# Planning for Professional Development in Cybersecurity:
A New Curriculum Design

Eliana Stavrou

► To cite this version:

Eliana Stavrou. Planning for Professional Development in Cybersecurity: A New Curriculum Design. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.91-104, 10.1007/978-3-031-38530-8_8 . hal-05462080

HAL Id: hal-05462080

https://inria.hal.science/hal-05462080v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Planning for Professional Development
in Cybersecurity: A New Curriculum Design

Eliana Stavrou(✉) ID

Open University of Cyprus, Nicosia, Cyprus

eliana.stavrou@ouc.ac.cy

**Abstract.** The cybersecurity landscape is constantly rising while cybersecurity professionals are expected to keep up with the cyber threat dynamics. To be able to do so, professionals need to demonstrate a lifelong learning attitude to upskill and/or re-skill based on the needs of the role they pursue or hold. Cultivating a lifelong learning mentality should be a priority in formal learning, achieved through learning activities that are mapped to industry needs. Such activities should target to guide learners to identify their skills and knowledge, and to recognize their gap in competencies, considering career roles of interest. This can lead to focused learning and effective professional development. This research work contributes a new curriculum towards this direction, considering post-graduate level studies.

**Keywords:** Cybersecurity skills · Cybersecurity professional development · Cybersecurity curriculum

## 1 Introduction

The skills shortage in cybersecurity [1, 2] is a problem that has long been troubling academia and industry. Due to the dynamic nature of the cyber threat landscape and advances of technology that give rise to new attack surfaces, there is a great demand for cybersecurity expertise. Studies indicate that 3.5 million jobs are unfulfilled, highlighting the urgency to take actions to address the skills shortage and empower organizations to build strong cybersecurity teams. Such teams are expected to demonstrate a high degree of expertise to be able to defend against a range of cyber threats. To achieve this, professionals should pursue lifelong learning so they can continuously upskill and/or re-skill to address a dynamic cybersecurity environment and meet the needs of their job role.

Professional development through lifelong learning can be pursued through formal and/or informal learning [3], including among others, studying towards an academic degree and/or professional certification in cybersecurity, mentoring, communities of practice, attending conferences, trainings, etc. This can be an overwhelming process for both early-career and experienced professionals as it requires good planning and a high-degree of personal reflection. Cybersecurity is a competitive domain, with the industry
posing high standards for employability in cybersecurity roles. Usually, job advertise-
ments include a combination of academic qualifications, professional certificates, and
demonstration of hard and soft skills.

Professionals should have a clear view of what aspects they need to develop as part of their career progression, and how they can achieve their professional development goals. Such a high degree of realization and forward-thinking can assist people in being effective in their planning and execution of their plan. Moreover, their overall learning experience can be enhanced when they have clear targets from the beginning, they can recognize where to focus their learning to build specific competencies and understand how their development can contribute to their career goals. Forward-thinking is an essential skill in professional development, but at the same time, professionals need to reflect on their current state of competencies/learning to inform their professional development plan and formulate their future development actions.

In terms of building competencies and planning for professional development, one must be aware of different employability aspects, such as qualifications required, competencies versus job roles, opportunities for learning, etc. Although there is a vast number of resources for cybersecurity professional development, these are not always visible to people, and even if they are visible, people might become overwhelmed when there it is not a clear direction how to benefit from the different learning opportunities that exist. This is a great challenge to address as it might hinder people's efforts from effectively planning their career progression as it is not easy for someone that enters the field or wishes to switch careers to identify how to build the necessary competencies to become competitive in the market. Also, it might be difficult for someone already working in cybersecurity to identify what is needed to move to another job role and identify gaps in his/her competencies that should be developed.

