Work Roles

Work Role ID: OV-TEA-002

Cyber Instructor

Develops and conducts training or education of personnel within cyber domain.

Category: Oversee and Govern
Specialty Area: Training, Education, and Awareness

Abilities

  • A0006: Ability to prepare and deliver education and awareness briefings to ensure that systems, network, and data users are aware of and adhere to systems security policies and procedures.
  • A0011: Ability to answer questions in a clear and concise manner.
  • A0012: Ability to ask clarifying questions.
  • A0013: Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
  • A0014: Ability to communicate effectively when writing.
  • A0015: Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.
  • A0016: Ability to facilitate small group discussions.
  • A0017: Ability to gauge learner understanding and knowledge level.
  • A0018: Ability to prepare and present briefings.
  • A0019: Ability to produce technical documentation.
  • A0020: Ability to provide effective feedback to students for improving learning.
  • A0022: Ability to apply principles of adult learning.
  • A0023: Ability to design valid and reliable assessments.
  • A0024: Ability to develop clear directions and instructional materials.
  • A0032: Ability to develop curriculum for use within a virtual environment.
  • A0037: Ability to leverage best practices and lessons learned of external organizations and academic institutions dealing with cyber issues.
  • A0055: Ability to operate common network tools (e.g., ping, traceroute, nslookup).
  • A0057: Ability to tailor curriculum that speaks to the topic at the appropriate level for the target audience.
  • A0058: Ability to execute OS command line (e.g., ipconfig, netstat, dir, nbtstat).
  • A0063: Ability to operate different electronic communication systems and methods (e.g., e-mail, VOIP, IM, web forums, Direct Video Broadcasts).
  • A0066: Ability to accurately and completely source all data used in intelligence, assessment and/or planning products.
  • A0070: Ability to apply critical reading/thinking skills.
  • A0083: Ability to evaluate information for reliability, validity, and relevance.
  • A0089: Ability to function in a collaborative environment, seeking continuous consultation with other analysts and experts—both internal and external to the organization—to leverage analytical and technical expertise.
  • A0105: Ability to tailor technical and planning information to a customer’s level of understanding.
  • A0106: Ability to think critically.
  • A0112: Ability to monitor advancements in information privacy technologies to ensure organizational adaptation and compliance.
  • A0114: Ability to develop or procure curriculum that speaks to the topic at the appropriate level for the target.
  • A0118: Ability to understand technology, management, and leadership issues related to organization processes and problem solving.
  • A0119: Ability to understand the basic concepts and issues related to cyber and its organizational impact.
  • A0171 : Ability to conduct training and education needs assessment. 
  • Knowledge

  • K0001: Knowledge of computer networking concepts and protocols, and network security methodologies. 
  • K0002: Knowledge of risk management processes (e.g., methods for assessing and mitigating risk). 
  • K0003: Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy. 
  • K0004: Knowledge of cybersecurity and privacy principles. 
  • K0005: Knowledge of cyber threats and vulnerabilities. 
  • K0006: Knowledge of specific operational impacts of cybersecurity lapses. 
  • K0007: Knowledge of authentication, authorization, and access control methods. 
  • K0059: Knowledge of new and emerging information technology (IT) and cybersecurity technologies. 
  • K0115: Knowledge that technology that can be exploited. 
  • K0124: Knowledge of multiple cognitive domains and tools and methods applicable for learning in each domain. 
  • K0130: Knowledge of virtualization technologies and virtual machine development and maintenance.
  • K0146: Knowledge of the organization's core business/mission processes.
  • K0147: Knowledge of emerging security issues, risks, and vulnerabilities.
  • K0204: Knowledge of learning assessment techniques (rubrics, evaluation plans, tests, quizzes). 
  • K0208: Knowledge of computer based training and e-learning services.
  • K0213: Knowledge of instructional design and evaluation models (e.g., ADDIE, Smith/Ragan model, Gagne’s Events of Instruction, Kirkpatrick’s model of evaluation).
  • K0215: Knowledge of organizational training policies.
  • K0216: Knowledge of learning levels (i.e., Bloom’s Taxonomy of learning).
  • K0217: Knowledge of Learning Management Systems and their use in managing learning.
  • K0218: Knowledge of learning styles (e.g., assimilator, auditory, kinesthetic).
  • K0220: Knowledge of modes of learning (e.g., rote learning, observation).
  • K0226: Knowledge of organizational training systems.
  • K0239: Knowledge of media production, communication, and dissemination techniques and methods, including alternative ways to inform via written, oral, and visual media.
  • K0245: Knowledge of principles and processes for conducting training and education needs assessment.
  • K0246: Knowledge of relevant concepts, procedures, software, equipment, and technology applications.
  • K0250: Knowledge of Test & Evaluation processes for learners. 
  • K0252: Knowledge of training and education principles and methods for curriculum design, teaching and instruction for individuals and groups, and the measurement of training and education effects.
  • K0287: Knowledge of an organization's information classification program and procedures for information compromise. 
  • K0313: Knowledge of external organizations and academic institutions with cyber focus (e.g., cyber curriculum/training and Research & Development).
  • K0319: Knowledge of technical delivery capabilities and their limitations.
  • K0628 : Knowledge of cyber competitions as a way of developing skills by providing hands-on experience in simulated, real-world situations. 
  • Skills

