Defend the future: find your place in cyber
Cybersecurity is not one job. It is hundreds of ways to protect people, and many of them do not need a computer science degree. The hard part for a newcomer is knowing which door to knock on. The U.S. has a shared map for that: the NICE Framework, a common language for cyber work. This page is the D: Defend the future step of SHIELD 2040. You will learn how the map works, use free career tools to explore it, and match popular roles to free training on this site and to free credentials. Wherever the facts about a program are uncertain, we say so.
What you'll be able to do
Read the NICE Framework
Explain work role categories, work roles, competency areas and TKS statements, and why a work role is not the same thing as a job title.
Explore real jobs
Use CyberSeek and the CISA Cyber Career Pathways Tool to see which roles exist, what they pay on average and what skills employers ask for.
Pick a first target role
Choose one or two work roles to aim at, with a short list of competency areas to build.
Plan free training
Map each role to free courses on our SHIELD 2040 pages and to credentials you can earn for $0.
Find programs that pay or fund you
Understand CyberCorps Scholarship for Service, NCAE-C schools, registered apprenticeships and K-12 resources.
Talk about careers with confidence
Describe a role, the skills behind it and your next step in plain words, in an interview or a conversation with a coach.
The NICE Framework explained
NIST SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework) was published in November 2020. It sets out the structure, and NIST maintains the current content separately as "NICE Framework Components" so it can be updated without rewriting the publication. When we checked in October 2026, NICCS and the NIST Resource Center both listed Components version 2.2.0 as current. (NIST's page date line looked ambiguous, so always confirm on the Current Versions page.) The Framework has four building blocks:
Work Role Categories
Five broad groups of cyber work: Oversight and Governance (OG), Design and Development (DD), Implementation and Operation (IO), Protection and Defense (PD) and Investigation (IN).
Work Roles
Groupings of work someone is responsible for, such as Incident Response or Cybersecurity Policy and Planning. NICE is clear that work roles are not job titles; one job may combine several, and one role may appear under many titles.
Competency Areas
Clusters of related knowledge and skills for a topic. Version 2.2.0 lists 11: Access Controls, Artificial Intelligence (AI) Security, Asset Management, Cloud Security, Communications Security, Cryptography, Cyber Resiliency, DevSecOps, Operating Systems (OS) Security, Operational Technology (OT) Security and Supply Chain Security.
TKS statements
The smallest pieces: Task statements (what is done), Knowledge statements (what you must know) and Skill statements (what you must be able to do). Everything else is built from them.
Browse them yourself: work role categories, work role search, competency areas and TKS search on NICCS. The Components are also free to download as a spreadsheet or JSON from the NICE Framework Resource Center. A companion report, NISTIR 8355, explains how competency areas were developed.
Free tools to explore careers
NICE Framework Resource Center
NIST's home for the Framework: current versions, downloads, news and guidance for employers, educators and learners. Start here to see the official documents. Cost: Free
Open the Resource Center
CyberSeek: career pathway and jobs heat map
CyberSeek's Career Pathway tool shows, for each role, a description, common job titles, requested education level, job openings over 12 months, top certifications and skills, and average advertised salary. Its Heat Map shows where cybersecurity jobs are concentrated across the U.S. We could read the pathway page; the heat map page loads but we did not review its contents in detail. Cost: Free
Career Pathway Jobs Heat Map
CISA Cyber Career Pathways Tool
An interactive tool from CISA that shows how work roles connect, with the skills and tasks behind each, built on the NICE Framework. It is part of NICCS (National Initiative for Cybersecurity Careers and Studies). Cost: Free
Open the tool
NICCS workforce tools
NICCS also offers a Career Pathways Roadmap, a Cybersecurity Career Map, a NICE Framework Mapping Tool (match your own job description or course to the Framework), an Education and Training Catalog, and pages for beginners, students, veterans and K-12 teachers. Cost: Free
Career Pathways Roadmap Mapping Tool For beginners
Eight roles, mapped to free training
The role names below are real NICE work roles from the current Framework (v2.2.0). The competency areas and training are our suggestions for a first learning plan, not an official NICE mapping: open each role in the Work Role Search to see its official tasks, knowledge and skills. "Free credential" means one you can earn for $0 today.
