evidence, set career paths, choose a learning mix, measure with KPIs and fund it. Includes templates and an honest comparison of delivery options.

Source: https://playciso.com/blog/how-to-build-a-cyber-workforce-development-program · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

A workforce development programme answers one question: how will you have the security skills you need next year without hiring all of them? Here is a seven-step build, the templates to use, and an honest comparison of the ways to deliver training. ## Step 1: Which roles do you actually need? Start with the work, not job titles. NIST’s [NICE Workforce Framework for Cybersecurity](https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center) gives you a shared language. Its current components group work roles into five categories: - Oversight and Governance (for example cybersecurity policy, risk management, programme management) - Design and Development (for example security architecture, secure software development, OT cybersecurity engineering) - Implementation and Operation (for example systems administration, network operations) - Protection and Defense (for example defensive cybersecurity, incident response, vulnerability analysis) - Investigation (for example digital evidence analysis) Each work role comes with task, knowledge and skill statements you can copy into your matrix. NIST revises the components regularly: version 2.0.0 (March 2025) reduced the categories to five, and version 2.2.0 (April 2026) added a cybersecurity supply chain risk management role. List the 8 to 15 roles your organisation needs over the next two years, and mark which are covered, thin or missing. The [Security Org Designer](/tools/org-designer) sizes functions and headcount if you are starting from scratch, and the [CISO Role Builder](/tools/ciso-role-builder) defines the top of the structure. ## Step 2: How do you build a cyber skills matrix? One row per skill, one column per person, a 0 to 3 score, and a target level per role. Keep it to 15 to 25 skills per role family or nobody maintains it. An extract for a SOC team: Skill (NICE category)Tier 1 analyst targetTier 2 analyst targetIR lead targetHow it is evidenced Alert triage (Protection and Defense)233Triage lab score; QA review of 10 closed tickets Detection rule writing (Protection and Defense)122Detection lab; rules merged to production Windows and identity log analysis (Protection and Defense)123Lab; investigation write-up Digital evidence handling (Investigation)123Chain-of-custody record from an exercise Incident coordination and comms (Oversight and Governance)013Led a tabletop; after-action report Risk communication to executives (Oversight and Governance)012Board-style brief reviewed by a manager Scale: 0 = no exposure, 1 = can do with guidance, 2 = can do alone, 3 = can teach others and handle edge cases. ## Step 3: How do you assess skills fairly? Self-ratings are a starting point, not evidence. Confirm each score with something observable: a lab result, a reviewed work product or an exercise. Browser labs make this cheap. Everyone can take the same [SOC Case Triage Lab](/tools/case-triage) or [IR Playbook Lab](/tools/ir-playbook-lab) and share a graded scorecard. For team-level maturity alongside individual skills, use the [SOC Maturity Assessment](/tools/soc-maturity-assessment). ## Step 4: What career paths should you publish? People stay when they can see the next step. Publish the ladder with what each rung needs: StepSkills at target levelCertification that helps (Oct 2026 price)ExperiencePractice SOC analyst, Tier 1Triage, ticketing, phishing analysisCompTIA Security+ (US$439)0 to 1 year[SOC Log Triage Trainer](/tools/soc-triage) SOC analyst, Tier 2Investigation, detection tuningCySA+ (US$439) or BTL1 (£399)1 to 3 years[Detection Lab](/tools/detection-lab) Incident responder / IR leadCoordination, forensics, commsGIAC GCIH (US$999 per attempt)3 to 5 years[IR Playbook Lab](/tools/ir-playbook-lab), [War Room](/warroom) SOC or security managerPeople, budget, metrics, riskCISM or CISSP (US$749 exam); both need 5 years5+ years[Board Metrics Lab](/tools/board-metrics-lab), [KPI library](/kpi-library) Give each person a written plan for their next step. The [Cyber Certification Roadmap](/tools/cyber-cert-roadmap) produces one from current role, target role, budget and weekly hours. ## Step 5: What learning mix works? Most skill comes from doing the work with feedback, so weight the programme toward practice, not course hours. Compare the delivery options honestly: ApproachBest forExamplesMain drawbackCost profile Hands-on lab platformsTechnical skills at scaleTryHackMe, Hack The Box, PlayCISO browser labsLab skill does not always transfer to your toolsFree tiers to per-seat business plans Cyber rangesTeam drills on realistic networksCyberbit, RangeForce, Immersive LabsCost and scheduling effortEnterprise contracts CertificationsRecognised baselines and promotion criteriaCompTIA, ISC2, GIAC, ISACAExam pass is not job performanceUS$125 to US$999+ per exam Instructor-led coursesDeep specialist skillsSANSVery expensive per seatThousands of US dollars per course Decision simulations and tabletopsIncident command, leadership, cross-team responseCISA Tabletop Exercise Packages, PlayCISO War RoomNeed a facilitator and follow-upFree to low cost Mentoring and rotationsJudgement and contextSOC shadowing, IR on-call as second responderTakes senior people’s timeInternal time Honest note on PlayCISO: it is strongest for browser-based labs, incident decision simulations and leadership practice. It has no full virtual-machine attack boxes, no accredited certification and no LMS/SCORM integration, and its library and community are smaller than TryHackMe’s or Hack The Box’s. Larger organisations that need ranges or an LMS will combine it with other platforms. ## Step 6: How do you measure the programme? Measure outcomes, not completions: - Share of people at target level per role, every six months. - Internal fill rate: open security roles filled from inside. - Time for new analysts to work alerts alone. - Role KPIs before and after: for example mean time to triage for SOC analysts or time to contain for IR leads. The KPI library lists 5 KPIs, plus SLAs and performance measures, for each of 30 security roles. - 12-month retention of people on the programme. ## Step 7: How do you fund it? Set a per-person annual budget (exam vouchers, one platform licence, one course for senior staff) and, more important, protected time: 4 to 8 hours a month that managers cannot reclaim. Tie certification sponsorship to the career path so money follows the plan. ## Checklist: launching your programme - List the roles you need, mapped to NICE work roles. - Draft a 15 to 25 skill matrix per role family with target levels. - Run a baseline assessment with one practical lab per role. - Publish the career ladder with skills, certifications and experience per step. - Agree a per-person budget and protected learning hours. - Pick role KPIs to track from the KPI library. - Schedule the six-monthly matrix review now.