Certifications: what employers ask for, and when

Start with the job posting

Pick your target role first. Each Pathway Finder role guide lists its starter and later certifications. Then read five current postings for that role, and note which certifications they require and which they only prefer.

Experience counts as much as certificates at entry level. In a 2025 ISC2 survey of 929 hiring managers in six countries, 90% would consider entry- and junior-level candidates whose only background was IT work experience. 89% would consider candidates with only entry-level certifications^[1]. Build your portfolio alongside your first exam.

Entry certifications

Pick one Security+ version and study only for it. SY0-701 stays available in English until June 11, 2027, and SY0-801 adds objectives on risks in AI systems, models, prompts and data exposure^[3].

ISC2 ended its free One Million Certified in Cybersecurity program on May 20, 2026. If you hold an unexpired free code, you must take the exam by December 31, 2026^[5].

Cloud certifications

Start with a fundamentals exam for the cloud your target employers name in their postings. Microsoft offers academic pricing once you verify your student status in your Microsoft Learn profile, before you pay^[13].

Save the specialty and professional exams until you have built and secured real workloads. Microsoft's SC-500 exam leads to the Cloud and AI Security Engineer Associate credential^[14]. AWS has used exam SCS-C03 since December 2, 2025^[9].

Security operations certifications

CySA+ suits security operations center (SOC) and vulnerability analyst roles, and CompTIA recommends about four years of experience in them^[15]. Treat it as a second certification.

Splunk (now part of Cisco) is a log search and security information and event management (SIEM) platform^[18]. If postings for your target role name Splunk, its certifications show that you can search and investigate in it.

Offensive security certifications

PEN-200 (Penetration Testing with Kali Linux) leads to the OSCP+ certification, which expires after three years. Passing also earns the OSCP, which does not expire^[21]. OffSec's Learn One subscription costs US$2,749 a year, and full-time college students can get up to 10% off it^[20].

That is a lot of money for a hard exam. Build your skills on free platforms first, and buy the course when the free material feels easy.

Later, with experience

You can pass the Certified Information Systems Security Professional (CISSP) exam before you have the experience and become an Associate of ISC2. You then have six years to earn the five years of experience. A degree in computer science, IT or a related field can count for one year, and paid or unpaid internships count as experience^[23].

Avoid paying for advanced certifications yourself before you have the experience they assume. Once you have a security job, ask whether your employer has a training budget that covers them.

Student discounts

• CompTIA. Verify your student status through SheerID to get academic pricing^[25].
• ISC2 Candidate. The first year is free, then US$50 a year. It includes 10% off ISC2's official online self-paced training^[26].
• Microsoft. Academic exam pricing after you verify your student status^[13].
• OffSec. Up to 10% off Learn One for full-time college students^[20].
• ISACA. Student membership is US$25 a year plus local chapter dues^[27].

Ask your department about vouchers before you pay full price.

If you target defense jobs: DoD 8140

Department of Defense (DoD) cyber positions follow DoD Manual 8140.03, which took effect on February 15, 2023 and replaced the old DoD 8570.01-M^[28]. Positions are coded to work roles, and a certification is one of several ways to qualify^[29]. Security+ was one of the first certifications approved^[30]. Check the qualification matrix for your target work role before you buy a voucher^[31].

See Working in government or defense for clearances.

Related Pathway Finder roles

Each role guide covers the work, the realistic first job, starter certifications and free practice.

Sources

We checked each source in October 2026. Rules, prices and dates change, so confirm them on the source before you act.

1. [1] ISC2. ISC2 research: organizations must amend early-career hiring practices (June 11, 2025).
2. [2] CompTIA. Security+ V7 (SY0-701).
3. [3] CompTIA. Security+ V8 (SY0-801).
4. [4] ISC2. Exam pricing.
5. [5] ISC2. One Million Certified in Cybersecurity program concludes.
6. [6] Amazon Web Services. AWS Certified Cloud Practitioner.
7. [7] Microsoft Learn. Microsoft Certified: Azure Fundamentals.
8. [8] Microsoft Learn. Microsoft Certified: Security, Compliance, and Identity Fundamentals.
9. [9] Amazon Web Services. Security - Specialty (SCS-C03) exam guide: version history.
10. [10] Amazon Web Services. AWS Certified Security - Specialty.
11. [11] Microsoft Learn. Azure Security Engineer Associate (retired August 31, 2026).
12. [12] Google Cloud. Professional Cloud Security Engineer.
13. [13] Microsoft Learn. Student discounts.
14. [14] Microsoft Learn. Cloud and AI Security Engineer Associate.
15. [15] CompTIA. CySA+ V4 (CS0-004).
16. [16] CompTIA. CySA+.
17. [17] Splunk. Splunk Core Certified User.
18. [18] Splunk. Splunk Certified Cybersecurity Defense Analyst.
19. [19] CompTIA. PenTest+.
20. [20] OffSec. Individual pricing.
21. [21] OffSec. PEN-200: Penetration Testing with Kali Linux (OSCP+).
22. [22] CompTIA. SecAI+.
23. [23] ISC2. CISSP experience requirements.
24. [24] GIAC. Certification pricing.
25. [25] CompTIA. Exam voucher discounts.
26. [26] ISC2. ISC2 Candidate.
27. [27] ISACA. Become a member.
28. [28] Department of Defense. DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program.
29. [29] DoD Cyber Workforce. DoD 8140.
30. [30] CompTIA. What 8140 means for companies working with DoD.
31. [31] DoD Cyber Workforce. DCWF work role qualification matrix.