CyberBridge: Bridging the Gap Between Cybersecurity Education and Industry

CyberBridge: Bridging the Gap Between Cybersecurity Education and Industry Arthur Nijdam Dept. of Electrical & Information Technology Lund University Lund, Sweden arthur.nijdam@eit.lth.se

Paul Stankovski Wagner Dept. of Electrical & Information Technology Lund University Lund, Sweden paul.stankovski wagner@eit.lth.se

arXiv:2608.05231v1 [cs.CR] 5 Aug 2026

Sara Ramezanian Dept. of Mathematics & Computer Science Karlstad University Karlstad, Sweden sara.ramezanian@kau.se Abstract—This full research paper presents CyberBridge, a framework that automatically maps cybersecurity job descriptions to professional role profiles. As the cybersecurity landscape evolves rapidly, it is difficult for academic programs to align curricula with the competencies expected in practice. CyberBridge addresses this gap by decomposing a given vacancy description into its constituent Knowledge, Skill, and Task (KST) statements, embedding them using a sentenceBERT model, and matching them to the most semantically similar workforce profiles. A key contribution of our approach is its interpretability. Rather than functioning as a black box, CyberBridge enables users to trace recommendations back to the specific competencies driving each match, providing a humanreadable justification for the resulting mappings. CyberBridge supports three primary use cases; (1) job recommendation, providing students with vacancies and closely matching professional roles based on their completed curriculum, (2) market analysis, enabling educators and curriculum developers to analyze which roles are currently in demand, and (3) curriculum planning, assessing which course program best prepares students for in-demand cybersecurity roles. As such, CyberBridge can be used by educational institutions as a practical tool for career guidance and evidence-based curriculum development in cybersecurity education. Index Terms—Career Development, Cybersecurity, LLM, NLP, Personalized Education, Recommender Systems

I. I NTRODUCTION Cybersecurity is a rapidly evolving field, driven by the emergence of new threats such as Artificial Intelligence (AI)based attacks [1], Internet of Things vulnerabilities [2], and ransomware attacks [3]. At the same time, a persistent skills gap remains: in 2025, approximately two-thirds of cybersecurity teams reported lacking essential competencies [4]. This highlights the need for stronger alignment between the regional labor market and cybersecurity education, where future Funding for this work was made available by the Swedish Research Council (VR) under grant 2021-05621, and the Swedish Knowledge Foundation (KKS). All computations were executed on a Tesla T4 GPU, provided by the National Academic Infrastructure for Supercomputing in Sweden (NAISS), partially funded by the Swedish Research Council through grant agreement no. 2022-06725.

cybersecurity professionals begin developing their skill set [5]–[7]. However, curriculum developers and educators struggle to keep up with the fast-paced changes in the cybersecurity landscape [8]. Additionally, while workforce frameworks such as the National Initiative for Cybersecurity Education (NICE) published by the National Institute of Standards and Technology (NIST) [9] provide structured descriptions of cybersecurity competencies and roles, academic curricula are often difficult to relate directly to these frameworks, limiting their practical use for students and curriculum designers. To address these issues, we present CyberBridge, an endto-end framework that connects cybersecurity curricula, standardized workforce frameworks, and real job advertisements (see Figure 1). CyberBridge supports three primary use cases: 1) Job Recommendation: help students identify which professional cybersecurity roles best match their completed coursework. 2) Market Analysis: enabling educators and program designers to analyze which cybersecurity roles are currently in demand in their region and to project how these demands evolve over time. 3) Curriculum planning: analyze how well existing and future curricula map onto in-demand cybersecurity roles. CyberBridge is an ontology-based Job Recommendation System (JRS) that maps unstructured job advertisements to the professional work roles defined in the NICE framework [9]. The system follows a two-stage approach. First, an offthe-shelf Large Language Model (LLM) is used to extract structured Knowledge, Skill, and Task (KST) descriptions from the free-text job advertisement. These serve as a standardized intermediate representation, devoid of redundancy that might be present in the original phrasing of the advertisement, and more closely aligned with the structure of the NICE framework. Subsequently, CyberBridge leverages the sentence-Bidirectional Encoder Representations from Transformers (sBERT) [11] model to derive semantic representa-

RQ1: How can an interpretable matching be achieved between cybersecurity job advertisements and the professional roles defined in the NICE framework? • RQ2: Which cybersecurity job roles are most in demand, and how does the demand differ geographically? • RQ3: How can labor market analyses performed by CyberBridge inform curriculum planning? The rest of this paper is organized as follows. Section II gives an overview of related work. Section III presents our proposed methodology, addressing RQ1. Section IV presents both a quantitative performance evaluation of CyberBridge and experimental results from its application to market analysis (RQ2) and curriculum planning (RQ3). Section V discusses limitations and possible extensions of our tool. Finally, Section VI concludes our work. •

Workforce Framework

CurricuLLM

job recommendation

CyberBridge

market analysis

curriculum planning

Job Advertisement

Academic Curriculum

Fig. 1. Linking job advertisements, standardized workforce frameworks, and academic curricula through CyberBridge and CurricuLLM [10].