One direction to take to address this challenge is to bring different aspects of pro-
fessional practice into academic cybersecurity curricula. This direction can be driven
by existing cybersecurity competency-based frameworks in combination to other learn-
ing opportunities to empower people' efforts to upskill in cybersecurity. Investigations
should be performed to create activities in formal education programs to mentor peo-
ple to identify roles of interest, their current competencies, gaps they need to address,
and identify opportunities for professional development in cybersecurity. Such activities
should also aim to increase visibility of resources and point people in the right direction
to be able to search and identify information of interest

This paper contributes a new curriculum developed in the context of master-level
distance learning cybersecurity studies, aiming to guide learners towards different pro-
fessional aspects in cybersecurity and support them in pursuing different employabil-
ity opportunities. Section 2 briefly analyses the methodology applied for this research
work. Section 3 reviews the literature. Section 4 presents the proposed professional
development curriculum and Sect. 5 discusses its evaluation. Finally, Sect. 6 constitutes
conclusions.
## 2 Methodology

This research work seeks to investigate the design of a new curriculum to build appropriate competencies and enable professional development planning in cybersecurity. Investigations stemming from the background work resulted in the design of a new cybersecurity curriculum delivered in the context of postgraduate synchronous distance learning studies. A range of activities were delivered in the context of the proposed curriculum aiming to increase career awareness aspects and cultivate lifelong learning mindsets through professional development planning activities. The curriculum was delivered to 38 learners pursuing a master level distance learning degree in cybersecurity. After the curriculum was delivered, the learners were invited to answer a questionnaire anonymously, evaluating their experience and the curriculum's usefulness and appropriateness to assist them in obtaining a better view of career options and planning for professional growth. Valuable observations have been made, alongside the constructive feedback provided by the learners, which will drive the curriculum's enhancement for future deliveries.

## 3 Related Work

As indicated in ISC² 2022 Cybersecurity Workforce study [1] and The State of Cybersecurity 2022 report by ISACA [2], the cybersecurity field is still critically in need of more professionals to fill the gap of 3.4 million cybersecurity workers. While today's cyber threat landscape constantly evolves, professionals need to pursue their continuous growth to meet the demands of a volatile cyber threat landscape. This requires professionals to develop a lifelong learning mindset to upskill and to be able to follow the technological advances and the dynamics of the cyber threat landscape, meeting industry demands for qualified cybersecurity professionals. The need to accelerate staff skill development is indicated in [4]. The study reports that 39% of responders highlighted that a cybersecurity professional needs 3–5 years to become proficient. This is a long time and upskilling should be accelerated.

The last few years there is a shift to cybersecurity competencies development activities. This encompasses a focused approach to learning, with an emphasis on developing specific skills and knowledge to meet the requirements of specific work roles. The recent European Cybersecurity Skills Framework (ECSF) [5] which is published by ENISA, is profiling key cybersecurity roles in the context of the management cycle (plan – implement – operate – improve). The US National Institute of Standards and Technology (NIST) published the National Initiative for Cybersecurity Education (NICE) framework [6]. The NICE Framework has been developed to serve as a reference taxonomy of the cybersecurity work that is carried out in specific cybersecurity roles, and describes the tasks, knowledge, and skills that are needed. Through ECSF and NICE taxonomy, learners can explore different occupational profiles and engage in learning activities to develop their knowledge and skills.

Fisk et al. [7], emphasized the importance of making connections between formal education and the cybersecurity communities of practice so that graduates can be integrated seamlessly into the workforce. One way to establish this connection is by aligning
the curricula with industry best practices and addressing industry needs. The work in [8], highlights the challenge of identifying the cybersecurity qualifications or certifications that can assist in the development of a specific set of skills. It is also highlighted that someone might pursue the wrong certification if the learner did not match it to what he/she needs. This challenge can be alleviated if educational curricula provide guidance to learners to identify roles of interest, their current skills, skills they lack, and identify an appropriate certification to pursue. Mentoring is another approach to high impact practice for strengthening cybersecurity education and advancement [9, 10]. CyberAlumni [11] pursued a collaborative model for professional development, demonstrating the development of strong digital communities, wider and more productive collaborations, and the promotion of continuing education that maps directly to careers. Such principles (creating community, collaboration, and continuing education that are clearly tied to career development) should be integrated into formal education to bridge the gap between curriculum and job placement. The work in [12] also recognized the value of using collaborative learning approaches, highlighted the lack of practice-oriented teaching resources and reported that finding suggests that soft-skills, although necessary, seem that are not getting the appropriate level of attention in formal education. Authors in [13] performed investigations and validated that by using an out-of-class learning approach, learners can realize their career goals and stimulate their intellectual growth. The work in [14] highlights the importance of demonstrating research skills in the workplace, empowering employees to gather data in a systematic manner to fill knowledge gaps in their organization and enable them to grow. It is also worth mentioning that interventions for professional development in cybersecurity should be developed across disciplines as cybersecurity is a multidisciplinary domain [15]. Therefore, it is essential to equip learners across disciplines with the appropriate skills that will assist them to pursue employment opportunities in the cybersecurity domain.