| NICE work role | Competency areas to build (our suggestion) | Free training on this site | Free credential |
|---|
| Defensive Cybersecurity (PD) | Access Controls, Asset Management, Operating Systems Security | Foundations, Hands-On Defense | IBM SkillsBuild Cybersecurity Fundamentals badge (free) |
| Incident Response (PD) | Cyber Resiliency, Communications Security, Asset Management | Hands-On Defense, NIST frameworks (CSF Respond and Recover) | IBM badge above; CISA Learning courses (certificate not confirmed) |
| Vulnerability Analysis (PD) | Operating Systems Security, DevSecOps, Supply Chain Security | Hands-On Defense, Cyber 2040 (supply chain) | Linux Foundation LFD121 digital badge (free) |
| Cybersecurity Architecture (DD) | Access Controls, Cloud Security, Cryptography | Zero Trust, NIST frameworks, Cyber 2040 (post-quantum, cloud) | Microsoft Learn achievements for security concepts (free); SC-900 exam is paid |
| Cybersecurity Policy and Planning (OG) | Asset Management, Cyber Resiliency | NIST frameworks (CSF 2.0, RMF), Foundations | Advisera ISO 27001 Foundations course (free; its exam is $349) |
| Privacy Compliance (OG) | Access Controls, Asset Management | NIST frameworks (Privacy Framework) | No free credential confirmed; read the NIST Privacy Framework |
| Operational Technology (OT) Cybersecurity Engineering (DD) | Operational Technology (OT) Security, Cyber Resiliency | Cyber 2040 (OT and ICS) | CISA ICS Virtual Learning Portal (free; certificate not confirmed) |
| AI and data security (competency area; NICE v2.2.0 has no AI-only work role) | Artificial Intelligence (AI) Security, Cryptography, Supply Chain Security | Cyber 2040 (AI security), Zero Trust | Microsoft Learn AI security fundamentals achievements (free) |
Credential 1 · IBM SkillsBuild Cybersecurity Fundamentals badge
Provider: IBM SkillsBuild. You earn: the Cybersecurity Fundamentals digital badge (Credly). Complete the IBM course and score 80% or higher on its end-of-course assessment; register on SkillsBuild first (adult learners, or high school students and educators). Cost: Free badge · About 8 hours (estimate) · Level: Beginner
See the badge requirements Browse IBM cybersecurity courses
Credential 2 · Microsoft Learn: AI security fundamentals
Provider: Microsoft Learn. You earn: a module achievement for each of three modules on your Microsoft Learn profile. Cost: Free course · About 3 hours (estimate) · Level: Beginner
Open the learning path
Credential 3 · Linux Foundation LFD121, Developing Secure Software
Provider: The Linux Foundation with OpenSSF. You earn: a digital badge; the course includes labs, quizzes and a final exam, and the page lists no exam fee. Some programming experience helps. Cost: Free course · About 16-20 hours · Level: Beginner
Open LFD121
Credential 4 · CISA ICS Virtual Learning Portal
Provider: CISA and Idaho National Laboratory. You earn: knowledge from 13 on-demand video courses; certificate not confirmed. Cost: Free course (the page states there are no tuition costs) · About 18 hours · Level: Beginner to Intermediate
See the course list
Credential 5 · CISA Learning (successor to FedVTE)
Provider: CISA. You earn: training mapped to the NICE Framework (CISA describes about 850 hours) in areas such as cloud security, ethical hacking, risk management and malware analysis, plus certification-prep courses. Open to the public with a Login.gov account. Certificate details not confirmed. Cost: Free course · Hours vary · Level: Beginner to Advanced. Page: NICCS: CISA Learning.
About CISA Learning
Credential 6 · ISO 27001 Foundations (Advisera)
Provider: Advisera (a private company, not a government site). You earn: free course access; the Advisera certificate requires passing a paid exam ($349 on the page). Cost: Free course · About 8 hours · Level: Beginner
Open the course
A note about the ISC2 "Certified in Cybersecurity" free offer
ISC2's One Million Certified in Cybersecurity program closed to new participants on May 20, 2026, according to ISC2's own page. Only people who already held an unexpired exam code can still sit the free exam, by December 31, 2026. Everyone else pays the standard exam fee (US $199) plus an annual maintenance fee. We therefore do not include it in our $0 path.
Read ISC2's notice
Programs, apprenticeships and funding
These are not courses. They are routes that can fund your learning or pay you while you learn. Eligibility and deadlines change, so confirm details on each official page.