tions from the extracted KST, as well as of the KST associated with each NICE work role. By computing the similarity between these representations, the system establishes a bidirectional mapping between vacancies and NICE work roles: a vacancy can be linked to its nearest work role(s), and conversely, a given NICE work role can be matched to the most relevant available vacancies in the database. This symmetry enables both work role classification and downstream job recommendation, respectively, depending on whether the starting point is a job advertisement or a target role. Therefore, we explicitly utilize the KST ontology of the NICE framework, rather than relying on keyword matching or directly prompting a proprietary LLM. This ontologycentered design makes the job recommendation process more interpretable and explainable, since CyberBridge gives access to the specific Knowledge, Skill, or Task descriptions that contributed most strongly to the ranking of a given vacancy, e.g., whether this primarily driven by ‘hard skills’ like C++ programming or by ‘soft skills’ such as team work. This transparency is valuable in an educational context, as students and their guidance counselors get insight into which competencies are most important for a given cybersecurity role. Additionally, the explainability of CyberBridge is beneficial to the workforce. It enables recruiters and hiring managers to assess how their vacancy is positioned within the NICE framework by exposing which workforce categories, e.g. Protect & Defend versus Implement & Operate, are most strongly associated with a given job posting. This insight, in turn, informs the design of vacancies targeted to the specific type of cybersecurity professional the organization aims to hire. In summary, our methodology provides a transparent bridge between job advertisements and standardized workforce frameworks, rather than relying on black-box machine learning. Lastly, we demonstrate how CyberBridge can be coupled with the recently released CurricuLLM framework [10] to connect vacancies to academic curricula, as depicted in Figure 1. This integration facilitates curriculum design based on current, regional labor market demand, enabling the use of CyberBridge as a curriculum-informed JRS. In this work, we address the following research questions:

II. R ELATED W ORK A. Job Recommendation Systems Job Recommendation Systems aim to present users with vacancies that best match their profile and search criteria. To this end, JRS typically leverage information such as the content of the applicant’s curriculum vitae, their past search behavior, or labor market data [12]. In the STEM domain, professional competencies are often expressed using Knowledge, Skills, and Abilities or Task descriptions [13]–[15]. Because these KST descriptions define what a professional should know and do, they provide a natural foundation for JRS. This principle has been applied across computing disciplines. For example, Fernández-Sanz et al. [16] developed a JRS for Computer Science that utilizes e-skills to align users with suitable roles. Within the cybersecurity domain, Dzurenda et al. [17] proposed a JRS based on skills extracted from the European Cybersecurity Skills Framework (ECSF). Automating the analysis of vacancies for JRS is essential due to the time-consuming nature of manual analysis and the dynamic job market. Some JRS approaches use classical machine learning techniques such as Naive Bayes [18] and K-means clustering [19]. More recently, advances in Natural Language Processing (NLP), particularly transformer-based models such as BERT [20], have greatly improved the ability to process large text volumes. As a result, these models have become the new gold standard for JRS [19], [21], [22]. B. Cybersecurity Curriculum Development Cybersecurity curricula require frequent updating due to the rapidly evolving threat landscape [8]. Commonly used references for cybersecurity curriculum design are the Cybersecurity Curricula 2017 (CSEC2017) framework [23], which organizes the domain into eight Knowledge Areas (KAs) to guide program design, and the Cyber Security Body of Knowledge (CyBOK) [24], which defines 21 Knowledge Areas. Aligning educational perspectives with workforce needs is a central challenge in curriculum development. Workforce frameworks, such as the NICE [9] framework, describe cybersecurity professions in terms of roles and competencies.

Prior work has begun bridging educational and workforce perspectives. Ramezanian and Niemi [8] mapped NICE Knowledge descriptions to CSEC2017, revealing gaps between academic coverage and workforce expectations. CurricuLLM [10] extends this idea by mapping course descriptions to NICE roles using LLMs. CyberBridge complements this approach by linking job advertisements to NICE, enabling labor market–aware curriculum analysis (Figure 1). III. M ETHODS A. Datasets In this work, we use the following two datasets. • REWIRE [25]: originally coined the Cybersecurity Job Ads Analyzer dataset, this dataset was developed for the REWIRE Horizon Europe project [26]. It contains 936 European cybersecurity job descriptions, as well as one Afghan job description. • LinkedIn [27]: consists of approximately 1.3 million job listings scraped from LinkedIn in 2023 and 2024, made publicly available on Kaggle. The dataset contains the job title, a link to the job description, the company, location of the job, date the listing was posted, the target city for the search, as well as a summary of the job listing and the required skills listed on LinkedIn. 6,020 samples in this dataset were deemed cybersecurity roles. We restricted our analysis to job descriptions and job titles, as these data fields were shared across both datasets. The REWIRE dataset contained approximately thirty ECSFannotated samples, but these could not be utilized due to the lack of comparable annotations in the other dataset. All job descriptions were normalized using a pre-processing function that converts text to lowercase, removes special characters, and cleans up extra spaces. All code developed for this work is publicly available in our Github repository [28]. B. Extracting KST-statements We adopt an ontology-based method that connects the job advertisements contained in both datasets with the NICE job roles by breaking it down into Knowledge, Skill, and Task descriptions. To this end, we use the procedure detailed in Figure 2. The job description is first passed through an LLM with the prompt contained in Figure 3 to extract KST statements. Each prompt variant (KNOWLEDGE, SKILL, TASK) uses the same base instructions (system prompt) with category-specific definitions appended to the system prompt (contained in #Question). We employ DeepSeek-V3 as the LLM to do this extraction, since this LLM showed the best performance in [10]. As can be seen from the extracted KST statements in Figure 2, all statements are taken from the original job description without alterations in their phrasing, except for the inclusion of ‘Knowledge of’ and ‘Skill in’, c.f. the phrasing of Knowledge and Skill descriptions in the NICE framework. For example, the sample that ‘Knowledge of ISO/IEC 27001’ originates from appears under the heading Required Qualifications in the job posting.

