Library
Cybersecurity career path, levels and ladder
Updated
5 levels, from Security Analyst to Principal Security Engineer. Each one is rated on the same 41 skills — what changes between the rungs is how good you have to be at each. A ladder from security analyst to principal engineer, covering threat operations, exposure, identity, architecture and risk.
- Level 1 of 5
Security Analyst job description
Monitors alerts and works incident playbooks under supervision.
Read the job description - Level 2 of 5
Senior Security Analyst job description
Investigates and closes incidents independently end to end.
Read the job description - Level 3 of 5
Security Engineer job description
Builds and hardens security controls across a domain.
Read the job description - Level 4 of 5
Senior Security Engineer job description
Owns a domain and leads response to major incidents.
Read the job description - Level 5 of 5
Principal Security Engineer job description
Sets security architecture and strategy across the organization.
Read the job description
Cybersecurity levels and job titles
Analyst, engineer and architect titles overlap in security. This table maps each level on this ladder to the titles you will commonly see elsewhere. For how these titles line up across departments, see the job title hierarchy.
| Level on this ladder | Common job titles |
|---|---|
| Security Analyst | Security Analyst, Cybersecurity Analyst I, IT Security Analyst, Information Security Analyst I, Associate Security Engineer |
| Senior Security Analyst | Senior Security Analyst, Senior Cybersecurity Analyst, Cybersecurity Analyst II, Information Security Analyst II |
| Security Engineer | Security Engineer, IT Security Engineer, Intermediate Security Engineer, Cybersecurity Analyst III |
| Senior Security Engineer | Senior Security Engineer, Senior IT Security Engineer, Staff Security Engineer, Security Architect |
| Principal Security Engineer | Principal Security Engineer, Distinguished Security Engineer, Lead Security Architect, Principal Security Architect |
Individual contributor or manager?
These are individual contributor (IC) titles: they grow in technical scope and influence, not in direct reports. Many companies also run a separate manager track that branches off around Senior, such as Security Manager, then Head of Security or a Chief Information Security Officer (CISO). Moving between the two tracks is a change of job, not a promotion.
Skills matrix
41 skills and 5 certifications across 5 levels.
| Skill/Certification 46 | Security Analyst | Senior Security Analyst | Security Engineer | Senior Security Engineer | Principal Security Engineer |
|---|---|---|---|---|---|
| Threat Operations6 | |||||
| BasicYou can triage routine alerts using the playbook and record your reasoning on the ticket, with a senior analyst checking each closure. | ProficientYou can pull extra evidence from other tools to triage alerts, including insider misuse such as unusual access or bulk data copying. | AdvancedYou can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts. | AdvancedYou can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts. | AdvancedYou can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts. | |
| NoviceYou can implement a detection rule from a provided specification and confirm it fires against a known sample. | BasicYou can write a simple detection rule from a described behavior, test it against sample data, and adjust it when it fires too often. | AdvancedYou can build detection coverage for a whole class of technique, prioritize which gaps matter most, and coach others in writing rules that hold up in production. | AdvancedYou can build detection coverage for a whole class of technique, prioritize which gaps matter most, and coach others in writing rules that hold up in production. | ExpertYou can set the detection engineering strategy for the organization, deciding where investment in content beats investment in tooling, and defend detection coverage decisions to leadership. | |
| BasicYou can build a simple search or dashboard panel from an existing example, and onboard a log source by following the runbook with a reviewer checking it. | ProficientYou can fix parsing faults in a log source, tune a noisy rule without losing coverage, and report retention gaps against what detections need. | AdvancedYou can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap. | AdvancedYou can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap. | AdvancedYou can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap. | |
| NoviceYou can follow an incident response runbook for a routine incident under close supervision, and keep the incident log up to date as you go. | ProficientYou can coordinate a multi-system incident across several teams and decide when to escalate and who the law requires you to notify. | AdvancedYou can command a major incident, balancing containment, evidence and notification duties, and run the review that changes something. | ExpertYou can set the incident response program for the organization, including who has authority to declare and close an incident, and represent the organization to regulators or the board after a serious breach. | ExpertYou can set the incident response program for the organization, including who has authority to declare and close an incident, and represent the organization to regulators or the board after a serious breach. | |
