The demand for cyber security professionals has not kept pace with the sophistication and velocity of cyber criminal activity; and from all accounts the problem is going to get worse. The shortfall of cyber security skills is a major challenge to prevent, detect, and respond to these cyber attacks. To compound the problem, training programs and educational institutes fall further behind the demand every year, making our ability to find the right talent a difficult challenge that will likely continue for years to come. Creating a high performing cyber security team is an expensive and daunting task, but maybe it doesn’t have to be. In this presentation I will walk you through a 4 part professional development program that will help you pick, train, and retain the right people. Learn how to build a robust and sustainable cyber security talent pipeline without blowing your budget using the following framework. Framework: Battle Roster Assessment Map of skills by position Internal training & challenge schedule Individual Development Plan Battle Roster Assessment - The cyber security professional development plan consists of comprehensives lists of demonstrable skills required to successfully meet the standards of each position within Cyber Security. Team members are expected to work with their up line to document how they have demonstrated meeting each skill. Future work will include skills required for advancement into other teams. The quantitative assessment (Gauntlet) and a qualitative assessment (Capacity Index) of team member’s capacity to achieve expected development goals. The percentage of points awarded in each area of the gauntlet is recorded and plotted to provide tactical guidance as to which trainings would be most advantageous for the team member to complete in order to meet current standards as well as career growth goals. Map of skills by position- The Gauntlet is broken into 5 skill groups that have been identified as critical to the Cyber Security program. These skill groups include: Reverse Engineering, Host Analysis, Network Analysis, General InfoSec, and Incident Investigations. These skills are outlines as demonstrable, not ethereal concepts. Internal training & challenge schedule - A large number of internal training opportunities and technical challenges are developed and provided to the team member to go above and beyond assigned development activities each year. Individual Development Plans - Individual development plans are developer for each team member to either address deficiencies or reinforce strengths. These plans will assist team members to have access to the training they need to be successful.