Each resulting KST statement is embedded as a 768dimensional vector using sBERT [11], a sentence-level adaptation of BERT [20]. Both models begin with tokenization, which splits text into smaller units such as words or subwords. BERT generates contextualized embeddings for each token in an input sequence, producing variable-length outputs that depend on the length of the input text. This complicates direct sentence-level similarity comparison because the embeddings do not share a fixed dimensional representation. sBERT addresses this limitation by applying pooling operations over the token embeddings to produce a single fixed-length sentence vector. sBERT embeddings are optimized for similarity comparison using cosine similarity, enabling efficient semantic comparison across statements of different lengths. This is particularly suitable for our setting: while we have access to elaborate, expert-defined, KST descriptions for all NICE work roles, we do not have labeled training data linking vacancies to roles. By embedding both the KST descriptions extracted from job advertisements and the official KST descriptions of NICE roles into the same semantic space, we can map a vacancy to its closest matching role(s) based on semantic similarity rather than through supervised classification. C. Vacancy-NICE work role mapping with sBERT Once the KST descriptions are embedded into the sBERT semantic space, each vacancy and each NICE work role can be represented in the same space by embedding of their respective Knowledge, Skill, and Task descriptions. This enables a structured comparison between vacancies and NICE work roles based on semantic similarity. Figure 4 provides an intuitive geometric interpretation of the matching process in the embedding space. The formalization of similarity underlying this visualization is as follows: Let a vacancy v and a NICE work role r consist of 3 sets corresponding to the sBERT embeddings of the K, S, and T descriptions, respectively, such that, v = (Kv , Sv , Tv ) and r = (Kr , Sr , Tr ), where for example Kv = ⃗kv1 ,⃗kv2 , ...,⃗kv8 if there are 8 Knowledge descriptions for vacancy v. We measure the semantic similarity between two embedding vectors using cosine similarity, defined as: sim(⃗x,⃗y) =

⃗x ∗⃗y ||⃗x|| ∗ ||⃗y||

(1)

This metric computes the cosine of the angle between vectors ⃗x and ⃗y, providing a normalized measure of their semantic proximity. We adopt cosine similarity since sBERT is explicitly trained to produce embeddings that are comparable under this metric [11]. As shown in Figure 2, some extracted KST descriptions are vague or not cybersecurity-specific, e.g., ‘Skill in establishing control-related processes and procedures’. To limit their influence, we apply a soft similarity threshold τ, yielding the following thresholded similarity function: simτ (⃗x,⃗y) = max (sim(⃗x,⃗y) − τ, 0)

(2)

Senior Cyber Security Engineer Reporting to the Cyber Security Team Lead, the Senior Cybersecurity Engineer will primarily focus on forensics, log management and threat modeling. The Cybersecurity Engineer is a seasoned professional, proactive self-starter who has strong problem-solving analytical skills with great attention to detail. The candidate must be comfortable working in a fast-paced, entrepreneurial, goal-oriented environment, emphasizes accountability for delivering results, and has hands-on experience with the latest security processes. Responsibilities: Collaborate with senior management across the company to prioritize security initiatives. Establish control-related processes/procedures while working towards building relevant security metrics and dashboards Act as an escalation point for and support Cyber Security incidents as a tier 3 support Perform forensic investigation in a case of an incident Own and improve Cyber Security incident management process Proactively work on threat modeling tasks Work closely with various business and support teams to identify and implement logging requirements Serving as subject matter expert for Cyber/Product Security, having strong software engineering skills Provide periodic reports to the management team and key stakeholders Work closely with the team to understand products (connected devices) in-depth and document the product details, including the security architecture, attack surface, trust boundaries, and data flows. Help the engineering team to develop Threat Models that enumerate cybersecurity threats by attack surface

Knowledge: • Knowledge of security by design principles. • Knowledge of ISO/IEC 27001. • Knowledge of ITIL. . . . • Knowledge of computer forensics. • Knowledge of threat modeling. • Knowledge of cyber security incident management.

KST Extraction

LLM

Required Qualifications: Commitment to diversity, equity, and inclusion, a personal growth mindset, and customer-centricity 5+ years of cybersecurity or engineering/development experience with increasing responsibilities BA/BS or equivalent experience Knowledge of common information security management frameworks, such as ISO/IEC 27001, ITIL, COBIT, SANS, and NIST Proficiency in technical understanding of various IS components (Linux, Windows, WEB applications, IoT devices and network devices) Preferred Qualifications Understanding of security by design principles and architecture-level security concepts. Application or software security certifications are preferred, such as CASP, CISSP, CEH, OSCP, CSSLP, GIAC, GSEC Hands-on experience with computer forensics, and threat modeling Cyber Security incident management experience

Skills: • Skill in collaborating with senior management to prioritize security initiatives. • Skill in establishing control-related processes and procedures. • Skill in building relevant security metrics and dashboards. . . . • Skill in applying security by design principles. • Skill in applying architecture-level security concepts. • Skill in managing cyber security incidents.

KST Embedding

K

sBERT

S T

Tasks: • Collaborate with senior management to prioritize security initiatives. • Establish control-related processes and procedures. • Build relevant security metrics and dashboards. . . . • Document security architecture. • Help the engineering team to develop Threat Models. • Enumerate cybersecurity threats by attack surface.

Fig. 2. A job description from the REWIRE dataset is mapped to separate K, S and T embeddings using CyberBridge. First, the job description is fed through an LLM to extract Knowledge, Skill, and Task descriptions (consistent with the NICE framework), then, these descriptions along with the original vacancy are passed through the sBERT model to extract embeddings. The K, S, and T embeddings can now be compared to the NICE work role KST embeddings.

vacancy-NICE work role pair, we compute the semantic similarity separately for Knowledge, Skill and Task embeddings. Every K, S, and T description in the vacancy is matched to the most semantically similar K, S, and T description contained in the work role using the cosine similarity between the corresponding sBERT embeddings. However, only samples exceeding the threshold τ contribute to the final score. The average of the best-match similarity scores quantifies how well the work role’s competencies align with those of the vacancy. Subsequently, the three category-level similarities are aggregated using predefined weights (wK , wS , and wT ):

Prompt Structure for KST Extraction System Prompt: You are an expert workforce ontologist and occupational data normalizer. Instructions: a. Carefully read the job description. b. Extract ALL distinct atomic statements. c. Each statement must express exactly ONE idea. d. NEVER mention the job title, company name, or role labels. e. ALL statements must be normalized into canonical form: - Knowledge must start with ’Knowledge of ...’ - Skills must start with ’Skill in ...’ - Tasks must start with a bare action verb. f. Convert narrative sentences into normalized form. g. Merge semantically identical items. h. Do NOT repeat equivalent statements using synonyms. i. Do NOT include any explanation or additional text. j. Return ONLY a newline-separated list of sentences. User Message Templates: #Job Description: {job_description} #Question: Extract all KNOWLEDGE statements. #Job Description: {job_description} #Question: Extract all SKILL statements. #Job Description: {job_description} #Question: Extract all TASK statements.

