Training Tracks · Mapped to the NICE framework
Build a security career one level at a time.
Our tracks group accredited certifications by NICE work role and by level, so a new analyst, a systems engineer or a future team lead can see a clear route from foundation skills to advanced, hands-on expertise.
Why follow a track
Stop collecting certificates. Start building a role.
Every course has a purpose
Each certification sits at a set level within a NICE role, so learners know what it adds and what it prepares them for next.
Fewer wasted training days
Managers can fund the step a person is ready for, rather than a course that repeats what they know or skips too far ahead.
Matched to your team
We screen your team's skills against the NIST NICE framework, then shape each track around the real gaps that screening reveals.
The four tracks
Four NICE categories. A clear route through each.
These are sample tracks built on the NICE framework. We adjust each one to your role, your experience and the systems your organisation runs.
Securely Provision
Designing and building secure systems. Runs from Security+ and CND to CEH, PenTest+, CPENT and CASE .NET and Java.
Operate & Maintain
Running infrastructure safely day to day. Starts with A+, Network+ and Server+, then Cloud+ and CVA, up to DevSecOps and CISM.
Protect & Defend
Detecting and stopping attacks. Builds from Network+ and Server+ through Security+, CND and Cloud+ to CySA+, CSA and CFR.
Analyse
Investigating threats and incidents. Moves from Security+, CND and CEH to CySA+, CSA and CER, then on to CHFI and ECIH.
Three levels
Three levels. Clear steps between them.
01 · Start
Entry level
Network+, Server+ and A+ foundations
Security+ or CND for core defence
Cloud+ and IoT Practitioner
CEH as a starting point for analysts
02 · Grow
Intermediate level
CEH and PenTest+ for secure provisioning
Security+, CND and Cloud+ for defenders
CySA+ or CSA, plus CER, for analysts
CVA for operations and maintenance staff
03 · Lead
Advanced level
CPENT and CASE for build specialists
CISM and DevSecOps for operations leads
CySA+, CSA and CFR for senior defenders
CHFI and ECIH for investigators
Programmes delivered
Structured learning, delivered for national programmes.
CBJ Cybersecurity Bootcamp · 2025
Nine EC-Council courses plus ISACA CET over three months
NCSC Nashama Cyber · 2024 to 2026
Cohorts 4, 5, 7 and 9 of the national programme delivered
Community programme · Amman · 2025
16 weeks from networks to SOC, forensics and GRC
BSI ISO 22301 Lead Implementer · May 2025
Every candidate in the cohort passed
Governance skills, applied in ExceedGRC.
Advanced tracks lead to roles such as CISM-certified security manager. ExceedGRC gives those leaders one place for policies, processes, compliance gaps and risk mitigation, replacing scattered spreadsheets, documents and email threads.
Related
Choose a track. Then book the first course.
Find course dates, browse the full catalogue, or bring in specialists while your own team is still training.
Training Schedule
Upcoming classes, including ECIH for the Analyse track, online in the evening or full days in Amman.
See course datesTraining Courses
Every accredited course we run, grouped by awarding body, with the certification each one leads to.
Browse the catalogueProfessionals as a Service
Experienced security staff to fill a role while your own people work through their training track.
Explore the serviceRed Teaming
Training-led red team exercises that put your defenders against real attack techniques, red versus blue.
Explore red teamingFAQ
Tracks and levels, clearly mapped.
What learners and team leaders ask when they plan a track.
What is the NICE framework?
The NICE Workforce Framework for Cybersecurity, published by the US National Institute of Standards and Technology (NIST) as SP 800-181, describes cyber work by category and role. Our sample tracks use the categories of its original edition.
Are these tracks fixed?
No. They are samples. We adjust the courses and their order to your current skills, your goals and the technology your organisation uses, often after a skills screening.
Do the tracks include hands-on workshops?
Yes. Practical workshops sit alongside the certifications: Nmap, penetration testing with Metasploit, OWASP web application penetration testing, Burp Suite and SQLMap, network and system penetration testing, and network monitoring with Tcpdump.
Can you assess our team before choosing a track?
Yes. Our screening and assessment service tests technical skills against the NIST NICE framework, shows where the gaps are and turns them into a training roadmap for each person or the whole team.
Which track suits a SOC analyst?
Usually Protect & Defend or Analyse. Protect & Defend builds detection and defence skills up to CySA+ and CFR, while Analyse leads towards forensics and incident handling with CHFI and ECIH.
Plan your track
Tell us the role. We'll map the route.
Share your current role and where you want to be. Our academy team will suggest a track, a starting course and dates that suit you.
Tell us your role, experience and goal
We match you to a NICE track and level
You receive a course plan with upcoming dates