# 4 Curriculum Design

## 4.1 Audience and Scope

The proposed cybersecurity curriculum is developed in the context of post-graduate synchronous distance learning studies that usually include diverse audiences. Specifically, cybersecurity post graduate programs include people with diverse background in terms of knowledge and experience, from newly graduates to professionals already working in the industry [16]. This is taken into consideration to design professional development activities that will benefit all learners. Specifically, the focus will be to build competencies for learners to locate and critically evaluate resources relevant to their professional development and to formulate an actionable plan to progress with their career.

## 4.2 Learning Objectives

Professional development in cybersecurity encompasses a range of aspects that are not often evident to people that seek to build or advance their career. New curricula should build appropriate skills and knowledge around the topic of professional development,
motivating people to drive their learning actions purposefully and be able to grow continuously. To this end, the proposed curriculum (Table 1) follows guidelines provided in [17, 18] to formulate its learning objectives and focuses on answering why-what-how questions in the context of developing a professional development plan.

<table><caption>**Table 1.** Learning Objectives</caption><thead><tr><td>ID</td><td>Learning Objective</td></tr></thead><tbody><tr><td>LO1</td><td>Understand the importance of forward-thinking planning in cybersecurity professional development</td></tr><tr><td>LO2</td><td>Understand industry needs and qualifications needed in the cybersecurity job market</td></tr><tr><td>LO3</td><td>Locate and use appropriate resources to stay-up to date throughout a professional's career</td></tr><tr><td>LO4</td><td>Analyse a cybersecurity competency framework and extract information relevant to learners' interests and career inspirations</td></tr><tr><td>LO5</td><td>Investigate and link job roles with professional certifications, considering specific geographic locations</td></tr><tr><td>LO6</td><td>Perform a SWOT analysis to understand current state of competencies and apply forward-thinking to plan for professional development</td></tr><tr><td>LO7</td><td>Create an actionable professional development plan, structuring appropriately personal goals</td></tr><tr><td>LO8</td><td>Create a CPD log to maintain evidence about professional development</td></tr></tbody></table>

Initially, the curriculum clearly articulates why learners need to plan for their professional development in a consistent manner to enable their professional growth. Then it focuses on answering 2 key questions: “what skills and knowledge do we need to develop for specific job roles of interest?”, “what resources can be utilized for our professional development in cybersecurity?”. Lastly, the curriculum focuses on guiding learners how to create an actionable professional development plan. Overall, the why-what-how approach can assist the learners to obtain a clear view of their career options, set their career goals and specify how to achieve them.

## 4.3 Learning Content and Pedagogy

The proposed curriculum specifies four thematic areas to promote the learning objectives specified in the previous section. Table 2 lists the relevant Learning Content (LC) and pedagogies utilized to deliver it, covering: 1) Cybersecurity career pathways and competencies (LC1,2,3) to increase awareness on career options, inspire learners to identify areas of interest and take note of required skills and knowledge, 2) Opportunities to develop skills and knowledge (LC4) so that learners obtain a clear view of what opportunities to pursue for their professional development and start taking benefit of those identified, 3) Professional certifications – key aspects and exam preparation (LC5,6) to identify certifications relevant to roles of interest, realize certification requirements and
how to achieve them, and 4) Cybersecurity competencies evaluation and professional development planning (LC7,8) to critically reflect on the current skills and knowledge and plan how to evolve professionally.