Fig. 3. Prompt used for DeepSeekV3 to extract KSTs from job descriptions, where {job description} is replaced with the actual job description.

This ensures that only KST items from the vacancy that are close enough to NICE KST descriptions contribute to the final similarity score. Unless specified otherwise, we set τ = 0.4. Then, to compare v and r, we compute: simCr→v (v, r) =

1 ∑ max⃗y∈Cv simτ (⃗x,⃗y) |Cr | ⃗x∈C r

(3)

Where C ∈ K, S, T denotes the competency category. For each

score(v, r) = wK SimKr→v (v, r)+wS SimSr→v (v, r)+wT SimTr→v (v, r) (4) This weighted sum yields an overall similarity score between vacancy v and NICE work role r. The role with the highest score is considered the best match for vacancy v. More generally, the function score(v, r) induces a ranking over all NICE work roles, reflecting their relative semantic proximity to the vacancy in the embedding space. This ranking-based interpretation enables downstream applications to consider the top-k most relevant roles rather than a single role. Such flexibility is desirable because cybersecurity positions typically span multiple NICE work roles, reflecting the diversity of competencies expected of professionals in practice. It is important to note that the labeled dataset used in this study is limited to 50 annotated samples. Since there are 41 distinct NICE work roles to differentiate, this equates to an

CyberBridge Embedding Space

NICE Framework Work Roles

Job Description Senior Cyber Security Engineer Reporting to the Cyber Security Team Lead, the Senior Cybersecurity Engineer will primarily focus on forensics, log management and threat modeling. The Cybersecurity Engineer is a seasoned professional, proactive self-starter who has strong problem-solving analytical skills with great attention to detail. The candidate must be comfortable working in a fast-paced, entrepreneurial, goal-oriented environment, emphasizes accountability for delivering results, and has hands-on experience with the latest security processes.

Communications Security (COMSEC) Management

Cybersecurity Policy and Planning

Cybersecurity Workforce Management

Cybersecurity Curriculum Development

Cybersecurity Instruction

Executive Cybersecurity Leadership

Cybersecurity Legal Advice

Privacy Compliance

Product Support Management

Program Management

Secure Project Management

Security Control Assessment

Systems Authorization

Systems Security Management

Technology Portfolio Management

Technology Program Auditing

Cybersecurity Architecture

Enterprise Architecture

Operational Technology Cybersecurity Engineering

Secure Software Development

Secure Systems Development

Software Security Assessment

Systems Requirements Planning

Systems Testing and Evaluation

Technology Research and Development

Data Analysis

Database Administration

Knowledge Management

Network Operations

Systems Administration

Systems Security Analysis

Technical Support

Defensive Cybersecurity

Digital Forensics

Infrastructure Support

Incident Response

Insider Threat Analysis

Threat Analysis

Vulnerability Analysis

Cybercrime Investigation

CyberBridge

Digital Evidence Analysis

Fig. 4. A birds-eye overview of CyberBridge. A job description is mapped onto the cyberbridge embedding space, where it can be linked to the closest NICE framework work roles. All NICE work roles are listed on the right-hand side, color-coded by category: ■ Oversight & Governance, ■ Design & Development, ■ Implementation & Operation, ■ Protection & Defense, and ■ Investigation.

average of just over one sample per role, rendering datadriven optimization of the weights wK , wS , and wT through k-fold cross-validation infeasible. Therefore, the determination of the optimal weights is considered outside the scope of this paper. Unless specified otherwise, the results presented here are generated using equal weights, i.e., wK = wS = wT = 13 . D. Quantitative Evaluation Methodology For quantitative evaluation, two human annotators labeled 25 vacancies with one or two NICE work roles, producing a dataset of 50 vacancies sampled equally from the REWIRE and LinkedIn datasets. CyberBridge’s performance is evaluated using three metrics commonly used in JRS research [12]: 1) Mean Reciprocal Rank (MRR): MRR reflects the position in the model’s ranking at which the annotator’s top label appears. For instance, an MRR of 1/2 indicates that the role selected by the annotator appears, on average, in the second position of the model’s ranking. MRR can take on a value between 0 and 1, where higher is better. MRR is computed as: MRR :=

1 N 1 ∑ rn , N n=1

(5)

where N is the total number of samples, 50 in our case, and rn is the rank of the annotator’s top label in the ranking generated by the model. 2) Top-3 accuracy (Top3): Top-3 accuracy measures whether the annotator label appears among the three highest-ranked roles predicted by the model: Top3 :=

1 N ∑ I(rn ≤ 3), N n=1

where I(·) denotes the indicator function. 3) Category Accuracy (Cat. Acc.): This metric evaluates whether the work role category of the annotator’s top label matches that of the model’s top prediction.

TABLE I C YBER B RIDGE ABLATIONS . M ETRICS WERE COMPUTED ON HUMAN - ANNOTATED DATA . Method

Components

Metrics

K

S

T

MRR

Top3

Cat. Acc.

✗ ✓ ✗ ✗ ✓

✗ ✗ ✓ ✗ ✓

✗ ✗ ✗ ✓ ✓

0.08 0.17 0.19 0.28 0.27

6 16 14 28 28

4 36 30 44 44

Ablations Description Ours K Ours S Ours T Ours (equal K/S/T)

IV. R ESULTS A. Performance Assessment Here, we evaluate the performance of CyberBridge by comparing different variants of our framework and several baselines with human annotator ground truth. TABLE II Z ERO - SHOT PERFORMANCE ON HUMAN - ANNOTATED DATA FOR SEVERAL BASELINE MODELS . Method

Metrics MRR

Top3

Cat. Acc.

