Security, Privacy & GRC - Security
Security Trainer
IC / Practitioner
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a defined area of the function and the outcomes it produces.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- Vulnerability & Cloud Posture
- Learning & Development (LMS)
- Content & Asset Management (CMS/DAM)
- Analytics & BI
- HRIS & Payroll
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Design and run phishing-simulation campaigns tuned to each audience - realistic and fair, with a teaching moment built into the click, not a gotcha
- Analyze simulation results by group and drive just-in-time coaching for clickers and recognition for reporters, not punishment
- Build and deliver role-based, story-driven training curricula people remember, replacing generic annual modules
- Own security onboarding - the day-one habits (phishing reporting, MFA, data handling) that set new hires up right
- Run behavior-change campaigns (reporting, MFA adoption, BEC awareness) end to end: message, channels, reinforcement, success metric
- Report behavior-change metrics to leadership - report rate and real-click trend, not a completion dashboard - and make the culture ask
- Map completion and training records to compliance requirements as evidence
- Partner with HR and leadership on consequences, onboarding integration, and modeling security from the top
The essence of this seat
The Security Trainer owns the human layer of security - turning employees from the most-targeted attack surface into an active line of defense.
Signature move
Name the target behavior and its metric before you build anything. The first move on any request is to pin the one behavior you want to change (report faster, stop clicking, adopt MFA) and how it will be measured - report rate and real-click trend, never completion percentage. An asset with no behavior and no metric attached is activity, not the job
What good looks like
reads report rate and time-to-report over the headline click rate, treats the group spike as a targeting signal for a tuned role-based follow-up, coaches clickers supportively and recognizes reporters at the group level, refuses a name-and-shame list, and hands the consequence question to HR rather than owning it
Decision rights
- - curriculum design, simulation cadence and difficulty, content and messaging, and how results are coached
Working vocabulary
What this role does
The Security Trainer owns the human layer of security - turning employees from the most-targeted attack surface into an active line of defense. They run phishing simulations, build and deliver training, own security onboarding, and drive the campaigns and culture that make secure behavior the default. The measure of the job is never "training delivered"; it is behavior changed - fewer people clicking real phishing, more people reporting it fast, and secure habits that hold up under a real attack. What separates great from average is measurable behavior change and culture, not activity. A mediocre trainer ships the mandatory annual module and reports a completion percentage. A great one moves the report rate up and the real-click rate down, coaches clickers instead of shaming them, writes content people actually remember, and gets leadership to model and fund security as everyone's job. The work is equal parts security knowledge and communication/education craft, plus data.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.