  • S0001: Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
  • S0004: Skill in analyzing network traffic capacity and performance characteristics.
  • S0006: Skill in applying confidentiality, integrity, and availability principles.
  • S0051: Skill in the use of penetration testing tools and techniques.
  • S0052: Skill in the use of social engineering techniques. (e.g., phishing, baiting, tailgating, etc.). 
  • S0053: Skill in tuning sensors.
  • S0055: Skill in using knowledge management technologies.
  • S0056: Skill in using network management tools to analyze network traffic patterns (e.g., simple network management protocol).
  • S0057: Skill in using protocol analyzers.
  • S0060: Skill in writing code in a currently supported programming language (e.g., Java, C++).
  • S0064: Skill in developing and executing technical training programs and curricula.
  • S0070: Skill in talking to others to convey information effectively.
  • S0073: Skill in using virtual machines. (e.g., Microsoft Hyper-V, VMWare vSphere, Citrix XenDesktop/Server, Amazon Elastic Compute Cloud, etc.). 
  • S0075: Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).
  • S0076: Skill in configuring and utilizing software-based computer protection tools (e.g., software firewalls, antivirus software, anti-spyware).
  • S0081: Skill in using network analysis tools to identify vulnerabilities. (e.g., fuzzing, nmap, etc.). 
  • S0084: Skill in configuring and utilizing network protection components (e.g., Firewalls, VPNs, network intrusion detection systems).
  • S0097: Skill in applying security controls.
  • S0100: Skill in utilizing or developing learning activities (e.g., scenarios, instructional games, interactive exercises).
  • S0101: Skill in utilizing technologies (e.g., SmartBoards, websites, computers, projectors) for instructional purposes.
  • S0121: Skill in system, network, and OS hardening techniques. (e.g., remove unnecessary services, password policies, network segmentation, enable logging, least privilege, etc.). 
  • S0131: Skill in analyzing malware.
  • S0156: Skill in performing packet-level analysis.
  • S0184: Skill in analyzing traffic to identify network devices.
  • S0270: Skill in reverse engineering (e.g., hex editing, binary packaging utilities, debugging, and strings analysis) to identify function and ownership of remote tools.
  • S0271: Skill in reviewing and editing assessment products.
  • S0281: Skill in technical writing.
  • S0293: Skill in using tools, techniques, and procedures to remotely exploit and establish persistence on a target.
  • S0301: Skill in writing about facts and ideas in a clear, convincing, and organized manner.
  • S0356: Skill in communicating with all levels of management including Board members (e.g., interpersonal skills, approachability, effective listening skills, appropriate use of style and language for the audience).
  • S0358: Skill to remain aware of evolving technical infrastructures.
  • Tasks

  • T0030: Conduct interactive training exercises to create an effective learning environment.
  • T0073: Develop new or identify existing awareness and training materials that are appropriate for intended audiences.
  • T0101: Evaluate the effectiveness and comprehensiveness of existing training programs.
  • T0224: Review training documentation (e.g., Course Content Documents [CCD], lesson plans, student texts, examinations, Schedules of Instruction [SOI], and course descriptions).
  • T0230: Support the design and execution of exercise scenarios.
  • T0247: Write instructional materials (e.g., standard operating procedures, production manual) to provide detailed guidance to relevant portion of the workforce.
  • T0316: Develop or assist in the development of computer based training modules or classes.
  • T0317: Develop or assist in the development of course assignments.
  • T0318: Develop or assist in the development of course evaluations.
  • T0319: Develop or assist in the development of grading and proficiency standards.
  • T0320: Assist in the development of individual/collective development, training, and/or remediation plans.
  • T0321: Develop or assist in the development of learning objectives and goals.
  • T0322: Develop or assist in the development of on-the-job training materials or programs.
  • T0323: Develop or assist in the development of written tests for measuring and assessing learner proficiency.
  • T0352: Conduct learning needs assessments and identify requirements.
  • T0365: Develop or assist in the development of training policies and protocols for cyber training.
  • T0367: Develop the goals and objectives for cyber curriculum.
  • T0381: Present technical information to technical and nontechnical audiences.
  • T0382: Present data in creative formats.
  • T0395: Write and publish after action reviews.
  • T0443: Deliver training courses tailored to the audience and physical/virtual environments.
  • T0444: Apply concepts, procedures, software, equipment, and/or technology applications to students.
  • T0450: Design training curriculum and course content based on requirements.
  • T0451: Participate in development of training curriculum and course content.
  • T0467: Ensure that training meets the goals and objectives for cybersecurity training, education, or awareness.
  • T0519: Plan and coordinate the delivery of classroom techniques and formats (e.g., lectures, demonstrations, interactive exercises, multimedia presentations) for the most effective learning environment.
  • T0520: Plan non-classroom educational techniques and formats (e.g., video courses, mentoring, web-based courses).
  • T0535: Recommend revisions to curriculum and course content based on feedback from previous training sessions.
  • T0536: Serve as an internal consultant and advisor in own area of expertise (e.g., technical, copyright, print media, electronic media).
  • T0926: Develop or assist with the development of privacy training materials and other communications to increase employee understanding of company privacy policies, data handling practices and procedures and legal obligations
  • Capability Indicators