CyberCorps: Scholarship for Service (SFS)
A National Science Foundation program, managed with OPM and CISA. It funds cybersecurity-related study (NICCS says fields include AI, quantum computing and aerospace) at participating colleges that are NCAE-C schools. Per NICCS: tuition and fees for up to three years, a yearly stipend ($27,000 undergraduate, $37,000 graduate) and a $6,000 professional allowance. In return you work for the government in a cyber role for a period equal to your scholarship. Cost: Funded scholarship, with a service obligation · Level: college undergraduate or graduate
Visit SFS NICCS scholarships page
NSA NCAE-C: National Centers of Academic Excellence in Cybersecurity
A designation for colleges and universities with strong cybersecurity programs. The NCAE-C community site offers an Institution Map to find designated schools near you, a Career Explorer, and a students page. Using the map and tools is free; tuition at a school is not, though SFS (above) is tied to these schools. Check each school for two-year options. The community site lists four communities of practice: Cyber Defense, Cyber Operations, Cyber Research and Artificial Intelligence. Cost: Free tools; school costs vary
NCAE-C community Institution Map
NICE K12: cybersecurity for younger learners
NIST's NICE program supports the NICE K12 Cybersecurity Education Conference (hosted by iKeepSafe); NIST currently lists the 12th annual event for March 7-9, 2027 in New Orleans, moved from December 2026. NICCS has a page for K-12 teachers and a competitions and games page. Learners can also try picoCTF (free) from our Hands-On page. Cost: Free resources; conference fees not verified · Level: ages 11-18 and teachers
NICE K12 conference NICCS for K-12 teachers
Community college pathways
Two-year colleges are a low-cost route into cyber. Use the NCAE-C Institution Map above to find designated schools, CyberSeek to see which credentials employers in your area ask for, and Apprenticeship.gov to see if a college partners with an employer. Ask each school about its cybersecurity certificate or associate degree, financial aid and transfer agreements. We did not verify any single college program, so treat this as a search method, not an endorsement. Cost: College costs vary; financial aid may apply
Find a school CyberSeek heat map
From our earlier .gov list, re-verified
We carried over the items from our earlier curated list of free government cybersecurity training that still hold up in October 2026. Anything we could not confirm was dropped.
CISA Cybersecurity Training & Awareness
CISA's training hub: free courses, the ICS portal, incident response training and links to CISA Learning. Still current. Cost: Free
Open CISA training
ISO/IEC 27001 Foundations (Advisera)
Still available as a free course (paid exam). See Credential 6 above.
Open the course
Dropped after checking: the DoD Cyber Awareness Challenge (its public page now redirects to a DoD login, so we cannot confirm open public access); the FedRAMP training page (the old address no longer works; see fedramp.gov for current material); the CIO Council Zero Trust Data Security Guide (we could not load the old link; see our Zero Trust page); the PCI Work From Home course (it is now $40 per person); and several commercial listings (HITRUST, CCPA training, IAPP, a SOC analyst course, CyberTraining4U, an EPALE data-protection course) that we could not confirm as free, official or current.
For Curiosity Coaches
Discussion prompts
- "Which of the five NICE categories sounds most like something you already enjoy: protecting, building, investigating, running things or setting rules?"
- "Pick a work role. What would a normal day look like? What would make it hard?"
- "What is the difference between a work role and a job title? Why might that help you?"
- "If you could earn only one free badge this month, which would help you most, and why?"
A 4-week plan (one 45-minute session per week)
Week 1: explore the five categories with the NICCS Career Pathways Roadmap and pick three roles that look interesting. Week 2: use CyberSeek's Career Pathway on those three roles and compare skills, salary and openings. Week 3: start one free credential (IBM Cybersecurity Fundamentals for most learners) and pick one hands-on lab from our Hands-On page. Week 4: the learner writes a one-page plan: target role, three competency areas, two free courses, one program to look into, and one question for a professional.
Age and level fit
Ages 11-14: NICCS pages for K-12, picoCTF, role-matching games; no accounts beyond what a parent approves. Ages 15-18: CyberSeek, IBM SkillsBuild, NCAE-C map, SFS awareness. Career-changers: work role search, CISA Learning, apprenticeships and the mapping tool to translate past experience. Please keep personal data off third-party sites unless the learner (and a guardian, for minors) agrees.
Free resource library
Related on this site: Cyber 2040: Post-Quantum, AI Security & What's Next, Security Foundations, Hands-On Defense, NIST Frameworks and Zero Trust.