<table><caption>**Table 2.** Learning Content of Proposed Curriculum</caption><thead><tr><td></td><td>Learning Content (LC)</td><td>Pedagogy</td></tr></thead><tbody><tr><td>1</td><td>Cybersecurity job roles, entry vs advance-level roles</td><td>L/AV/RD/RS/CA</td></tr><tr><td>2</td><td>Cybersecurity competency-based frameworks & career paths</td><td>L/D/AV/RD/RS/CA</td></tr><tr><td>3</td><td>Hard vs soft skills in cybersecurity</td><td>L/RD/RS/CA</td></tr><tr><td>4</td><td>Opportunities to develop skills and knowledge</td><td>L/RS/FD</td></tr><tr><td>5</td><td>Professional certification programs in cybersecurity - overview</td><td>AV/RS/RS/CA/PA</td></tr><tr><td>6</td><td>Preparing for cybersecurity certification</td><td>L/RS</td></tr><tr><td>7</td><td>Planning professional development</td><td>L/RD/RS/CA/PA</td></tr><tr><td>8</td><td>Continuous Professional Development (CPD) log</td><td>RD/RS/PA</td></tr></tbody></table>

L = Lecture, RD = Reading, RS = Research, CA = Critical Analysis, D = Demonstration, FD = Forum Discussion, AV = Audio-Visual, PA = Practical Activity

**Cybersecurity Career Pathways and Competencies.** The curriculum presents information related to key cybersecurity roles, discussing two main categories, one category focusing on business/managerial-oriented roles and the other concerning technology-oriented roles, identifying that there are entry level and advanced level roles. Learners had the opportunity to get familiarized with the purpose of cybersecurity competency frameworks, such as ECSF, NICE, UK Cyber Career framework, etc. The curriculum presented the main components of the frameworks, how they profile the different cybersecurity career pathways and the aspects they cover, e.g., key responsibilities, skills, knowledge, etc. Although all cybersecurity competency frameworks present valuable information, emphasis was given to the ECSF that is the most recent and focuses on providing key information about the listed roles, without overwhelming people with too many details. Some of the other frameworks, e.g., NICE, provide elaborated categories and might not be easy for someone to identify roles of interest. Once learners are comfortable with ECSF framework and understand how to apply it, it can be easy to move on to other frameworks that include further information. ECSF categorizes role profiles in the context of the management cycle (plan – implement – operate – improve), assisting learners to easily identify areas of interest. The curriculum presented how to apply ECSF as an individual professional to identify potential gaps in competencies versus specific roles of interest. Emphasis was given for learners to realize the importance of building soft skills in cybersecurity and which soft skills are considered important by the industry.

**Opportunities to Develop Skills and Knowledge.** Having a clear view of the cybersecurity roles and required competencies is a key aspect in professional development. The other aspect that needs to be taken into consideration is to identify opportunities to
develop skills and knowledge. Developing such knowledge is valuable as one can identify the bigger picture in terms of learning opportunities and pursue the ones of interest to achieve his/her professional development goals. Such learning opportunities may require small to significant effort, and this was discussed accordingly so it was evident to all that appropriate planning is needed to maximize the benefit from the different learning opportunities that exist. The curriculum covered registration to newsletters, networking with professional communities, academic degrees, online material and practice sites, internships, competitions, games, and professional certifications.