| NoviceYou can capture a memory image or log export following a written procedure, without altering the evidence in the process. | BasicYou can collect evidence from a single system, maintain a chain of custody record, and identify obviously suspicious artefacts. | ProficientYou can reconstruct a timeline of attacker activity across several systems from disk, memory and log evidence, and get a second review of any finding that rests on one source. | AdvancedYou can lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator. | AdvancedYou can lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator. | |
| NoviceYou can read a threat intelligence report and summarize what it says about a specific indicator or actor. | BasicYou can check the environment against indicators from a report, and flag matches for investigation. | ProficientYou can assess the credibility and relevance of a new intelligence source, and translate known techniques used by a threat actor into specific defensive changes. | AdvancedYou can run a structured intelligence program that prioritizes collection against the threats the organization actually faces, and brief technical findings to non-technical leaders. | ExpertYou can set intelligence requirements and sourcing strategy for the organization, and advise leadership on emerging threats before they become incidents. | |
| Exposure Management6 | |||||
| BasicYou can assign severity from the agreed scale to scan findings using the triage guide, and pass doubtful ones to a senior analyst. | ProficientYou can design a scanning scope and cadence for a new environment, and correlate findings across tools to avoid duplicate or contradictory severity ratings. | AdvancedYou can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning program from what was missed. | AdvancedYou can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning program from what was missed. | AdvancedYou can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning program from what was missed. | |
| NoviceYou can log a vulnerability finding with the owning team and follow up until you get a status update. | BasicYou can track remediation against agreed timelines for findings you own, and escalate ones that are about to breach their deadline. | ProficientYou can negotiate a realistic remediation plan with a resistant system owner, and decide when a temporary compensating control is good enough to hold the risk. | AdvancedYou can run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on. | AdvancedYou can run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on. | |
| NoviceYou can follow a test plan to run known tools against an agreed target and record what each one reports. | NoviceYou can follow a test plan to run known tools against an agreed target and record what each one reports. | ProficientYou can plan and run a test against a more complex environment, develop a proof of concept for a finding that tooling alone did not confirm, and write a report a system owner can act on. | AdvancedYou can scope and lead a test involving several systems or a red-team-style exercise, and judge when a finding is too dangerous to demonstrate live rather than describe. | ExpertYou can set the offensive testing program for the organization, deciding what gets tested, how often and by whom, and interpret results against the real risk appetite of the organization. | |
| NoviceYou can read a posture management dashboard and describe what a specific finding means for the resource it flags. | BasicYou can fix a straightforward misconfiguration, such as an open storage bucket or an over-permissive rule, once it has been flagged to you. | ProficientYou can define the baseline a cloud environment should be checked against, and investigate why a class of finding keeps recurring rather than fixing each instance. | AdvancedYou can drive posture improvement across multiple cloud accounts and providers, and stop a risky deployment pattern by changing how it is provisioned rather than by policing it after the fact. | ExpertYou can set the cloud security baseline and guardrails for the organization, and decide which controls are enforced automatically versus left to review. | |
| NoviceYou can list the externally reachable services for a system you support when asked, using tools someone else set up. | BasicYou can scan known ranges and record each asset found in the inventory, with exposed services that should not be reachable marked. | ProficientYou can find unmanaged exposure such as forgotten infrastructure or shadow IT, and get it decommissioned or brought under control. | AdvancedYou can build continuous attack surface monitoring into how the organization ships infrastructure, and reduce a whole category of exposure rather than one instance at a time. | AdvancedYou can build continuous attack surface monitoring into how the organization ships infrastructure, and reduce a whole category of exposure rather than one instance at a time. | |
| NoviceYou can compare the settings of a system with a published hardening checklist and list each setting that differs. | BasicYou can apply an approved baseline to a system and record each exception and its owner, with a reviewer checking the record. | ProficientYou can write the hardening baseline for a new type of system, and set up checks that report drift from it. | AdvancedYou can run baseline compliance across many types of system and rule on each exception according to the risk it carries. | AdvancedYou can run baseline compliance across many types of system and rule on each exception according to the risk it carries. | |
| Resilience1 | |||||