N/A 0.14 0.36 0.39

2 7 33 37

20 24 42 50

Baselines Qwen2.5-7B-Instruct ChatGPT-4o-mini ChatGPT-5-mini DeepSeek-V3

We first analyze how the individual Knowledge, Skill, and Task components of CyberBridge influence its overall performance on human-labeled data. These component-wise evaluations, known as ablations, are presented in Table I. Firstly, we use CyberBridge without extracting KST-descriptions, where we directly map the overall vacancy description to a NICE work role description. As indicated for ‘Description’ in Table I, this approach performs poorly (Top3 = 6%, MRR = 0.08). This is likely due to the verbosity and redundancy of job

advertisements, compounded by the fact that sBERT was designed to process sentences rather than paragraphs of text. Basing the prediction on Knowledge, Skills, or Tasks yields stronger results: The Knowledge-only and Skill-only versions achieve Top3 scores of 16% and 14%, respectively, while Task-based matching achieves 28%. This makes sense, since task descriptions often provide the most concrete information about role requirements. Combining Knowledge, Skills, and Tasks with equal weighting yields a comparable performance. For reference, we also evaluate several state-of-the-art LLMs through zero-shot prompting. In the zero-shot setting, the model receives the job description together with a list of all NICE work roles and their summaries as listed in the NICE framework [9]. The model is then asked to rank the roles according to their relevance to the job description. It is important to note that it was not feasible to inform these zero-shot models of the full NICE framework, including all KST descriptions per work role, due to token length limits and the inability to attach external files in DeepSeek and Qwen’s APIs. We recommend that future work explores this avenue for OpenAI models, as their Responses API provides functionality for file inclusion up to 512 MB. Among the zero-shot baselines, DeepSeek-V3 [29] achieves the highest performance, reaching 37% Top3, 50% category accuracy and an MRR of 0.39. CyberBridge outperforms two out of four zero-shot baselines (ChatGPT-4o-mini and Qwen2.5-7B-Instruct) while being built a computationally efficient sBERT architecture that requires substantially fewer resources.However, a performance gap remains relative to DeepSeek-V3 and ChatGPT-5-mini. This gap may be partially explained by the human annotation process itself. Annotators reported that it took considerable effort to map a vacancy to the most appropriate work role. Due to the difficulty of this task, it is plausible that annotators relied primarily on high-level role understanding rather than conducting a detailed analysis of the underlying Knowledge, Skills and Tasks. In this case, the higher correspondence between LLM predictions and human judgments does not imply that zero-shot prompting leads to a deeper semantic understanding of vacancy-to-role mapping. CyberBridge, by contrast, grounds its predictions in KST descriptions, which offers interpretability (see Section IV-B) at the cost of lower agreement with human labels. B. Interpretability To illustrate how CyberBridge results in interpretable mappings, we consider Figure 4. This figure presents an illustrative two-dimensional projection of the high-dimensional sBERT embedding space, showing how NICE work roles can be related to a given vacancy using CyberBridge. The vacancy corresponds to the example previously analyzed in Figure 2. In practice, the similarity between a vacancy and a NICE job role is computed in the full 768-dimensional sBERT embedding space using the extracted KST embeddings. The twodimensional visualization is therefore intended only to convey the notion of relative proximity and how ranking of NICE work roles takes place. The work role embeddings depicted in

Figure 4 are derived from an actual t-SNE projection of the embedding space, whereas the position of the example vacancy (marked with an x) is illustrative and does not represent its exact geometric location in the original embedding space. This distinction is important since distances observed in the twodimensional visualization do not faithfully preserve the true distances from the full high-dimensional space. An initial observation that can be drawn from Figure 4 is that there is a clear clustering pattern within the embedding space. Work roles belonging to the same NICE workforce category tend to occupy nearby regions. Oversight & Governance roles appear predominantly at the extremes, Implementation & Operation roles are positioned more centrally, Design & Development roles cluster on the right-hand side, and Protection & Defense together with Investigation roles are located on the left. This spatial separation suggests that CyberBridge captures meaningful structural relationships within the NICE framework, as roles within the same category are represented closer to each other than to roles outside their category. In Figure 4, all NICE work roles are color-coded by work role category. The three highest-ranked roles for the example vacancy as computed by CyberBridge are Incident Response, Systems Security Analysis, and Executive Cybersecurity Leadership. Since CyberBridge is interpretable and white-box by design, it is possible to trace back which KST descriptions contributed most strongly to these assignments. For Incident Response, the vacancy Task Description ‘Support Cyber Security incidents as a tier 3 support’ most closely matched the NICE Task Description ‘Perform cyber defense incident triage’. For Executive Cybersecurity Leadership, the vacancy Knowledge Description ‘Knowledge of security by design principles’ played the largest role, aligning with ‘Knowledge of network security principles and practices’ in the corresponding NICE role. Similarly, for Systems Security Analysis, the vacancy Task Description ‘Document security architecture’ most closely matched the NICE Task Description ‘Document systems security activities’. This illustrates how competencylevel semantic alignment shapes the work role ranking. In contrast, explanations produced by DeepSeek-V3 largely restate the high-level summaries of the corresponding NICE work roles rather than pointing to specific competency-level alignments between the vacancy text and the NICE framework. For example, DeepSeek-V3 assigned Digital Forensics as the most related work role, and when prompted for an explanation, produced the following: ‘Direct match to ‘Perform forensic investigation in a case of an incident’ and ‘Hands-on experience with computer forensics’. Role involves analyzing digital evidence from security incidents.’ While this explanation may appear plausible, it is important to recognize that explanations generated by LLMs after a prediction are typically post-hoc rationalizations. They provide a justification for the output but do not necessarily reflect the internal reasoning process that led to the prediction. As such, the generated explanation cannot be taken as evidence that the classification was actually motivated by the factors stated in the explanation. Furthermore, a closer inspection of the explanation reveals

North America

Europe

Sample Density > 1,000 100–999 50–99 10–49 1–9 North American Job Categories 53.5%

