Why do we train? In a short summary, we train to gain new skills and sharpen the skills we already have. Take an athlete trying to shorten their run time. They analyze their current abilities and weaknesses. From there, they create a plan to strengthen their weak areas and achieve their goal of running faster.   Training security professionals should be no different, but for some reason it’s more difficult. In a rapid-changing industry like cybersecurity, we must train our people so they can better defend our organizations.   So how do we know what our people need? At HHS, we asked ourselves this question. We created a process, based on the NICE Framework, that identifies what our security professionals do and helps us understand what they need.   We would like to share our journey of creating an Information Security Role-Based Training program to help others on their own journeys.