Table of Contents

1. Purpose and Scope
2. What a Job Family Is
3. The Five CERG Job Families
4. Family-to-Family Career Lattice
5. Why Five Families Instead of Three
6. Job Levels Within Each Family
7. How Levels Interact With CERG’s Grade Framework
8. Level Progression Gates
9. Per-Family Level Definitions
10. Document Control

1. Purpose and Scope

This document establishes the formal Job Family structure for CERG’s workforce architecture. It groups the 27 canonical CERG roles into five job families, defines career progression tiers within each family, and maps those tiers to CERG’s existing grade framework (S1-S4 / M1-M4).

This document does NOT rename, add, or remove canonical roles. The authoritative role roster remains OM-001 §6.1. Job families are a VIEW into the role architecture — a career-development and hiring lens — not a replacement for the operating model’s pillar structure.

1.1 Workforce System Map

Use the workforce documents in this order:

2. What a Job Family Is

A Job Family is a grouping of similar roles that share a core competency profile, career progression path, and broad functional purpose. Job families enable:

• Career tracks. A person can see: “I am in the Security Engineering family. From here I can progress to Advisor, Sr. Advisor, or laterally to the Risk Operations family.”
• Hiring clarity. Requisitions are opened against a family, a level, and a specific role. HR and compensation can calibrate within and across families.
• Training alignment. Certification and training pathways are defined per family, not per role.

3. The Five CERG Job Families

4. Family-to-Family Career Lattice

                    ┌──────────────────────────────────────┐
                    │         JF-EXEC (CISO)               │
                    │  Entry: Executive | Terminal: Exec    │
                    └──────────────────────────────────────┘
                                      ▲
          ┌───────────────────────────┼───────────────────────────┐
          │                           │                           │
┌─────────┴─────────┐     ┌──────────┴──────────┐     ┌──────────┴──────────┐
│  JF-SECENG        │     │   JF-RISKOPS         │     │   JF-GOVCOMP        │
│  Security Eng.    │◄───►│   Risk Operations    │◄───►│   Governance &       │
│  S1→S4            │     │   S1→S4/M3           │     │   Compliance        │
│                    │     │                      │     │   S1→S4/M3          │
└─────────┬─────────┘     └──────────┬───────────┘     └──────────┬──────────┘
          │                           │                           │
          └───────────────────────────┼───────────────────────────┘
                                      │
                          ┌───────────┴───────────┐
                          │   JF-ADJUNCT           │
                          │   Incident Response    │
                          │   S2→S4/M4             │
                          └───────────────────────┘

Left-right arrows (◄──►) indicate encouraged cross-family movement. Vertical arrows indicate progression toward executive leadership. CERG’s existing “Left-Right Knowledge Model” (FRM-001 §9.2) and cross-training expectations (OM-001 §10.4) are the operational mechanisms that make this lattice real.

5. Why Five Families Instead of Three

The current three-pillar structure (Engineering, Risk, Governance) works well for the operating model but conflates functional grouping with career grouping:

• Engineering Pillar maps cleanly to JF-SECENG (one family = one pillar). No change needed.
• Risk Pillar contains two distinct functional families: JF-RISKOPS (exposure management, threat intel, detection — operations work) and adjacent roles that are more incident-response-oriented (JF-ADJUNCT). The current structure puts Detection Engineer and Threat Intelligence Analyst in the same pillar as Vendor Risk Analyst, but their day-to-day work, certifications, and career paths differ significantly. This proposal keeps them in the same pillar operationally but gives them distinct family designations for career development.
• Governance Pillar maps cleanly to JF-GOVCOMP (one family = one pillar). No change needed.

The distinction between JF-RISKOPS and JF-ADJUNCT is important: Incident Commander and Lead Investigator are NOT CERG roles (they belong to the standing IR team per CERG-GOV-OM-001 §3.4). They appear in CERG documents only for cross-functional clarity. Giving them their own family makes this boundary explicit in the career architecture.

6. Job Levels Within Each Family

Each Job Family has 4 tiers that map directly to CERG’s existing SME grade structure (S1-S4) and Management grade structure (M1-M4). This section defines what each tier means WITHIN each family — providing family-specific expectations that a hiring manager and a team member can reference without consulting multiple documents.

See Section 9 for per-family level definition tables.

7. How Levels Interact With CERG’s Grade Framework

The Job Family levels (L1-L4) are a VIEW into the grade framework, not a replacement for it. Think of them as:

• CERG Grades (S1-S4, M1-M4) = the internal calibration standard used by HR, compensation, and promotion panels. These are precise, defined in JA-001, and carry compensation bands.
• Job Family Levels (L1-L4) = the external-facing and career-development language. These appear in job postings, career conversations, and succession plans.

The mapping is:

Job Family Level  |  SME Track Grade  |  Management Track Grade
L1               |  S1               |  N/A
L2               |  S2               |  N/A
L3               |  S3               |  M1-M2
L4               |  S4               |  M3-M4

An “L3 Security Engineer” could be an S3 Advisor (SME track) or an M1 Manager (Management track). The external title is the same; the internal grade reflects whether their primary contribution is through individual expertise or people leadership.

8. Level Progression Gates

Progression from one level to the next requires demonstration of capabilities. The gates below define what a promotion case must show. These supplement (not replace) the JA-001 grade definitions and CMP-001 behavioral anchors.

8.1 L1 → L2 Gate (All Families)

• Has completed at least one full cycle of the family’s core process (e.g., for JF-SECENG: a project from intake to go-live; for JF-GOVCOMP: a compliance cycle from preparation to audit close)
• No longer needs direction on daily work
• Has identified and corrected at least one process gap or documentation error
• Peer feedback confirms reliability

8.2 L2 → L3 Gate (All Families)

• Has led at least one cross-pillar initiative or authored/revised a standard or procedure
• Has formally mentored at least one L1 or L2 team member (documented in PERF-001)
• Has represented the pillar in at least two cross-functional forums or engagements
• Manager confirms self-direction against objectives

8.3 L3 → L4 Gate (All Families)

• Has contributed to CISO-level decisions (documented: strategy input, risk assessment, budget recommendation)
• Has mentored across pillars, not just within the home pillar
• Has represented the organization externally (conference, regulatory forum, industry working group, publication)
• Peer pillar leaders confirm cross-organizational influence
• For JF-SECENG specifically: has authored at least one standard or reference architecture adopted organization-wide
• For JF-RISKOPS specifically: has led an organization-wide risk posture assessment
• For JF-GOVCOMP specifically: has represented the organization to an external auditor or regulator without supervision

9. Per-Family Level Definitions

9.1 JF-SECENG — Security Engineering Levels

9.2 JF-RISKOPS — Risk Operations Levels

9.3 JF-GOVCOMP — Governance & Compliance Levels

9.4 JF-EXEC — Executive Leadership Levels

9.5 JF-ADJUNCT — Incident Response Levels

10. Document Control

Revision History

Review Triggers

• Addition or retirement of a canonical role in CERG-GOV-OM-001 §6.1
• Change to the NICE Workforce Framework affecting CERG role mappings
• Revision to JA-001 grade definitions
• Direction from the CISO

Governance owns this document. The Governance Pillar Leader (Policy & Standards) is responsible for initiating reviews, managing the revision cycle, and obtaining approval for all changes.

Related Documents

Source: roles/CERG-GOV-JF-001_Job_Families_Overview.md · Download .md · View on GitHub