Cyber Security Certifications: What Employers Ask For

Search this term and the first three results are CompTIA, ISC2 and Google, each listing its own catalog and none of them showing a price. That is the problem with the question: the people best placed to answer it are all selling something.

What follows is the eight certifications employers name in job ads, in one table, with the experience each demands and the cost each carries, taken from the issuing body's own pages. Then the part the vendors do not write: whether any of it gets you hired.

What Are Cyber Security Certifications?

A certification is a credential from an independent body saying you passed its exam and, for most of them, that you have done the job for a stated number of years. Nobody is legally required to hold one. Employers use them as a filter because there is no license for this work, so the issuer's name is the closest thing to a standard.

Which issuer matters more than which topic. Six organizations account for almost every certification in a US job posting: CompTIA, ISC2, ISACA, EC-Council, OffSec and GIAC, the certification arm of the SANS Institute. Vendor certifications from Microsoft, Cisco and AWS prove you can run one company's products, which is useful once you know where you are working and premature before that.

Certifications also sit on top of knowledge rather than instead of it. The exams test whether you can apply the controls that make up the working definition of cyber security, which is material you have to learn somewhere first.

Which Cyber Security Certifications Do Employers Ask For?

These eight are the ones that recur in job postings. Everything in the table comes from the issuing body's own page, linked in the sections below.

Entry Level Cyber Security Certifications

CompTIA Security+ is the default first certification in the United States, and the one you will see named by title in entry level job ads. The current exam is SY0-701, a maximum of 90 multiple choice and performance based questions in 90 minutes. CompTIA recommends Network+ and around two years in a security or systems administrator role first, but that is guidance rather than a gate. It is broad and shallow by design, which is what makes it work as a filter.

ISC2's CC, Certified in Cybersecurity, is the cheapest credible alternative at $199 and requires no work experience. It is newer and less often named in postings, so treat it as a supplement or as a way to test whether the material holds your interest.

The Google Cybersecurity Certificate is a course rather than a certification: $49 a month after a seven day trial, three to six months at five to ten hours a week, no prior experience required. It teaches the ground floor well and is a reasonable way to prepare for Security+, but it is not what a hiring manager means by a certification.

Before any of them, learn how the attacks work. Candidates who cram the acronyms without the mechanism fail on the scenario questions.

Mid Level Cyber Security Certifications

CompTIA CySA+ is Security+ for people already doing the work. The current exam is CS0-004, a maximum of 85 questions in 165 minutes, and CompTIA recommends about four years in a SOC analyst or vulnerability analyst role. It maps more directly to a detection and response job than anything else on this list.

EC-Council's CEH is the best known offensive credential and the most argued about. The knowledge exam is 125 multiple choice questions in four hours, with an optional six hour, 20 challenge practical that upgrades the holder to CEH Master. Eligibility runs two ways: complete EC-Council's official training, whose on-demand packages start at $1,699, or self-study with two years of information security experience plus a $100 non-refundable application. Recruiters recognize it and practitioners dismiss it, on the grounds that a multiple choice exam cannot demonstrate offensive skill. Both are true, which is why it opens doors at companies that screen on keywords and none at companies that test.

GIAC, the certification arm of SANS, runs the most respected exams in the field and the most expensive route to them. GSEC, the general one, is 106 questions in four hours with a 72 percent pass mark. GIAC publishes no price on its own site, because an attempt is normally bought alongside a SANS course priced for employers rather than individuals. If your employer pays, this is the strongest thing at this level. If you pay, it usually is not.

Understanding phishing properly matters more here than it sounds, because social engineering is the entry point in most real incidents and it appears in every one of these exams.

Advanced Cyber Security Certifications

Three of these four cannot be held without five years of experience, which is the single most misunderstood fact about them.

CISSP from ISC2 is the broad standard, an exam across eight domains that costs $749 and requires five years of work experience across those domains. It appears in postings for security leads, architects and managers more than for analysts.

CISM from ISACA is the governance counterpart, aimed at people who run security programs rather than build them. The exam is US$575.00 for members and US$760.00 for non-members, and certification requires five or more years of information security management experience across at least three of the four CISM domains, within the preceding ten years.

CCSP, also from ISC2, is the cloud specialization: $599 and five or more years of experience. Worth it when your work is genuinely cloud-first, redundant when it is not.

OSCP from OffSec is the outlier and the one practitioners respect most. No prerequisites, no multiple choice paper. $1,749 buys 90 days of the PEN-200 course, the labs and one exam attempt, and the exam is 24 hours of proctored hands-on work against three standalone machines and an Active Directory set. Note the naming: OSCP+ expires after three years, while the underlying OSCP does not.

How Much Do Cyber Security Certifications Cost?

The exam fee is the smallest part of the number. Budget for four things: the exam, the training, the retake and the renewal.

Published exam fees run from $199 for CC to $749 for CISSP, with CISM at $575 or $760 and OSCP at $1,749 with the course bundled in. Two of the eight publish no price at all: CompTIA sells vouchers through its own store, whose product pages now redirect back to the certification pages, and GIAC prices attempts through SANS. Assume you will have to ask.

Renewal is the cost people forget. Renewing a CompTIA certification with continuing education units carries a $150 fee per three year cycle, though passing the current exam version instead carries no CE fee. GIAC wants 36 CPEs earned while the certification is active, or a retake. ISC2 and ISACA charge annual maintenance on top of continuing education. Over ten years, upkeep on three certifications exceeds what the exams cost.

Will a Cyber Security Certification Get You a First Job?

On its own, usually not, and the Bureau of Labor Statistics is the place to check rather than any vendor.

Read those two lines together, because they are the honest answer. A certification is preferred, not sufficient. The same handbook lists a degree as typical and prior experience in a related occupation as normal, which is why most people arrive in security from help desk, systems administration or networking rather than straight from a course. It is also why the certification is worth more once you can point at the threats you have actually handled.

The strongest entry-level combination is a certification, adjacent experience and something you can show. Read this year's breach reports and be able to explain how one of them happened, in order, without notes. That is a better interview than any credential, and it is free.

What Is the Best Cyber Security Certification to Get?

There is no single answer, and any page that gives you one is guessing about your situation. Security+ if you are coming from outside IT, because it is the credential entry level postings name by title and because passing it proves you can learn the vocabulary. CySA+ or a GIAC certification if you already work in IT, since your existing experience is worth more than another broad exam. CISSP or CISM once you clear five years and are heading toward leadership, choosing CISM for governance work and CISSP for technical breadth. OSCP if you want to break things for a living.

The one strategy that consistently fails is collecting certifications instead of experience. Two certifications and two years of doing the job beats five certifications and none, and the people reading your resume know that.