The security certifications employers actually ask for
Course sellers rank certifications by what they sell. This page ranks them by how often hiring companies write them into the job postings open today, which specialties ask for each one, and what the roles naming them pay.
A posting counts for a certification when its title or text names it, as a requirement or as a plus; postings seldom separate the two clearly enough to count them apart. CISA counts only where the posting lists it beside another certification, since the same letters name the US government's cyber agency. Middle pay is the middle salary of the postings that name the certification; it tells you which roles ask for it more than what the certificate itself adds.
Every certification named
Ranked by the postings that name them
Most-named first. The last column is the specialty whose postings name it most.
| Certification | Postings | Share | Middle pay |
|---|---|---|---|
| CISSP | 359 | 16.8% | $188k/yr |
| GIAC certifications (GSEC, GCIH, GPEN and others) | 216 | 10.1% | $179k/yr |
| CISM | 149 | 7% | $180k/yr |
| CISA (Certified Information Systems Auditor) | 120 | 5.6% | $170k/yr |
| OSCP | 117 | 5.5% | $196k/yr |
| CompTIA Security+ | 89 | 4.2% | $150k/yr |
| CCSP | 76 | 3.5% | $197k/yr |
| CRISC | 63 | 2.9% | $169k/yr |
| OffSec advanced (OSEP, OSWE, OSED, OSCE3) | 63 | 2.9% | $200k/yr |
| CEH (Certified Ethical Hacker) | 59 | 2.8% | $189k/yr |
| AWS certifications | 56 | 2.6% | $203k/yr |
| ISO 27001 Lead Auditor or Lead Implementer | 35 | 1.6% | $173k/yr |
| Cisco CCNA or CCNP | 31 | 1.4% | $203k/yr |
| CompTIA CySA+ | 23 | 1.1% | $106k/yr |
| CIPP (privacy) | 19 | 0.9% | $191k/yr |
| CKS (Certified Kubernetes Security Specialist) | 19 | 0.9% | $181k/yr |
| Microsoft security certifications (AZ-500, SC-200, SC-100, SC-300) | 16 | 0.7% | $194k/yr |
| CRTO | 14 | 0.7% | $192k/yr |
| CCSK | 11 | 0.5% | $137k/yr |
| CompTIA SecurityX (CASP+) | 11 | 0.5% | $180k/yr |
| SSCP | 11 | 0.5% | $163k/yr |
| Google Cloud Professional Cloud Security Engineer | 10 | 0.5% | $205k/yr |
| CGRC (formerly CAP) | 8 | 0.4% | $161k/yr |
| CompTIA Network+ | 6 | 0.3% | $129k/yr |
| PCI QSA or ISA | 5 | 0.2% | $160k/yr |
| PNPT | 5 | 0.2% | too few |
| CompTIA PenTest+ | 3 | 0.1% | $163k/yr |
| eJPT and eCPPT | 3 | 0.1% | too few |
Getting in
Certifications you can earn before your first security job
These have no years-of-experience rule from their issuer. Ranked by how many open postings name them.
1. GIAC certifications (GSEC, GCIH, GPEN and others)
216 postings (10.1%), among them Palo Alto Networks, Sophos and GuidePoint Security.
2. OSCP
117 postings (5.5%), among them SpaceX, Thales and CrowdStrike.
3. CompTIA Security+
89 postings (4.2%), among them GuidePoint Security, Thales and Anduril Industries.
4. CEH (Certified Ethical Hacker)
59 postings (2.8%), among them Airwallex, GuidePoint Security and Elastic.
5. AWS certifications
56 postings (2.6%), among them GuidePoint Security, Veeam and Darktrace.
6. Cisco CCNA or CCNP
31 postings (1.4%), among them GuidePoint Security, Anduril Industries and Thales.
7. CompTIA CySA+
23 postings (1.1%), among them GuidePoint Security, Anduril Industries and Fastly.
8. CIPP (privacy)
19 postings (0.9%), among them Trace3, xAI and Beast Industries.
The entry-level security roles open now and the career guides show where a first certification leads.
Senior seats
Certifications that need years in the field first
Their issuers ask for verified experience (five years of paid work for the CISSP, CISM, CISA and CRISC), so they gate senior and leadership roles.
| Certification | Postings | Typical pay of those postings |
|---|---|---|
| CISSP | 359 | $160k–$300k/yr |
| CISM | 149 | $163k–$315k/yr |
| CISA (Certified Information Systems Auditor) | 120 | $157k–$315k/yr |
| CCSP | 76 | $178k–$318k/yr |
| CRISC | 63 | $155k–$272k/yr |
| OffSec advanced (OSEP, OSWE, OSED, OSCE3) | 63 | $164k–$323k/yr |
| ISO 27001 Lead Auditor or Lead Implementer | 35 | $161k–$303k/yr |
| CKS (Certified Kubernetes Security Specialist) | 19 | $172k–$238k/yr |
| CRTO | 14 | $164k–$299k/yr |
| CompTIA SecurityX (CASP+) | 11 | $162k–$235k/yr |
| Google Cloud Professional Cloud Security Engineer | 10 | $177k–$263k/yr |
| CGRC (formerly CAP) | 8 | $152k–$248k/yr |
| PCI QSA or ISA | 5 | $154k–$199k/yr |
Questions
Certifications, answered from the postings
Which cybersecurity certification do employers ask for most?
CISSP. It is named in 359 of the 2,143 open security postings read on 11 Nov 2026 (16.8%), ahead of GIAC certifications (GSEC, GCIH, GPEN and others) (10.1%) and CISM (7%). 26.2% of postings name at least one certification counted here.
Is the CISSP worth it?
Postings that name the CISSP state a typical $160k–$300k/yr, middle $188k/yr, against $205k/yr for every security posting read. They sit below the board's middle: the CISSP is named most in Governance, Risk & Compliance (GRC) postings, while the postings that name no certification at all state a middle of $214k/yr. It is a key to the seats that ask for it rather than a raise on its own.
What is the best first certification for a newcomer to security?
Of the certifications a newcomer can sit without years of experience, employers name GIAC certifications (216 postings), OSCP (117 postings), CompTIA Security+ (89 postings) most often. CompTIA Security+ also satisfies the US Department of Defense baseline that 26 of these postings mention.
Do employers still ask for the CEH?
Some do: the CEH is named in 59 open postings (2.8%), against 117 for the hands-on OSCP (5.5%). For penetration testing and red team seats the OSCP is the one asked for more.
Weekly roles email
Have new security roles emailed to you
One weekly email with every new security role we found and the salary each states. Free; leave whenever you like.
Only job openings, never promotions. Unsubscribing takes one click.