European employers, training providers and job seekers describe the same cyber security jobs in very different words, which makes hiring, skills planning and NIS2 evidence harder than it needs to be. The European Cybersecurity Skills Framework (ECSF), published by ENISA in September 2022, fixes a common vocabulary of 12 typical role profiles, each with a mission, deliverables, tasks, skills, knowledge and e-competences taken from the European e-Competence Framework. This guide explains what each profile contains, how employers and individuals actually use it, how it lines up with certifications and the US NICE Framework, and what the revision planned by ENISA will change. It is for hiring managers, CISOs planning a team, learning and development leads and practitioners who want a recognised map of where their career is going. For the wider career picture, see the Cybersecurity Careers Guide.
Key takeaways
- Twelve profiles, not a job catalogue. The ECSF groups cyber security work into 12 typical role profiles, from Chief Information Security Officer to Penetration Tester; real jobs often combine parts of two or three.
- Every profile has the same nine fields. Title, alternative titles, summary statement, mission, deliverables, main tasks, key skills, key knowledge and e-competences with proficiency levels, so profiles can be compared line by line.
- The e-CF link makes it measurable. Each profile cites competences from EN 16234-1 (e-CF) at a stated level, which gives you a scale for gap analysis and progression.
- It is machine readable now. ENISA published XLSX and JSON versions in December 2024 and an interactive profile browser, so you can load profiles into HR or learning systems instead of copying PDFs.
- It is changing. ENISA says the ECSF is being revised to add proficiency levels and reflect new EU policy, with a public consultation planned for the end of 2026, so build processes that can absorb a new version.
What the role does: the 12 ECSF role profiles
The ECSF is not a single role. It is a reference set of profiles that describe the work a cyber security function has to cover. ENISA presents it as the EU reference for identifying and articulating tasks, competences, skills and knowledge, and it sits underneath the European Commission's Cybersecurity Skills Academy, which uses it to define and assess skills and monitor gaps. Each profile in the Role Profiles document follows the same template:
- Profile title and alternative titles: the ECSF name plus the job titles employers actually advertise (the Cyber Incident Responder profile lists SOC Analyst and Incident Response Engineer, for example).
- Summary statement and mission: one line on what the role does and a short paragraph on why it exists.
- Deliverables: the outputs the role owns, given as non-exhaustive examples.
- Main tasks, key skills and key knowledge: the working detail you would put into a job description or a training plan.
- e-Competences (from e-CF): competence codes from EN 16234-1 with a proficiency level for each.
The table summarises the 12 profiles as published in ENISA's ECSF JSON release.
| ECSF profile | Common job titles listed | Main deliverables | e-CF competences (level) |
|---|---|---|---|
| Chief Information Security Officer (CISO) | Head of Information Security, Information Security Manager, Cybersecurity Programme Director | Cybersecurity strategy, cybersecurity policy | A.7 (4), D.1 (5), E.3 (4), E.8 (4), E.9 (5) |
| Cyber Incident Responder | SOC Analyst, Incident Handler, Incident Response Engineer, SIEM Manager | Incident response plan, cyber incident report | A.7 (3), B.2 (2), B.3 (3), B.5 (3), C.4 (4) |
| Cyber Legal, Policy and Compliance Officer | Data Protection Officer, GRC Consultant, IT Compliance Manager | Compliance manual, compliance report | A.1 (4), D.1 (4), E.8 (3), E.9 (4) |
| Cyber Threat Intelligence Specialist | Cyber Intelligence Analyst, Cyber Threat Modeller | CTI manual, cyber threat report | B.5 (3), D.7 (4), D.10 (4), E.4 (3), E.8 (4) |
| Cybersecurity Architect | Solutions Architect, Cybersecurity Designer, Data Security Architect | Architecture diagram, cybersecurity requirements report | A.5 (5), A.6 (3), B.1 (3), B.3 (3), B.6 (4) |
| Cybersecurity Auditor | Information Security Auditor, GRC Auditor, Audit Manager | Audit plan, audit report | B.3 (4), B.5 (3), E.3 (4), E.6 (4), E.8 (4) |
| Cybersecurity Educator | Awareness Specialist, Cybersecurity Trainer, Lecturer | Awareness programme, training material | D.3 (3), D.9 (3), E.8 (3) |
| Cybersecurity Implementer | Cybersecurity Engineer, Cybersecurity Developer, DevSecOps Engineer | Cybersecurity solutions | A.5 (3), A.6 (3), B.1 (3), B.3 (3), B.6 (4) |
| Cybersecurity Researcher | Research Engineer, R&D Officer, Research Fellow | Publications in cyber security | A.7 (5), A.9 (5), C.4 (3), D.7 (4), D.10 (3) |
| Cybersecurity Risk Manager | Information Security Risk Analyst, Risk Assessor, Cyber Risk Manager | Risk assessment report, risk remediation action plan | E.3 (4), E.5 (3), E.7 (4), E.9 (4) |
| Digital Forensics Investigator | Digital Forensics Analyst, Computer Forensics Consultant | Forensic analysis results, electronic evidence | A.7 (3), B.3 (4), B.5 (3), E.3 (3) |
| Penetration Tester | Ethical Hacker, Vulnerability Analyst, Red Teamer | Vulnerability assessment report, penetration testing report | B.2 (4), B.3 (4), B.4 (2), B.5 (3), E.3 (4) |
Two things stand out. First, the levels tell you seniority: the CISO profile sits at level 5 for D.1 and E.9, while the Implementer and Architect share the same competence codes but the Architect sits at level 5 for A.5 against level 3 for the Implementer. Second, some familiar jobs are spread across profiles. A SOC analyst is listed under the Cyber Incident Responder, a DPO under the Cyber Legal, Policy and Compliance Officer, and a vulnerability analyst under the Penetration Tester.