| NoviceYou can follow a recovery runbook to restore a system from backup under supervision, and record each step and the time it took. | ProficientYou can plan the recovery order for critical systems and run a recovery exercise that tests the agreed recovery targets. | AdvancedYou can protect backups from alteration or deletion by an attacker, and test that a clean restore works when the main environment is compromised. | ExpertYou can set the criteria that declare recovery complete, and show executives whether recovery targets hold after a destructive attack. | ExpertYou can set the criteria that declare recovery complete, and show executives whether recovery targets hold after a destructive attack. | |
| Identity and Access3 | |||||
| NoviceYou can process a routine access request or remove access for someone who has left, against the written procedure. | BasicYou can run a periodic access review for a system you support, and chase down owners who have not responded. | ProficientYou can design an access review process for a new system, decide what evidence a reviewer actually needs to make a real decision, and act on stale or excessive access it turns up. | AdvancedYou can defend access governance across many systems to an auditor, and redesign reviews that reviewers approve without checking. | AdvancedYou can defend access governance across many systems to an auditor, and redesign reviews that reviewers approve without checking. | |
| NoviceYou can raise and close a privileged access request under supervision, following the checkout process for admin accounts and returning the credential when the task is done. | BasicYou can administer the privileged access tooling day to day, onboarding accounts, setting session recording and rotating credentials to the agreed schedule. You spot when a request asks for more reach than the task needs and say so. | ProficientYou can design the privileged access model for a system, deciding which accounts are vaulted, how long a session lasts and what gets recorded. You handle break-glass access without leaving a standing privilege behind. | AdvancedYou can bring privileged access under control where admin accounts are shared or embedded in scripts, and get owners to agree the migration. | AdvancedYou can bring privileged access under control where admin accounts are shared or embedded in scripts, and get owners to agree the migration. | |
| NoviceYou can configure a straightforward single sign-on connection from a documented pattern and test that a user can sign in, with an engineer reviewing the settings before they go live. | NoviceYou can configure a straightforward single sign-on connection from a documented pattern and test that a user can sign in, with an engineer reviewing the settings before they go live. | ProficientYou can design federation for an application with awkward requirements, and document what each trust decision hands to the other party. | AdvancedYou can federate across organizational boundaries, including mergers and partner tenants with conflicting identity sources, and restore sign-on for everyone when a broken trust locks users out. | AdvancedYou can federate across organizational boundaries, including mergers and partner tenants with conflicting identity sources, and restore sign-on for everyone when a broken trust locks users out. | |
| Secure Architecture5 | |||||
| NoviceYou can produce the security section of a design for a small system by following an existing pattern, and explain each control you included when an architect reviews it. | NoviceYou can produce the security section of a design for a small system by following an existing pattern, and explain each control you included when an architect reviews it. | ProficientYou can own the security design for a whole service, from encryption algorithms and key custody to controls that fit its risk. | AdvancedYou can design for systems with competing constraints, legacy dependencies or regulatory obligations, and get tradeoffs agreed with the engineers who build them. | ExpertYou can set the reference architectures and cryptographic standards teams build on, and plan for replacing an algorithm without redesigning systems. | |
| NoviceYou can draw the data flow for a system you support and name the obvious attack paths in a threat modeling session led by a facilitator. | BasicYou can run a threat model for a single application using an agreed method, record the threats found and link each one to a control or an accepted risk. | ProficientYou can facilitate threat modeling for a system you did not build, covering AI components such as prompt injection, and turn the output into work that gets done. | AdvancedYou can threat model systems with complex trust relationships, supply chains or unclear ownership, and separate the threats worth spending on from the ones worth accepting. You change the method when it stops finding anything. | ExpertYou can decide how and when the organization threat models, and show that the practice changes what gets built. You get teams to model their own systems without you in the room. | |
| NoviceYou can run a configured scan against a test environment, triage the output against the known false positives and write findings up for a reviewer to check before they reach the team. | BasicYou can test an application yourself with both scanner and manual technique, confirm a finding is genuinely exploitable, and describe the reproduction steps clearly enough to fix. | AdvancedYou can test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release. | AdvancedYou can test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release. | AdvancedYou can test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release. | |