**Professional Certifications – Key Aspects and Exam Preparation.** Industry is posing high standards in the cybersecurity domain in terms of employability. Usually, job advertisements include a blend of academic and professional qualifications. The latter, even though it might be considered as an advantage and not mandatory, it carries a significant weight when applicants hold relevant cybersecurity certifications. Given though the range of cybersecurity certifications that exist today, it has become a challenging task to decide which ones to pursue as part of professional development. The proposed curriculum includes key aspects of this topic so that learners realize which certification programs can help in the job market versus roles of interest. Examples of certification bodies, selection criteria to decide which certificate to pursue, and security certification roadmaps have been included as part of the proposed curriculum. Emphasis was given to the certification roadmaps, so that learners can identify what kind of resources are provided by the certification vendors to guide people in the selection of specific certificates. Key aspect to consider in advance is that there are certifications which might be prerequisite some years of experience before obtaining the certificate. Thus, one might pass the exam, but he/she will be placed on an associate level until the years of experience are reached. Also, there are cases where academic studies can replace some years of experience required to be demonstrated to obtain a certificate. Moreover, top security certifications have been discussed, highlighting the need for someone to understand top certifications that are relevant to the country of employment. Even though well-known certifications are common across different countries, there might be cases where some specific certificates might be required, e.g., due to specific regulations, focus on specific technologies, etc. Also, a distinction between neutral versus vendor specific certifications has been made.

Pursuing a professional certification often requires a lot of resources, e.g., in terms of study time, money, and effort to maintain the certificate once it is obtained. The proposed curriculum discussed a variety of means to prepare for the examination exams, such as self-study guides, MOOCs, formal training programs, mentors, study partners, etc. The aim was to familiarize learners with the means for preparing towards cybersecurity certifications so they know in advance their options, and can investigate further the ones they prefer as part of their professional development plan. They also had to realize that often is not enough to obtain a certificate, you also have to maintain it since there are certificates that have to be renewed. As part of their renewal process, the certificate holder has to demonstrate his/her continuous professional development (CPD). This task requires good planning to assist in logging relevant CPD activities that need to be reported at a later stage. This is a process that it is beneficial to start within the academic studies of learners, as they can report on activities performed and competencies developed. This
can benefit them when academic studies can replace some years of experience needed to obtain, or to maintain, a certificate.

**Cybersecurity Competencies Evaluation and Professional Development Planning.** The final thematic area covered by the proposed curriculum concerns competencies evaluation and professional development planning. Specifically, the curriculum familiarized the learners with SWOT analysis, guiding them to identify their strong aspects, their weaknesses, opportunities for growth and threats that might limit their professional development efforts. Once a clear view was obtained, learners proceeded to develop their professional development plan for the next year.

## 5 Evaluation

After the delivery of the curriculum, 38 learners completed a questionnaire to evaluate the delivered content, its usefulness to assist them in planning for their professional development, and their experience in general. Learners were asked to complete ten multiple choice questions and one open-ended question. Responses were submitted anonymously, and no sensitive information was requested.

Initially, it was deemed necessary by the author to ask about the working experience of the learners. Most of the learners (91%) reported that they are working professionals, with a mixture of participants in terms of work seniority (34% have reported over 10 years of experience, 8% reported 6–9 years, 50% reported 1–5 years and 8% had no experience). This aspect was going to be investigated further to understand responses provided by learners compared to their experience so far and in terms of professional development aspects covered by the proposed curriculum.

Regarding learners’ experience with creating a professional development plan, approximately 38% of responders indicated that they had not created a plan prior the delivered curriculum, while 46% mentioned that they created a plan as their own initiative. Moreover, 17% of the learners reported that they created a plan in the context of workplace, and approximately 13% during their master-level studies. This indicates the need for relevant activities to take place within the context of academic studies and in professional settings, to guide learners towards their professional development.

As discussed in Sect. 4, a range of activities were delivered in the context of the proposed curriculum aiming to increase awareness of career aspects and how to plan for professional growth. Learners were asked to select 4 activities that were most helpful in understanding industry needs and/or identifying resources/information to use to create their professional development plan.

As depicted in Fig. 1, the top activity that the learners found most useful in the context of creating their professional development plan was reviewing the ECSF and identifying a role of interest and relevant hard/soft skills and knowledge. This is a promising result as it confirms one of the key objectives of the ECSF, to be used by individuals to plan their growth. ECSF focuses on key information of each role, providing the baseline to learners to seek further information. Moreover, through the discussions learners identified the significance of professional certifications since they are a key qualification often required by the industry. Learners reported the activity of searching
for relevant job advertisements and identifying relevant cybersecurity certifications as the second most useful. This activity paired very well with the review of the ECSF as learners were able to map certifications to roles of interest. Moreover, they were guided to focus their investigations regarding job advertisements to specific geographic regions to identify which certifications were required by the industry. Although credible professional certifications are acknowledged worldwide, there are cases where certain certifications might be preferred over others. Therefore, guiding learners to localize job advertisements could be very useful for them to identify where to focus their learning efforts.