European Job Categories 51.9%

26.4%

26.2% 10.6%

OG

8.6%

DD PD IO Total: 5,781 positions

6.7%

0.9%

IN

OG

11.9%

DD PD IO Total: 1,105 positions

3.3%

IN

Fig. 5. Sample Density of combined REWIRE and LinkedIn datasets, containing approximately 7,000 cybersecurity vacancies. The legend for the sample density is displayed on the right. The overall distribution of work role categories for North America and Europe are depicted in the bottom of the figure.

that the reasoning primarily reiterates sentence segments from the vacancy description that include the word ‘forensics’, rather than explaining why the competencies required for the vacancy align with the competencies associated with the Digital Forensics role in the NICE framework. Consequently, the explanation largely paraphrases information already present in the input information, making it only superficially explanatory instead of providing meaningful reasoning about competencylevel alignment. This limitation is expected, as DeepSeek only has access to the short summary statement of the role, being ‘Responsible for analyzing digital evidence from computer security incidents to derive useful information in support of system and network vulnerability mitigation.’, lacking detailed knowledge of what the work role entails in terms of KST. C. Job demand per region Next, we examine how CyberBridge can be used to identify regional differences in cybersecurity workforce demand. As a proof of concept, CyberBridge was applied the combined REWIRE and LinkedIn dataset. The geographic distribution of this dataset is depicted in Figure 5. To analyze regional demand, we estimated the prevalence of each NICE work role category at the continental level for North America and Europe. Other regions were excluded due to insufficient sample sizes, as the dataset contained only 55 vacancies from Australia and a single vacancy from Afghanistan. The resulting distribution of work role categories is shown in the bottom-left (North America) and middle-left (Europe) panels of Figure 5. The results suggest that Protection and Defense and Investigation roles are more prevalent in Europe, whereas Implementation and Operation roles appear more prominent in the North American job market. This illustrates how CyberBridge can be used to explore regional differences in workforce demand, thereby addressing RQ2. Several considerations should be taken into account when interpreting these results. The dataset used in this analysis

constrains the extent to which conclusions about current workforce demands can be drawn, both because of its modest size (≈ 7, 000 vacancies) and because most postings were collected between 2022 and 2024. Consequently, these results should be interpreted primarily as a proof of concept demonstrating the methodological feasibility of CyberBridge for regional workforce analysis, rather than as an accurate representation of the present-day cybersecurity labor market. D. Case study: Curriculum planning with CyberBridge We now address RQ3 by illustrating how CyberBridge can support curriculum planning by linking curricula to labor market demand. To demonstrate this, we consider the following case study. After completing the mandatory components of her MSc degree in Cybersecurity at Nanyang Technological University, Eve is preparing for a career in Europe. Which electives should she take in her final semester to best position herself for the European cybersecurity job market? The overall workflow is illustrated in Figure 6. We begin by examining the core component of the NTU curriculum, which consists of the courses ‘Computer Security’, ‘Application Security’, ‘Cryptography’, and ‘Security & Risks Management’. The goal of this case study is to identify a set of electives such that the resulting curriculum aligns as closely as possible with the requirements of the European cybersecurity job market. Following CurricuLLM [10], we adopt Knowledge Areas as a common frame of reference between the curriculum and the job market. KAs represent cybersecurity competency domains relevant to university education, as defined in the CSEC2017 framework [23]. For example, the mandatory NTU courses contain a relatively large contribution of Data Security, while placing less emphasis on Human and Societal Security, which is consistent with the technical focus suggested by the titles. Next, we estimate the KA distribution required by the European cybersecurity labor market. To this end, all 1,105 European vacancies from the combined REWIRE and LinkedIn dataset are processed using CyberBridge (top left of the

European Cybersecurity Vacancies European NICE Role distribution Senior Cybersecurity Engineer Reporting to the Cyber Security Information Security TeamChief Lead, the Senior CybersecurityOfficer Engineer will primarily foCyber Operation Security Consultant TP forensics, Global Ltd (trading cus on log management career Cybersecurity underAmodeling. the within name Truphone and and threat The CybersePrivacy servicesis will provide you a UK curitywww.truphone.com) Engineer is a seasoned pro-based the opportunity to help our but with globally active, specialized fessional, proactive self-starter who clients implement an effective cytelecommunications services has strong problem-solving analytbersecurity programme that protects thatgreat has MVNO licenses ical provider skills with attention to threats,and propels transforma9against countries detail.in The candidate must be operations comtion,countries. and drives As comin working 15 It growth. is aen-world fortable in a fast-paced, toward arecorded digital busileaderpanies in pivot providing trepreneurial, goal-oriented environnesscommunication model, exponentially more data services ment,mobile emphasizes accountability for to is generated and shared among orregulated financial delivering results, and hasinstitutions hands-on and ganisations, partners and counts the world’s largest and customers. most experience with the latest security We play an integral role in helpprestigious financial institutions processes. Responsibilities Collabo- like ing our clientsJPensure they are proGoldman rate with senior Sachs, managementMorgan across and tected by developing HSBC astoits clients. security In transformation addition, the company prioritize strategies focusedcore on security, Truphone provides mobile effiinitiatives. Establish control-related ciently integrate and manage new communications services processes/procedures while workingto a or existing technology systems to number of multinational businesses towards building relevant security deliver continuous likeand Netflix and Tesla operational and IoT immetrics dashboards provements and increase connectivity solutions to over their 20 cybersecurity million devices. investment, and detect, respond, and remediate threats.