Core skills and tools
The "tools" of the ECSF are the competence scale behind it and the published data files. Understanding both is what turns the framework from a poster into something you can run.
The e-CF competence scale
The e-CF, published as EN 16234-1:2019, defines 41 e-competences in five areas: Plan (A), Build (B), Run (C), Enable (D) and Manage (E), each with up to five proficiency levels. Codes you will meet most in the ECSF include E.8 Information Security Management, E.3 Risk Management, D.1 Information Security Strategy Development, E.9 IS Governance, B.3 Testing and B.5 Documentation Production. Because the ECSF borrows these codes rather than inventing its own, a profile can be compared with other ICT roles in the same organisation that already use the e-CF.
How the profiles express skills
Key skills in the profiles are written as short, testable statements. The Penetration Tester profile, for example, lists developing code, scripts and programmes, performing social engineering, identifying and exploiting vulnerabilities and conducting ethical hacking. The Cyber Incident Responder lists handling and responding to incidents across technical and operational aspects, correlating threat information from multiple sources, working across operating systems, servers and clouds, and working under pressure. Those statements translate directly into interview questions and practical assessments.
The data and where to get it
| ENISA resource | What it gives you | Typical use |
|---|---|---|
| ECSF Role Profiles (PDF, September 2022) | All 12 profiles in the nine-field template | Reading, job descriptions, workshops |
| ECSF User Manual (PDF, September 2022) | Scope, principles and application guidance for stakeholders | Designing an adoption approach |
| ECSF XLSX and JSON (December 2024) | The profiles as structured data | Loading into HR, learning management or skills platforms |
| Interactive profile browser (GitHub Pages) | Searchable view of the profiles | Career conversations, quick lookups |
| ESCO and ECSF crosswalk | Mapping to the EU's occupations and skills classification | Labour market data, public employment services |
| Cybersecurity roles and skills for NIS2 entities (June 2025) | Mapping of NIS2 obligations to ECSF profiles | Showing which roles cover which NIS2 duties |
Routes into the role: how individuals and employers use the ECSF
The ECSF works as a route map. Different users enter it from different places.
- Job seekers and career changers: pick the one or two profiles closest to the work you want, read the main tasks, and compare them honestly with your current experience. Most people enter through the Implementer, Incident Responder or Legal, Policy and Compliance Officer profiles and move later. See the Career Change into Cyber Security Guide.
- Hiring managers: start each vacancy from a profile, keep the tasks and deliverables you actually need, delete the rest, and say in the advert which ECSF profile it maps to. This stops "unicorn" adverts that ask one person to be architect, tester and auditor at once. See the Cybersecurity Skills Gap and Hiring Guide.
- CISOs planning a team: list which of the 12 profiles your organisation needs in house, which you buy from providers (penetration testing and forensics are common), and which one person covers part-time. Record the gaps.
- NIS2 entities: NIS2 Article 20(2) requires members of management bodies to follow training and encourages entities to offer similar training to employees regularly. ENISA's June 2025 report maps NIS2 obligations to ECSF profiles, which gives you a defensible way to show that each obligation has a named, competent role behind it. See the NIS2 Directive Guide.
- Learning providers and universities: map modules to profile tasks and knowledge items so learners can see which profile a course prepares them for.
Where identity work fits
There is no separate identity or NHI profile. Identity engineers who build IAM, PAM and secrets platforms fit the Cybersecurity Implementer profile, and those who design identity architecture fit the Cybersecurity Architect. Machine identity and NHI governance work also draws on the Risk Manager and Auditor profiles when it comes to access reviews and evidence. If you are building an identity team, map each post to the Implementer or Architect profile and add identity-specific tasks. See the IAM Engineer Career Guide and the NHI and Machine Identity Engineer Career Guide.
