<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-team-development
description: >-
  Build high-performing security teams including hiring strategies,
  skills matrices, career ladders, training programs, retention
  frameworks, and performance management systems.
domain: cybersecurity
subdomain: security-leadership
tags:
  - team-development
  - hiring
  - career-ladders
  - skills-matrix
  - training
  - retention
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Team Development

## Overview

Security team development addresses the persistent talent gap through
structured hiring, development, and retention programs covering org
design, role definition, skills assessment, and career pathing.

## Prerequisites

| Requirement | Purpose |
|---|---|
| HR partnership | Recruiting and compensation benchmarking |
| NICE Framework | Cybersecurity workforce framework |
| Training budget | Professional development allocation |

## Key Concepts

### Team Structure Model

```python
team_structure = {
    "leadership": ["CISO", "VP_Security", "Director"],
    "management": ["Manager", "Team_Lead", "Principal"],
    "senior_ic": ["Staff_Engineer", "Senior_Analyst"],
    "mid_ic": ["Security_Engineer", "SOC_Analyst_III"],
    "junior_ic": ["Associate_Engineer", "SOC_Analyst_I"],
}
skills_matrix = {
    "detection_engineering": {"required": 3, "current": 2, "gap": 1},
    "cloud_security": {"required": 4, "current": 2, "gap": 2},
}
```

## Workflow

1. **Define org structure** — Map roles to security functions
2. **Build skills matrix** — Current vs required competencies
3. **Create career ladders** — IC and management progression tracks
4. **Develop hiring pipeline** — Skills-based screening criteria
5. **Implement training** — Map training to gaps, budget per person
6. **Establish mentoring** — Pair senior and junior staff
7. **Measure retention** — Track turnover and engagement metrics

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