<figure><img src="image_4.png" /><figcaption>Fig. 1. Learners’ preference of top 4 delivered activities.</figcaption></figure>

Learners also acknowledged the importance of searching for resources to stay up-to-date (Fig. 1), e.g., to register to newsletters, through a forum activity where they had the opportunity to exchange views with their peers. The activity yielded a range of useful discussions and results, and a list was compiled at the end with the intention to maintain and share it in future deliveries with other learners. Although staying up-to-date might seem like a simple task, it is not always evident how critical this is to achieve cybersecurity situational awareness. Through the delivered activity, awareness became actionable, and it was evident to all at the end what to search for and how to achieve this goal.

Another activity that was deemed very useful by learners, was related to discussing criteria to select a cybersecurity certificate as part of their professional development (Fig. 1). The tutor was acting as a facilitator to a brainstorming session to list criteria based on which they would select a certificate. A range of criteria have been identified, such as cost, area of focus, industry requirements, easiness of obtaining it, type of exam, prerequisites such as years of experience, range of roles that can be applied, etc. This activity aimed to provide clarity to all learners and increase their awareness regarding aspects to consider relevant to certifications’ selection. A high interest was also
observed about other activities related to certifications (Fig. 2), e.g., identifying entry versus advance certificates, investigating the content of certifications curricula, utilize a career path roadmap that links certificates with job roles and competencies.

<figure><img src="image_5.png" /><figcaption>Fig. 2. Learners’ preference of less favored delivered activities.</figcaption></figure>

A low interest was observed for the delivered networking activity and for the activity to investigate information to include in a CPD log (Fig. 2). Networking is very important in terms of professional development, but this can be effective in the long run compared to some of the other activities that can have an immediate effect. Nonetheless, given that networking takes time to build, learners should realize that they need to start taking actions to maximize the benefit from connecting with their peers. This aspect will be emphasized in the next delivery of the curriculum. Also, some of the learners reported that they did not have a LinkedIn page, which justifies the low participation on the forum regarding the networking activity. It was assumed by the author that the majority would have a LinkedIn page. In future deliveries of the curriculum, the author will investigate first whether the learners have a LinkedIn page or not and adjust the networking activity accordingly, e.g., first investigate how to create a LinkedIn page, and then exchange contact information.

Moving on, the questionnaire investigated certain aspects of the curriculum. Specifically, it evaluated learners’ opinion about the usefulness of the material to guide them regarding certifications to select, career options and assisting them towards the creation of a professional development plan. As indicated in Fig. 3, there was consensus among the participants (agree to strongly agree) regarding the activities that have been performed, reporting that they have been useful in assisting them to obtain clarity about the cybersecurity certifications they should focus on to promote their professional development. Only a minor percentage (4%) reported their disagreement. Further investigations indicated that these results concerned a few experienced learners who had already the
opportunity to formulate their professional development plan and they had knowledge on the discussed topics.

<figure><img src="image_6.png" /><figcaption>Fig. 3. Evaluation of the material's usefulness related to certification aspects.</figcaption></figure>

Moreover, a high percentage of learners (92%) reported that they agree/strongly agree with the statement that they have obtained a better view of their career choices and how to proceed to plan for their professional development through the proposed curriculum (Fig. 4). Again, a small percentage (8%) of learners reported that they were neutral about this aspect. Further investigations indicated that these learners have not created yet a plan prior the delivered activities and they reported at the end that they do not plan to maintain the plan they created in the context of the delivered activities. In one case, although the learner reported that he/she was neutral, he/she indicated having over 10 years of experience and reported that most of the activities were useful to very useful. The questionnaire did not investigate whether learners hold any certifications. Such cases need to be investigated so that the curriculum can be adjusted to guide experienced learners into identifying advanced areas of growth.