| NoviceYou can read a small change and spot the well-known weaknesses, such as unvalidated input or a hardcoded secret, with an experienced reviewer confirming what you found. | BasicYou can review a feature in a language you work in, trace user-controlled data to where it is used, and explain the fix to the author. | ProficientYou can review unfamiliar code and find the security flaw in its logic, not just in its patterns, including the authorization check that is missing rather than wrong. | AdvancedYou can review code whose weakness spans files, frameworks or trust boundaries, and decide which findings, including pipeline scanner results, should block a release. | AdvancedYou can review code whose weakness spans files, frameworks or trust boundaries, and decide which findings, including pipeline scanner results, should block a release. | |
| NoviceYou can check a proposed design against a requirements checklist and write up what is missing, with a senior reviewer deciding what actually blocks approval. | NoviceYou can check a proposed design against a requirements checklist and write up what is missing, with a senior reviewer deciding what actually blocks approval. | ProficientYou can review a proposed system on your own, tell a required control apart from a preference, and give the project a decision it can build against rather than a list of concerns. | AdvancedYou can review designs where security requirements conflict with cost, delivery date or an existing platform, and land an agreed position with conditions attached. You are brought in when a project and security have deadlocked. | ExpertYou can set which changes need review, what the standing requirements are, and where teams may assess themselves. You get design review treated as help early rather than a gate at the end. | |
| Governance and Risk6 | |||||
| NoviceYou can gather the information a risk assessment needs and draft the entries, with an assessor setting the ratings and deciding what goes to the risk owner. | BasicYou can assess a contained risk using the agreed method, describe the impact in terms the system owner recognizes, and propose treatment options. | ProficientYou can assess risk for a project or system independently, including privacy risk to personal data, and get a named owner to accept or treat it. | AdvancedYou can assess risk where the impact is uncertain or contested, and give decision-makers a real choice rather than a color on a heat map. You challenge a rating that has been set to suit the answer someone wanted. | ExpertYou can set how the organization measures and reports security risk, including its appetite and its escalation thresholds. You get executives to act on the risks that matter and to stop spending on the ones that do not. | |
| NoviceYou can apply agreed edits to policy documents and log each change, with an owner reviewing what you produce before it is published. | NoviceYou can apply agreed edits to policy documents and log each change, with an owner reviewing what you produce before it is published. | ProficientYou can write a policy or standard people can follow, covering privacy duties and acceptable AI use, and take it through consultation and approval. | AdvancedYou can rework a policy set that has drifted from practice, and decide whether to change the policy or the practice while keeping within privacy law. | ExpertYou can decide the policy and control framework the organization runs by, and which external standards it commits to certify against. | |
| NoviceYou can send out a supplier security questionnaire, chase the response and summarize the answers, with a reviewer deciding what the gaps actually mean. | NoviceYou can send out a supplier security questionnaire, chase the response and summarize the answers, with a reviewer deciding what the gaps actually mean. | BasicYou can check the evidence a supplier provides beyond the questionnaire, and record its criticality tier and residual risk. | AdvancedYou can assess critical suppliers and the provenance of what they ship, and lead the response when one is breached. | AdvancedYou can assess critical suppliers and the provenance of what they ship, and lead the response when one is breached. | |
| NoviceYou can help deliver awareness activity, issuing the training, tracking completion and collating phishing simulation results for someone else to interpret. | BasicYou can run a scheduled awareness campaign or phishing simulation yourself, brief the managers affected and handle the reports that come back from staff. | ProficientYou can design awareness activity for a specific audience and threat, pick a simulation difficulty that teaches rather than shames, and show whether reporting behavior changed. | AdvancedYou can move awareness from a completion figure to a measured change in behavior, including with audiences who have tuned security training out for years. You handle it when a simulation lands badly with senior staff. | AdvancedYou can move awareness from a completion figure to a measured change in behavior, including with audiences who have tuned security training out for years. You handle it when a simulation lands badly with senior staff. | |
| NoviceYou can pull the data for a regular security report, produce the figures to an agreed template and flag anything in the numbers that looks wrong. | BasicYou can maintain a reporting pack, explain what each metric counts and where it comes from, and answer questions about a movement in the figures. | ProficientYou can choose metrics that answer a real question about exposure, build them from sources you have verified, and write a report a non-technical reader can act on. | AdvancedYou can report on areas where the data is incomplete or easy to game, and say plainly what the numbers cannot tell you. You retire metrics that people have learned to hit without becoming any safer. | AdvancedYou can report on areas where the data is incomplete or easy to game, and say plainly what the numbers cannot tell you. You retire metrics that people have learned to hit without becoming any safer. | |