Security Control Assessment = 31%

Cybersecurity Architecture = 9%

Required KA profile Systems Security Management = 8%

CyberBridge

CurricuLLM Defensive Cybersecurity = 5%

6 6

18 8

32

.. . Technology Program Auditing = 0%

Completed NTU courses

KA Legend: • Miscellaneous • Data • Software • Component • Connection • System • Human • Organizational • Societal

36 9 12

Secure Systems Development = 7%

10

2 9 28

5 9

15

16 4 4

14

Total curriculum

26

Mandatory Courses: • Computer Security • Application Security • Cryptography • Security & Risks Management

Choose 4 electives

4 4

9 10

30

Selected Courses: • Network Security • Security Monitoring & Threat Detection • Topics in Crypto & Cybersecurity • Blockchains & Cryptocurrency

Fig. 6. Procedure taken for the Case Example. All European cybersecurities included in our dataset are passed through CyberBridge to compute the prevalence of each NICE work role. Then, through CurricuLLM, the required distribution of Knowledge Areas for a European job is computed (top right). In the bottom of the figure, we illustrate how Eve can sample her curriculum at NTU such that the total curriculum matches the required KA profile as closely as possible.

figure). For each vacancy, CyberBridge selects the most relevant NICE work role, which are subsequently aggregated to estimate the overall demand for NICE roles in the European cybersecurity job market (top middle). We then employ Table E.15 from CurricuLLM [10] to translate NICE roles into a desired Knowledge Area distribution. By weighting the KA distributions associated with each NICE role according to the demand estimated by CyberBridge, we obtain an aggregated KA profile reflecting current labor market demand. This profile is visualized as a pie chart on the right side of Figure 6, with the KA color coding shown at the bottom left. When comparing the required KA profile with the KA distribution of the core NTU curriculum, it appears that the core curriculum places relatively strong emphasis on Data Security, while Connection Security is comparatively underrepresented. To address this gap, we perform an exhaustive search over all electives listed in the official NTU curriculum [30] to identify the combination of courses that, together with the core curriculum, most closely matches the required KA profile. The resulting curriculum (depicted on the bottom right) demonstrates improved alignment with the European workforce demand as expressed through the required KA profile. In particular, the selected electives ‘Network Security’, ‘Security Monitoring & Threat Detection’, ‘Topics in Crypto and Cybersecurity’, and ‘Blockchain & Cryptocurrency’ increase coverage of Connection Security while reducing the dominance of Data Security. However, the Miscellaneous KA remains underrepresented due to limited course availability, suggesting that this competency area could be addressed through electives

offered outside the standard degree programme. By using CyberBridge, Eve’s curriculum has become more closely aligned with the competency profile demanded by the European cybersecurity market. This case study illustrates how CyberBridge can be combined with CurricuLLM to translate market demands into actionable curriculum recommendations. V. D ISCUSSION Limitations and opportunities for future work are: Data Collection. Pairing CyberBridge with current workforce data represents an important direction for future work. In particular, the methodology described in Section IV-C could be applied larger and more recent datasets. One approach would be to automatically collect job advertisements that are currently online by scraping platforms such as LinkedIn, or official government job portals e.g., USAJobs. Continuous data collection would make it possible to analyze temporal trends in cybersecurity workforce demand. For instance, this would enable monitoring how demand for specific NICE work roles evolves over time. An additional validation opportunity would be to attempt to replicate the statistics reported by CyberSeek [31], which provides detailed U.S. demand estimates per NICE work role and category. Human Evaluation. Further human evaluation would strengthen the empirical validation of CyberBridge. Most importantly, these expert annotations could be used to assess CyberBridge’s capabilities in mapping job advertisements to NICE work roles with greater confidence. This would also enable empirically determining optimal values for the weights

wK , wS , and wK , as well as the similarity threshold τ, which could lead to a more accurate and robust pairing. Job Recommendation. While the current methodology provides the foundation for CyberBridge as a Job Recommendation System, realizing this potential requires implementing CyberBridge as a tool and conducting user evaluation. In particular, the approach described in Section IV-D could allow students to filter cybersecurity vacancies in real time based on NICE role preferences or competencies from their curriculum. This would enable evaluation of user experience and CyberBridge’s effectiveness in supporting career planning. VI. C ONCLUSION The paper introduced CyberBridge, an ontology-based framework that connects cybersecurity job advertisements, workforce frameworks, and academic curricula. By leveraging the Knowledge, Skill and Task descriptions of the NICE framework together with the semantic similarity-based sBERT model, CyberBridge enables interpretable mappings between vacancies and standardized cybersecurity work roles (RQ1). We further demonstrated how CyberBridge can support labor market analysis by identifying differences in the prevalence of NICE work role categories across geographic regions (RQ2). While these results should be interpreted as a proof of concept, they illustrate how the framework can be used to explore trends in the cybersecurity job market. Finally, by integrating CyberBridge with the CurricuLLM framework, we showed how labor market insights can be linked to academic curricula (RQ3), supporting curriculum planning and career guidance for cybersecurity students. Overall, CyberBridge provides a practical foundation for bridging the gap between cybersecurity education and workforce needs. R EFERENCES [1] B. Guembe, A. Azeta, S. Misra, V. C. Osamor, L. Fernandez-Sanz, and V. Pospelova, “The emerging threat of ai-driven cyber attacks: A review,” Applied Artificial Intelligence, vol. 36, no. 1, p. 2037254, 2022. [2] D. Dave, G. Sawhney, P. Aggarwal, N. Silswal, and D. Khut, “The new frontier of cybersecurity: emerging threats and innovations,” in 2023 29th International Conference on Telecommunications (ICT), pp. 1–6, IEEE, 2023. [3] F. Teichmann, S. R. Boticiu, and B. S. Sergi, “The evolution of ransomware attacks in light of recent cyber threats. how can geopolitical conflicts influence the cyber climate?,” International Cybersecurity Law Review, vol. 4, no. 3, pp. 259–280, 2023. [4] ISC2, “2025 ISC2 cybersecurity workforce study.” [5] S. AlDaajeh, H. Saleous, S. Alrabaee, E. Barka, F. Breitinger, and K.K. Raymond Choo, “The role of national cybersecurity strategies on the improvement of cybersecurity education,” Computers & Security, vol. 119, p. 102754, 2022. [6] B. J. Blažič, “Changing the landscape of cybersecurity education in the EU: Will the new approach produce the required cybersecurity skills?,” Education and Information Technologies, vol. 27, no. 3, pp. 3011–3036, 2022. Available online 2021. [7] C. Catal, A. Ozcan, E. Donmez, and A. Kasif, “Analysis of cyber security knowledge gaps based on cyber security body of knowledge,” Education and Information Technologies, vol. 28, no. 2, pp. 1809–1831, 2023. [8] S. Ramezanian and V. Niemi, “Cybersecurity education in universities: A comprehensive guide to curriculum development,” IEEE Access, vol. 12, pp. 61741–61766, 2024. [9] NIST, “Nice workforce framework for cybersecurity (nice framework) v2.0.0..” https://niccs.cisa.gov/tools/nice-framework, 2025. Accessed: 2025-09-17.