The curriculum included a SWOT analysis activity, aiming to assist the learners to identify their strengths and weaknesses, and opportunities to pursue their professional development growth. The questionnaire investigated the activity's usefulness and whether the SWOT analysis helped learners to specify personal goals to include in their plan (Fig. 5). A high percentage of learners (63%) confirmed SWOT's analysis usefulness, 25% were neutral, while 12% reported their disagreement. The majority of those that reported their disagreement included learners with no or low experience. Reflecting on the SWOT analysis activity, further focus should be placed on future deliveries to support learners to extract their professional development goals as it is not an easy task to perform, especially for inexperienced learners.

Given that postgraduate programmes often consist of learners with different professional experience levels, the author considered important to investigate the learners' opinion about the stage they believe it will be most beneficial for MSc learners to take part in the listed professional development activities and create their personal plan. An interesting observation was made regarding this evaluation aspect as opinions varied;
<figure><img src="image_7.png" /><figcaption>**Fig. 4.** Evaluation of the material's usefulness related to career choices and planning for professional development.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>**Fig. 5.** Evaluation of SWOT's analysis usefulness.</figcaption></figure>

55% reported towards the end of their studies, 20% listed when they enter an academic program, while 25% selected after they register to a couple of cybersecurity modules. Further investigations revealed that among the learners who responded to participate in such activities towards the end of their studies, and those responded to participate at the start of their studies, in each case a high percentage (approx. 70%) concerned learners with no or low experience (1–5 years). Some of the learners acknowledged the benefit of performing the activities at the beginning, while others considered them more beneficial when learners obtain a good view of the cybersecurity area. Experienced learners (over 6 years of experience) indicated that it can be beneficial somewhere in the middle or towards the end of their studies.

Furthermore, encouraging results have been reported, confirming further the usefulness of the proposed curriculum. A high percentage of learners (87%) reported that they plan to maintain the plan that was created in the context of this curriculum to pursue
their professional development. This result was very encouraging, confirming the need to integrate such activities in the academic curricula to assist learners to pursue lifelong learning, beyond the context of their studies.

Finally, the questionnaire included an open-ended question, giving the opportunity to learners to report comments they had regarding the covered topics. Some indicative comments are extracted from the overall responses to demonstrate learners' satisfaction with the material: "very helpful and informative", "topics discussed were very helpful", "very interesting... never thought that I should take actions like the ones covered to look for a job...", "highly useful and innovative compared to other courses taken", "an excellent idea that drives my professional plan", "..."forced" me to look into various certificates in depth to understand what I am most interested in. It was the first time I entered this process, which will be very useful in my future career!", "topics we covered are quite satisfactory and have helped me to a great extent for my professional development", "very useful regarding my future career".

Moreover, learners provided valuable suggestions to be considered for the enhancement of the proposed curriculum: "include suggestions for online courses that could assist in acquiring competencies required by certifications", "arrange invited talks delivered by people who are active in the cybersecurity industry and determine job requirements", "discuss future trends regarding cybersecurity job requirements", "connect the discussions with the selection of the master thesis topic and where to focus the research", "discuss the topic of experience versus certification", "assist students in choosing an appropriate topic for the master's thesis, which could also be utilized for certification purposes". The author has already planned amendments to the curriculum based on learners' constructive feedback.

## 6 Conclusion

Cultivating talents in cybersecurity is a key direction to address the skills gap. This is a challenging task to perform as educators and learners must have a clear view of the competencies to develop to be able to pursue specific cybersecurity career opportunities and thrive. Formal education should assist learners to identify the competencies they possess, and to realize the gap in skills and knowledge relevant to cybersecurity roles of interest. In this way, learning can become focused and more effective, contributing to cultivating professionals with a lifelong learning mindset which is essential towards effective cybersecurity capacity building and a strong cybersecurity community.