    EntryIntermediateAdvanced
    Credentials/Certifications

    Entry

    • Recommended: Yes
    • Example Types: N/A
    • Example Topics: Certifications addressing network infrastructure, mobile device integration, hardware evaluation, operating systems, technical support, system security, network infrastructure, access control, cryptography, assessments and audits, organizational security, analyzing course materials and learner information, assuring preparation of the instruction site, establishing and maintaining instructor credibility, managing the learning environment, demonstrating effective communication skills, demonstrating effective presentation skills, demonstrating effective questioning skills and techniques, responding appropriately to learner's needs for clarification and feedback, providing positive reinforcement and motivational incentives, using instructional methods appropriately, using media effectively, evaluating learner performance, evaluating delivery of instruction, reporting evaluation information

    Intermediate

    • Recommended: Yes
    • Example Types: N/A
    • Example Topics: Certifications addressing evaluative concepts, instructional design, training delivery, performance improvement, evaluating learning impact, managing learning programs, coaching, integrated talent management, change management, knowledge management, learning technologies, wireless networks, incident handing, security and risk management, asset security, security engineering, communications and network security, identity and access management, security assessment and testing, security operations, software development security, enterprise security, risk management and incident response, research and analysis, integration of computing, communications and business disciplines as well as technical integration of enterprise components, reducing production costs, application vulnerabilities and delivery delays, as well as secure software concepts, requirements, design, implementation/coding, testing, software acceptance, software deployment, operations, maintenance, disposal supply chain, and software acquisition, change management and incident handling for managers, common attacks and malware, managing access control, managing defense in depth and security policy, managing disaster recovery and contingency planning, managing employees and total cost of ownership, managing operational security, managing physical/facility security, managing privacy and web security, managing risk and ethics, managing security awareness and protecting intellectual property, managing the network infrastructure, managing quality and growth of the security organization, managing the use of cryptography, managing vulnerabilities, managing wireless security, network and endpoint security technologies, network protocols for managers, project management and business situational awareness, selling and managing the mission, analyzing course materials and learner information, assuring preparation of the instruction site, establishing and maintaining instructor credibility, managing the learning environment, demonstrating effective communication skills, demonstrating effective presentation skills, demonstrating effective questioning skills and techniques, responding appropriately to learners' needs for clarification and feedback, providing positive reinforcement and motivational incentives, using instructional methods appropriately, using media effectively, evaluating learner performance, evaluating delivery of instruction, reporting evaluation information

    Advanced

    • Recommended: Yes
    • Example Topics: Certifications addressing security and risk management, asset security, security engineering, communications and network security, identity and access management, security assessment and testing, security operations, software development security
    Continuous Learning

    Entry

    • Recommended: Yes
    • Examples: 40 hours annually (may include learning and development conferences, experience with gamification and cutting-edge techniques, making a business case, cybersecurity conferences, emerging technology exposure, receiving mentoring, ongoing collaboration in a team context, professional memberships)

    Intermediate

    • Recommended: Yes
    • Examples: 40 hours annually (may include conferences, rotational team assignments involving technology, job shadowing, being shadowed by junior staff)

    Advanced

    • Recommended: Yes
    • Examples: 40 hours annually (may include assessments)
    Education

    Entry

    • Recommended: Yes
    • Example Types: Associate's
    • Example Topics: Communications, IT, cybersecurity, education, journalism, engineering, computer science

    Intermediate

    • Recommended: Yes
    • Example Types: Bachelor's
    • Example Topics: N/A

    Advanced

    • Recommended: Yes
    • Example Types: Master's, Ph.D.
    • Example Topics: N/A
    Experiential Learning

    Entry

    • Recommended: Yes
    • Examples: Experience teaching and speaking in front of a group at any level; toastmasters, internship, mentoring, job shadowing

    Intermediate

    • Recommended: Yes
    • Examples: Technical hands-on experience, can be a technical SME with training experience; mentoring

    Advanced

    • Recommended: Yes
    • Examples: Technical experience, teaching, mentoring, job shadowing, being shadowed, speaking at conferences, thought leadership
    Training

    Entry

    • Recommended: Yes
    • Example Types: N/A
    • Example Topics: Adult learning styles, tactical learning styles, communications, presentation skills, conflict management, vendor training (e.g., a virtual learning environment and course management system), in-person training, distance training, online, blended, instruction

    Intermediate

    • Recommended: Yes
    • Example Types: N/A
    • Example Topics: Evaluation, adult learning styles, tactical learning styles, communications training, presentation skills, soft skills training, conflict management, vender training (e.g., a virtual learning environment and course management system), learning evaluation, instruction

    Advanced

    • Recommended: Yes
    • Example Types: N/A
    • Example Topics: Learning evaluation, assessment, statics, train-the-trainer, instruction