Hiring and team building Incident Handling: Field Guide
RCCE students will learn cybersecurity workforce planning, recruitment, interviewing, and retention strategies for building high-performing security teams. RCCE students will learn to define cybersecurity job roles using frameworks like NICE/NIST, write effective job descriptions, evaluate candidate technical and soft skills, design practical interview assessments, navigate security clearance requirements, develop onboarding programs for new security hires, build career development paths that retain talent, manage diverse and distributed security teams, and address the cybersecurity talent shortage through alternative hiring pipelines. This incident response course prepares students to act decisively during security incidents with structured workflows and clear decision frameworks. Starting from foundational concepts, RCCE students will learn containment, evidence collection, eradication, and recovery procedures specific to this domain. Students practice incident scenarios that build the composure, coordination, and documentation skills essential for effective incident handling.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Hiring and team building Incident Handling: Field Guide
- Execute hands-on tasks for hiring & team building
- Execute hands-on tasks for incident handling
- Explain Advanced • Leadership Track • 7 Modules • Foundations fundamentals
- Explain Course Overview fundamentals
- Execute hands-on tasks for workforce & team building — covering Cybersecurity workforce planning strategies, NICE/NIST framework role definitions.
- Execute hands-on tasks for structured ir workflows and playbooks — covering Containment and evidence collection.
- Execute hands-on tasks for build elite teams — covering Source, assess, and retain top.
- Execute hands-on tasks for respond decisively — covering Execute structured containment, Preserve forensic evidence.
- Execute hands-on tasks for lead under pressure — covering Coordinate distributed teams, Apply decision frameworks in.
- Execute hands-on tasks for the cybersecurity talent landscape
- Execute hands-on tasks for global unfilled positions
- Execute hands-on tasks for annual workforce growth
| Module 01 | Hiring & Team Building |
| Module 02 | Incident Handling |
| Module 03 | Advanced • Leadership Track • 7 Modules • Foundations |
| Module 04 | Course Overview |
| Module 05 | Workforce & Team Building |
| Module 06 | Structured IR workflows and playbooks |
| Module 07 | Build Elite Teams |
| Module 08 | Respond Decisively |
| Module 09 | Lead Under Pressure |
| Module 10 | The Cybersecurity Talent Landscape |
| Module 11 | Global Unfilled Positions |
| Module 12 | Annual Workforce Growth |
| Module 13 | Median Senior Salary |
| Module 14 | Teams Report Shortages |
All hands-on labs run on Rocheston Rose X OS. Students practice hiring and team building incident handling: field guide by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for hiring & team building
- Lab 2: Execute hands-on tasks for incident handling
- Lab 3: Explain Advanced • Leadership Track • 7 Modules • Foundations fundamentals
- Lab 4: Explain Course Overview fundamentals
- Lab 5: Execute hands-on tasks for workforce & team building
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Hiring and team building Incident Handling: Field Guide, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI