Harnessing the Right Talent for SETA Programs: Cybersecurity Roles and Competencies that Make a Difference

Security Education, Training, and Awareness (SETA) is considered among the prominent strategies to develop a cybersecurity culture. Even though many SETA programs have been developed, their effectiveness is questionable as evident by the ongoing struggle of organizations to create a sustainable cybersecurity culture. A key factor that often challenges the design of effective SETA programs is the lack of expertise to create engaging and tailored initiatives to influence employees changing their unsafe behavior and adopting best practices. To address this challenge, organizations can leverage the expertise from multiple cybersecurity career roles, formulating a strong SETA development team that can exhibit a diverse range of perspectives and skills which are essential to design impactful SETA programs. Enabling such a collective design and development approach might be a solution to the pursuit of achieving a sustainable cybersecurity culture. This research work identifies: 1) the core knowledge areas and transferable skills that professionals responsible to design effective SETA programs should demonstrate, 2) which career roles in the ENISA European Cybersecurity Skills Framework cover relevant knowledge areas and transferable skills, 3) the prominent career roles for demonstrating knowledge and skills across multiple essential areas for SETA program development, and 4) the significance of lifelong learning in cybersecurity for developing sustainable SETA programs.