## References

1. (ISC)² Cybersecurity Workforce Study (2022). https://www.isc2.org/Research/Workforce-Study. Accessed 06 Apr 2023

2. ISACA State of Cybersecurity 2022 Global Update on Workforce Efforts, Resources and Cyberoperations. https://www.isaca.org/go/state-of-cybersecurity-2022

3. ENISA, Addressing Skills Shortage And Gap Through Higher Education (2021). https://www.enisa.europa.eu/publications/addressing-skills-shortage-and-gap-through-higher-education. Accessed 06 Apr 2023
4. The Life and Times of Cybersecurity Professionals 2020, ESG, ISSA. https://www.esg-global.com/hubfs/ESG-ISSA-Research-Report-Cybersecurity-Professionals-Jul-2020.pdf.
Accessed 06 Apr 2023

5. ENISA, European Cybersecurity Skills Framework (ECSF) (2023). https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework. Accessed 06 Apr 2023

6. NIST, Workforce Framework for Cybersecurity (NICE), SP 800-181 rev1, 2020

7. Fisk, N., Kelly, N.M., Liebrock, L.: Cybersecurity communities of practice: strategies for creating gateways to participation. Comput. Secur. 103188 (2023). ISSN 0167-4048. https://doi.org/10.1016/j.cose.2023.103188

8. Furnell, S.: The cybersecurity workforce and skills. Comput. Secur. 100, 102080 (2021). ISSN 0167-4048. https://doi.org/10.1016/j.cose.2020.102080

9. Payne, B., Mayes, L., Paredes, T., Smith, E., Wu, H., and Xin, C.: Applying high impact practices in an interdisciplinary cybersecurity program. J. Cybersecur. Educ. Res. Pract. Kennesaw State University Institute for Cybersecurity Workforce Development (2021)

10. Pinchot, J., Cellante, D., Mishra, S., Paullet, K.: Student perceptions of challenges and role of mentorship in cybersecurity careers: addressing the gender gap. Inf. Syst. Educ. J. Inf. Syst. Comput. Acad. Prof. (2020)

11. Ayala, A.D., Endicott-Popovsky, B., Hinrichs, R.J.: CyberAlumni a Cybersecurity Collaboratory. J. Colloq. Inf. Syst. Secur. Educ. 10(1) (2023)

12. Furnell, S., Langner, G., Tokola, T., Andriessen, J., Quirchmayr, G., Luciano, C.: Collaborative cybersecurity learning: establishing educator and learner expectations and requirements. In: Drevin, L., Miloslavskaya, N., Leung, W.S., von Solms, S. (eds.) Information Security Education - Adapting to the Fourth Industrial Revolution. WISE 2022. IFIP AICT, vol. 650, pp. 49-59. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-08172-9_4

13. Kam, H., Katerattanakul, P.: Enhancing student learning in cybersecurity education using an out-of-class learning approach. J. Inf. Technol. Educ. Innov. Pract. Inf. Sci. Inst. (2019). https://doi.org/10.28945/4200

14. Hamburg, I., Vladut, G.: Developing workplace research skills to bridge the innovation gap between University and Industry. Adv. Soc. Sci. Res. J. 6(1), 144-152 (2019)

15. Hulatt, D., Stavrou, E.: The development of a multidisciplinary cybersecurity workforce: an investigation. In: Furnell, S., Clarke, N. (eds.) Human Aspects of Information Security and Assurance. HAISA 2021. IFIP AICT, vol. 613, pp. 139-147. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81111-2_12

16. Stavrou, E., Polycapou, I.: Cybersecurity-related curriculum for diverse postgraduate cohorts: a case study. In: The 18th International Conference on Education and Information Systems, Technologies and Applications (EISTA), pp. 13-16, September 2020

17. Parrish, A., et al.: Global perspectives on cybersecurity education for 2030: a case for a meta-discipline. In: Proceedings Companion of the 23rd Annual ACM Conference on Innovation and Technology in Computer Science Education, 2018 (2018)

18. Stavrou, E.: Back to basics: towards building societal resilience against a cyber pandemic. J. Syst. Cybern. Inform. (JSCI) 18(7), 73-80 (2020)