Certifications that help
ENISA hosts a page of certifications mapped to the ECSF, with links to mappings published by nine certification bodies: CompTIA, ISACA, ISC2, SANS, CREST, EC-Council, Fortinet, Hack The Box and OffSec. The mappings appear to be produced by the bodies themselves, and the page does not say that ENISA verifies them, so treat them as a starting point rather than an endorsement. The table shows how commonly held certifications line up with profiles by subject matter; check each body's own ECSF page before relying on a mapping.
| ECSF profile | Certifications commonly aligned by content | NHI Mgmt Group guide |
|---|---|---|
| CISO | CISM, CISSP, CGEIT | CISM Certification Guide |
| Cyber Incident Responder | Blue team and incident handling certifications | Blue Team Certifications Guide |
| Cyber Legal, Policy and Compliance Officer | CIPP/E, CIPM, CGRC | CIPP/E and CIPP/US Certification Guide |
| Cybersecurity Auditor | CISA, ISO 27001 Lead Auditor | CISA Certification Guide |
| Cybersecurity Risk Manager | CRISC, Open FAIR | CRISC Certification Guide |
| Cybersecurity Architect | CISSP concentrations (ISSAP), CCSP | ISC2 CISSP Concentrations Guide |
| Penetration Tester | Practical offensive certifications (CREST, OffSec, Hack The Box) | Practical Red Team Certifications Guide |
A certification proves knowledge against one body's syllabus. The ECSF profile tells you whether that knowledge matches the job. Use both: the profile to decide what you need, the certification as one piece of evidence. See the Cybersecurity Certifications Guide.
Progression
The ECSF supports two kinds of progression: going deeper within a profile (higher e-CF levels) and moving sideways or upwards between profiles that share competences.
- Implementer to Architect: the two profiles share A.5, A.6, B.1, B.3 and B.6, but the Architect needs A.5 at level 5. The path is mostly about design authority, not new subjects. See the Security Architect Career Guide.
- Incident Responder to Forensics or CTI: A.7 and B.5 recur across the three, so analysts move between them easily. See the DFIR Analyst Career Guide.
- Auditor or Risk Manager to CISO: E.3 and E.8 recur, and the CISO adds strategy (D.1) and governance (E.9) at the top level. See the Cybersecurity Risk Manager Career Guide and the CISO Guide: First 90 Days.
ECSF compared with the NICE Framework
| Aspect | ENISA ECSF | NIST NICE Framework |
|---|---|---|
| Owner and scope | ENISA, EU reference framework | NIST, defined in SP 800-181 Rev. 1 with components maintained separately |
| Unit of description | 12 typical role profiles | Work roles built from Task, Knowledge and Skill statements, plus competency areas |
| Granularity | Broad profiles that combine related jobs | Many more, narrower work roles |
| Proficiency | e-CF levels attached to competences; ENISA plans to add proficiency levels in the revision | Proficiency handled through competency areas and organisational use |
| Machine-readable form | XLSX and JSON (December 2024) | Components in XLSX and JSON (version 2.2.0 listed by NIST in 2025) |
| Best fit | EU employers, NIS2 planning, European training programmes | US public sector and organisations aligned to US workforce programmes |
Organisations operating on both sides of the Atlantic can keep the ECSF as the top-level profile list and use NICE work roles as the more detailed task layer. See the NICE Workforce Framework Guide.
Mistakes to avoid when adopting the ECSF
- Treating profiles as job descriptions: profiles are typical, and the deliverables are examples. Copying all tasks into one advert produces an impossible role.
- Ignoring the levels: mapping a junior engineer and a principal architect to the same profile without levels hides the actual gap.
- Trusting certification mappings blindly: mappings come from the certification bodies; test the knowledge in the job.
- Freezing on version 1: the planned revision will add proficiency levels. Keep your mapping in a data file keyed by profile name so it can be updated.
Measure adoption with a few simple numbers: percentage of security posts mapped to an ECSF profile, number of profiles your organisation needs that have no named owner, average gap between required and assessed e-CF level per post, and percentage of training spend tied to a profile gap.
Practitioner checklist
- Download the ECSF JSON or XLSX from ENISA and load it into the system you use for roles or learning.
- Map every security post to one primary ECSF profile and, where needed, one secondary profile.
- Record the required e-CF level for each competence and assess each person against it once a year.
- List which of the 12 profiles you staff in house, buy from providers or leave uncovered, and report the uncovered ones as risks.
- For NIS2 entities, link each NIS2 obligation to a named role using ENISA's June 2025 mapping, and keep management training records under Article 20(2).
- Rewrite job adverts from profile tasks and deliverables, and name the profile in the advert.
- Check each certification body's own ECSF mapping before using it in a pay or promotion decision.
- Watch for the ECSF revision and public consultation planned for the end of 2026, and plan a remapping exercise.
Standards and references
- ENISA: European Cybersecurity Skills Framework (ECSF)
- ENISA: European Cybersecurity Skills Framework Role Profiles
- ENISA: European Cybersecurity Skills Framework (ECSF) User Manual
- ENISA: Cybersecurity Roles and Skills for NIS2 Essential and Important Entities
- ENISA: Certifications Mapped to the ECSF
- CEN and IT Professionalism Europe: The e-Competence Framework (EN 16234-1)
- European Commission: Communication on the Cybersecurity Skills Academy
- NIST: NICE Framework Current Versions
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · NICE Workforce Framework Guide · Cybersecurity Skills Gap and Hiring Guide · NIS2 Directive Guide