Learn / Careers in cybersecurity
Cybersecurity certifications roadmap
Which certifications help at each stage of a security career, from Network+, Security+ and ISC2 CC to CySA+, OSCP and CISSP, and how to decide which are worth your money.
Do you need certifications?
Certifications are not required to work in security, and they do not replace hands-on skills. They do help in three ways: they give structure to your learning, they get your resume past automated filters and HR screens, and some employers and government contractors require specific ones for certain roles.
The best approach is to treat a certification as a milestone on a learning path, not a goal in itself. Pair each one with practical labs so you can talk about what you have done, not just what you memorized.
Exam prices, versions and requirements change regularly, and vary by country. Always check current details on the official CompTIA, ISC2, ISACA, OffSec and GIAC websites before you buy anything. Watch for discounted student and voucher offers there too.
The roadmap at a glance
| Stage | Certification | Provider | Focus | Experience expected |
|---|---|---|---|---|
| Foundation | CompTIA Network+ | CompTIA | Networking fundamentals | None formally required |
| Foundation | ISC2 Certified in Cybersecurity (CC) | ISC2 | Broad entry-level security concepts | None |
| Foundation | CompTIA Security+ | CompTIA | Core security knowledge; widely requested in job posts | None formally required; some IT experience helps |
| Intermediate | CompTIA CySA+ | CompTIA | Security analysis, monitoring, incident response | A few years of IT or security recommended |
| Intermediate | GIAC certifications (for example GSEC, GCIH) | GIAC / SANS | Practical, specialized topics | Varies; training is usually costly |
| Hands-on offensive | OSCP | OffSec | Penetration testing in a timed practical exam | Strong Linux, networking and scripting skills |
| Advanced | CISSP | ISC2 | Broad security management and architecture | Five years of paid experience in its domains (with some substitutions) |
| Advanced | CISM | ISACA | Security management and governance | Five years of experience, including management |
| Cloud | CCSP, or AWS, Azure and Google Cloud security certs | ISC2 and cloud providers | Securing cloud platforms | Cloud experience recommended |
Foundation level
Network+ is useful if networking is new to you, because so much of security depends on it. Some people skip it and learn networking through free courses instead.
ISC2 Certified in Cybersecurity (CC) is a beginner certification covering security principles, access control, network security, incident response and security operations. ISC2 has offered free online training and exam vouchers for it through outreach programs; check the ISC2 site for what is currently available.
Security+ is one of the most commonly requested entry-level security certifications in job postings, especially in the US public sector and among government contractors. It covers threats, architecture, operations and governance at a broad level.
Free study resources exist for many entry exams, including official exam objectives (download them from the vendor), free video series and practice questions from reputable instructors. Avoid "brain dump" sites that sell leaked exam questions; using them violates exam rules and can get a certification revoked.
Intermediate and specialist
Once you have a job or solid lab experience, choose certifications that match your direction:
- Defense and SOC work: CySA+, or GIAC certifications such as GCIH for incident handling.
- Penetration testing: OSCP is respected because the exam is practical and hands-on. Other vendors offer practical exams too.
- Cloud: provider security certifications from AWS, Microsoft and Google, or ISC2's CCSP.
- Governance and audit: ISACA's CISA (auditing) and CISM (management), or CompTIA's and ISC2's GRC-focused options.
Advanced
CISSP is widely recognized for senior and management roles. It requires years of relevant experience; candidates who pass without enough experience can become an "Associate of ISC2" while they earn it. Most advanced certifications also require annual fees and continuing education credits to stay active.
Choosing wisely
- Start from the job you want. Search real job postings in your area and note which certifications appear most often.
- Check whether your employer pays. Many companies cover exam and training costs.
- Do not collect certifications for their own sake. Two relevant certifications plus a strong portfolio beat a long list of unrelated ones.
- Budget for renewals, including maintenance fees and continuing education.
For hands-on practice to go with your studies, see free learning resources and home labs.