| NoviceYou can collect the evidence for a control test from a checklist and log what each piece shows, with an assessor judging the result. | BasicYou can test a single control against its stated requirement and report any gap to the control owner. | ProficientYou can plan and run an assessment of the controls on a system, and write findings that state the control, the evidence and the gap. | AdvancedYou can run an internal audit of a control framework, and defend its sampling and conclusions to an external auditor or regulator. | ExpertYou can set how often and how independently controls are tested, and report to the board how far control claims are backed by evidence. | |
| Certifications5 | |||||
| Not required | Required | Required | Required | Required | |
| Not required | Not required | Required | Required | Required | |
| Not required | Not required | Required | Required | Required | |
| Not required | Not required | Not required | Required | Required | |
| Not required | Not required | Not required | Not required | Required | |
| Delivery4 | |||||
| NoviceYou can keep your own tasks and deadlines in a current to-do list, and tell your manager as soon as work you own will be late. | BasicYou can organize a small piece of work into steps, put them in a sensible order, and finish it by the date you agreed, raising problems before they cause a delay. | ProficientYou can coordinate a small team's work on a shared goal: who does what by when, what has to wait for what, and a revised plan when things change. | AdvancedYou can keep several people's work in step across teams, agree priorities and hand-offs with them, and keep one shared task list that all of them actually use. | ExpertYou can set the everyday habits for how work is organized and followed up across the organization, and teams you do not lead adopt the routines you introduce. | |
| NoviceYou can estimate how long a task will take once the approach is clear, and you say promptly when the estimate turns out to be wrong. | BasicYou can estimate your own work with reasonable accuracy and keep a steady enough pace that other people can plan around you. | ProficientYou can estimate a whole project including its risks and unknowns, split it into stages, and defend the estimate when it is challenged. | AdvancedYou can estimate work that spans several teams, name the assumptions behind each figure, and rework the plan when those assumptions break. | ExpertYou can forecast work and staffing quarters ahead, and set the estimating method other teams use. | |
| BasicYou can stay responsible after you hand work over: you check it did what it was meant to, fix your own mistakes, and give updates before anyone asks. | ProficientYou can pick up a problem that has no obvious owner and make yourself accountable for it, including the parts nobody enjoys. | AdvancedYou can hold accountability for outcomes delivered mostly by other people, taking the blame when it fails and passing on the credit when it works. | AdvancedYou can hold accountability for outcomes delivered mostly by other people, taking the blame when it fails and passing on the credit when it works. | ExpertYou can report the organization's most exposed outcomes to its leaders as they stand, including bad news, and answer for them. | |
| BasicYou can choose checks that suit the task in front of you, catch your own mistakes before anyone else sees them, and confirm the result works once people start using it. | ProficientYou can define what good enough means for a project, put checks in place to show it has been met, and hold work back when it falls short. | AdvancedYou can set how quality is checked on complex work shared by several teams, and you spot the problems that only appear where their pieces meet. | AdvancedYou can set how quality is checked on complex work shared by several teams, and you spot the problems that only appear where their pieces meet. | ExpertYou can raise the quality bar across the organization by building the tools and habits that make the careful way the easy way. | |
| Craft3 | |||||
| BasicYou can work out what is wrong in work you did not create, and you fix the underlying cause instead of working around the symptom. | ProficientYou can break a large, ambiguous problem into pieces and weigh the options for each against the evidence. | AdvancedYou can make the call on a problem outside your expertise and explain its cost, time and risk. | AdvancedYou can make the call on a problem outside your expertise and explain its cost, time and risk. | ExpertYou can crack problems the organization has repeatedly failed to solve, and your approach becomes how others tackle that whole kind of problem. | |
| NoviceYou can apply the basics of your field to the work you are given, and ask an expert when a task goes beyond what you have learned. | BasicYou can work confidently with the tools and methods your team uses daily, and you can explain how your work serves the team's goals. | ProficientYou can advise the team on your area and apply new developments in the field where they pay off. | AdvancedYou can bring in good practice from outside the organization and make it work here, and your judgment clearly improves the work you touch. | ExpertYou can influence how the field is practiced beyond this organization, and your expertise settles questions that have stood open for years. | |