[10] A. Nijdam, H. Kähkönen, V. Niemi, P. S. Wagner, and S. Ramezanian, “Curricullm: Designing personalized and workforce-aligned cybersecurity curricula using fine-tuned llms,” 2026. [11] N. Reimers and I. Gurevych, “Sentence-bert: Sentence embeddings using siamese bert-networks,” arXiv preprint arXiv:1908.10084, 2019. [12] D. Çelik Ertuğrul and S. Bitirim, “Job recommender systems: a systematic literature review, applications, open issues, and challenges,” Journal of Big Data, vol. 12, no. 1, p. 140, 2025. [13] H.-C. Chang, C.-Y. Wang, and S. Hawamdeh, “Emerging trends in data analytics and knowledge management job market: extending ksa framework,” Journal of Knowledge Management, vol. 23, no. 4, pp. 664– 686, 2019. [14] S. Jia, X. Liu, P. Zhao, C. Liu, L. Sun, and T. Peng, “Representation of job-skill in artificial intelligence with knowledge graph analysis,” in 2018 IEEE symposium on product compliance engineering-asia (ISPCECN), pp. 1–6, IEEE, 2018. [15] Y. Kang and A. D. Ritzhaupt, “A job announcement analysis of educational technology professional positions: Knowledge, skills, and abilities,” Journal of Educational Technology Systems, vol. 43, no. 3, pp. 231–256, 2015. [16] L. Fernández-Sanz, J. Gómez-Pérez, and A. Castillo-Martı́nez, “e-Skills Match: A framework for mapping and integrating the main skills, knowledge and competence standards and models for ICT occupations,” Computer Standards & Interfaces, vol. 51, pp. 30–42, 2017. [17] P. Dzurenda, S. Ricci, M. Sikora, M. Stejskal, I. Lendák, and P. Adão, “Enhancing cybersecurity curriculum development: Ai-driven mapping and optimization techniques,” in Proceedings of the 19th International Conference on Availability, Reliability and Security, pp. 1–10, 2024. [18] F. A. Bachtiar, F. Pradana, and R. D. Yudiari, “Employee recruitment recommendation using profile matching and naı̈ve bayes,” in 2019 International Conference on Sustainable Information Engineering and Technology (SIET), pp. 94–99, IEEE, 2019. [19] K. Bothmer and T. Schlippe, “Investigating natural language processing techniques for a recommendation system to support employers, job seekers and educational institutions,” in International Conference on Artificial Intelligence in Education, pp. 449–452, Springer, 2022. [20] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), pp. 4171–4186, 2019. [21] D. A. Tamburri, W.-J. Van Den Heuvel, and M. Garriga, “Dataops for societal intelligence: a data pipeline for labor market skills extraction and matching,” in 2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI), pp. 391–394, IEEE, 2020. [22] Q. Li and C. Lioma, “Joint extraction and classification of danish competences for job matching,” in European Conference on Information Retrieval, pp. 475–483, Springer, 2023. [23] JTF, “Curriculum guidelines for post-secondary degree programs in cybersecurity.” https://cybered.hosting.acm.org/wp/, 2017. Accessed: 2025-09-17. [24] A. Rashid, H. Chivers, G. Danezis, and E. Lupu, “The cyber security body of knowledge.” [Online], 2019. Accessed: Jan. 1, 2024. [25] S. Ricci, M. Sikora, S. Parker, I. Lendak, Y. Danidou, A. Chatzopoulou, R. Badonnel, and D. Alksnys, “Job adverts analyzer for cybersecurity skills needs evaluation,” in Proceedings of the 17th International Conference on Availability, Reliability and Security, pp. 1–10, 2022. [26] REWIRE, “Rewire: Cybersecurity skills alliance - a new vision for europe,” 2020. [27] Asaniczka, “1.3m linkedin jobs & skills (2024),” 2024. [28] A. A. Nijdam, “GitHub – PyTorch code repository CyberBridge.” https: //anonymous.4open.science/r/CyberBridge-6A34, 2026. Last accessed on 2026-06-15. [29] A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, C. Zhang, C. Ruan, and D. Dai, “Deepseek-v3 technical report.” arXiv:2412.19437. Available at: https://arxiv.org/pdf/2412.19437 (Accessed: 2025-11-28), 2024. [30] Nanyang Technological University, “Master of science in cyber security (mscs).” https://www.ntu.edu.sg/education/graduate-programme/ master-of-science-in-cyber-security-(mscs), 2025. Accessed: 2025-0517. [31] Cyberseek, “Cybersecurity supply/demand heat map.” https://www. cyberseek.org/heatmap.html, 2024. Accessed: 2025-11-14.

Related documents

• DESIGNING CYBERSECURITY CURRICULUM: EXPLORING THE NEED FOR INDUSTRY CERTIFICATIONS AND EXPERIENTIAL LEARNING#199322
• Cybersecurity education: Evolution of the discipline and analysis of master programs#199251
• Cybersecurity Awareness Framework for Academia#671631
• Want to Raise Cybersecurity Awareness? Start with Future IT Professionals.#199352
• Cybersecurity activities for education and curriculum design: A survey#199277