| ProficientYou can pick up an unfamiliar area fast enough to be useful in it, and you turn what you learned into something others can reuse. | ProficientYou can pick up an unfamiliar area fast enough to be useful in it, and you turn what you learned into something others can reuse. | AdvancedYou can judge which new ideas are worth the team's time and which are not, and you make room for the people around you to learn too. | AdvancedYou can judge which new ideas are worth the team's time and which are not, and you make room for the people around you to learn too. | ExpertYou can set what the organization invests its learning time in, and the material and practice you create outlive your involvement. | |
| Communication4 | |||||
| BasicYou can explain your work so your team can act on it, and play a request back in your own words before you act on it. | ProficientYou can explain a complex topic to people with very different backgrounds, adjusting the detail to the audience without talking down to them. | AdvancedYou can bring disagreeing groups to agreement on the facts and the next steps, and help colleagues frame a difficult or sensitive message. | AdvancedYou can bring disagreeing groups to agreement on the facts and the next steps, and help colleagues frame a difficult or sensitive message. | ExpertYou can set how the organization communicates by creating the forums and norms that teams use to share information. | |
| BasicYou can work well with people in other roles, share context and credit, and take criticism of your work without defending territory. | ProficientYou can build working relationships beyond your own team and get things done through people who do not report to you. | AdvancedYou can align teams with competing priorities on a common goal, surfacing the conflict early instead of letting it harden into resentment. | AdvancedYou can align teams with competing priorities on a common goal, surfacing the conflict early instead of letting it harden into resentment. | ExpertYou can remove the barriers that stop teams working together by putting in place routines and forums they use across the organization. | |
| BasicYou can document your own work well enough for a colleague to follow it unaided, such as a how-to guide or a handover, and keep it current as things change. | ProficientYou can write for a defined audience, whether a proposal, a policy, a report, or a decision record, and make the reasoning as clear as the conclusion. | AdvancedYou can own the documents behind a large piece of work, coordinating contributions so that people who were not involved can carry it on. | AdvancedYou can own the documents behind a large piece of work, coordinating contributions so that people who were not involved can carry it on. | ExpertYou can set the writing standard the organization works to, and documents you wrote are still in use long after you have moved on. | |
| NoviceYou can keep your manager and immediate team informed of your progress, and you raise an issue before someone else discovers it. | BasicYou can identify who is affected by your work and keep them updated at a level of detail and a frequency that suits them. | ProficientYou can win support for a proposal, reset expectations when the plan changes, and turn down a request with a reason the other side accepts. | AdvancedYou can hold senior and external relationships, negotiate between competing demands, and deliver unwelcome news without losing trust. | ExpertYou can represent the organization in its most important relationships and set how it engages with everyone who depends on it. | |
| Leadership3 | |||||
| NoviceYou can act on direction well, seek feedback on how you work, and be open about what you need help with. | BasicYou can spot a problem and propose a way forward unprompted, and you take a small leading role such as running a working group. | ProficientYou can lead one piece of work shared by several people, on your own team and beyond, and make calls that they act on. | AdvancedYou can lead across team boundaries, build the credibility that makes people follow you by choice, and create room for others to lead. | ExpertYou can set direction for the whole organization, make hard calls under real uncertainty, and carry the decisions nobody else wants to own. | |
| NoviceYou can share what you have just learned with your peers and help a newer colleague find their way around. | BasicYou can help someone new settle into your team's work, answer their questions patiently, and give feedback specific enough to act on. | ProficientYou can mentor someone over months, tell them the uncomfortable thing they need to hear, and adapt how you teach to how they learn. | AdvancedYou can develop other mentors, coach people through career decisions rather than tasks, and lift the capability of a whole team. | ExpertYou can shape how the organization grows its people, and those you developed are themselves named by others as strong in their field. | |
| NoviceYou can explain why the work you were given matters and who it is for. | BasicYou can connect your team's work to its goals and question a task that does not appear to serve them. | ProficientYou can look a year ahead in your area, name what will matter by then, and turn that into work people can pick up now. | AdvancedYou can set direction for an area, choose deliberately what not to do, and defend that choice when it is challenged. | ExpertYou can shape the organization's strategy, and the bets you argued for are visible in where it ended up. | |
Use this ladder with your own team
For managers and HR teams: create a free account, then add cybersecurity from Departments → Add from template in one click: all 41 skills, with the mastery expected at each of your 5 career levels.