What IT Security Certifications Are Growing As Desired By Employers

[jbacon83]

According to the Cyber Edge group's 2022 Cyber Threat Defense Report, employers interviewed indicated that certifications in cloud security and software security as shown below are in top demand.  These certifications would include the Certified Cloud Security Professional (CCSP) and Certified Software Security Lifecycle Professionals (CSSLP).    According to the trends I've been tracking on Indeed from employer job postings it appears however, the certification trends posted in employer job openings have the CISSP followed by ISACAs Certified Information Systems Auditor (CISA) as the top certifications. CCSP and CSSLP are among the lower ranked advertised certifications for employer job openings.  Maybe the new trend hasn't caught on yet with employer job advertisements?

[FatalByte]

Thank you for the overview. As someone who is continually striving to pursue the most relevant certifications in today's ever-evolving landscape, I found this information to be an invaluable roadmap for anyone looking to enhance their cybersecurity knowledge.

[akkem]

Much needed!

[ko6728]

Wrong.

The reasons why it seems folks on this discussion board don't like the CEH cert is because it's too difficult and expensive to obtain, which is understood.

However, just because something is difficult, doesn't mean it shouldn't be "taken seriously."

Contrast:  I have talked to hundreds of employers who don't care about Net+ (They want CCNA - even for "entry" level, because, by golly "I had to do it 15 years ago..."), never heard of the CISSP (99% think it's a Cisco cert), and many still want computer science students (or ANYBODY) with bachelor degrees - even without certs or experience.  So, here in the US, that leaves most of them basically asking for H1 visa applicants.  Everybody wants "cloud" because its "new" and "sexy."  The "cloud" has been around since clustering started around 1998, for those of you with cloud certs who wish to argue.  Yup.  It's not new, no matter what some tech rag magazine may tell the "young ones."  Yup.  LOL

There is NOT shortage of cyber students or applicants.  There is a shortage of employers willing pay cyber employees what they are worth.  I teach cyber security.  I have worked in cyber since it was called "information assurance" back in the old days.  So, regardless of "industry studies"  or people putting together random charts from Indeed, I will tell you something from experience.  Here are the certs employers (who are smart enough to care about certs) want right now.

CCNA

Any Cloud Cert

Sec+ or higher (CISSA, CISSP)

That's it.  That's all of them.  Even for stuff like SCADA.  What in the world is a "cybersecurity leadership certification?" as mentioned in the chart?  Dunno, don't care.  I hate to burst bubbles, but there seems to be a ton of "faculty lounge" types on here who love to theorize but have no idea what is going on in the real world right now.   This is coming from a guy who has spent time in actual faculty lounges, BTW.

How about this:  Not to mention, a full 30% of employers admit to posting "ghost" or "fake" job listings.

You can take that Indeed search chart above and flush it down the toilet, that's about how much it is worth.

Side note:  USG HR will ALWAYS hire accountants, liberal arts, etc. for cyber jobs over applicants with actual skills, experience, and/or certs because the accountants, etc had  bachelor degrees.  Didn't matter what it was in - as cyber / IT supervisor, especially.  DoD 8570?? They didn't care - there are waivers and ways to get around that.

Everyone on this page should take a long, slow read at my post if you want some REAL insight into what is really going on.

[ko6728]

C

[Alogarithm001]

I think cloud and software security is on trending markets...

[riffjim4069]

Just to revisit this topic...as I mentioned a couple years ago, I was seeing where Cybersecurity folks needed not only the CISSP certification (think of this as the Infrastructure Security cert) which was fine for the past, but also needed to possess Cloud Security chops in the form of the CCSP or CCSK, and having at least a fundamentals certification in Azure, AWS, or GCP was a plus - almost a requirement in some sectors. 
 
As if being an expert in cybersecurity operations, engineering, architecture, risk management, applications security, DevOps, infrastructure security, OT/IOT, everything the business wants to support, etc., ad nauseum wasn't enough...now many of us find ourselves in the line of fire with AI/ML. Yep, add AI Governance, AI threats, AI controls, AI ethics, LMMs, AI EIEO, Aye Aye Aye, my headaches grown exponentially trying to keep-up and prevent the business from going off the AI Cliff-->because everyone else is doing it.
 
Just my two-cents!  
 
AI Certification discussions are coming up and, sadly, it may a factor in people keeping their cybersecurity jobs down the road.  We shall see.  What is everyone's take on AI certification for the Cybersecurity folks?  There's not much out there (frameworks still be developed and revised) but last month I participated in the AAISM Beta exam program.  Overall, I though it was a pretty good exam and CBK.  ISC2 offers an AI certificate program, but not sure if they have announced plans to offer any certification programs.
 
Again, just interested in hearing everyone's thoughts on AI Security certifications. Cheers! 

[emb021]

@riffjim4069 I've also been looking at AI certs, both for my infosec cert presentation as well as my overall AI governance/framework research.

We have the 2 from ISACA, which are more for audit and security management.

IAPP has one on AI governance.

Of the ones I've seen so far, these are the only ones I'm looking at getting at some point.

There is a group called, believe it or not, "AI Certs" who have put out a LOT of AI cert, including several security related ones.  They do state that several of their certs are 17024 certified, but not sure which ones.  And certainly don't know if these has good or not.

I know of ISC2 doing an AI certificate.  And it seems CompTIA is doing the same.

I WOULD like to see a kind of "AI CISSP" cert from someone.  SANS/GIAC.  ISC2.  Wouldn't be impressed by one coming from CompTIA or EC-Council.

I see that OWASP and SANS are teaming up on developing a set of AI Security controls, so maybe this may lead to something from SANS/GIAC.  But that is probably a year or more away.

[emb021]

@ko6728 wrote "The reasons why it seems folks on this discussion board don't like the CEH cert is because it's too difficult and expensive to obtain, which is understood.

However, just because something is difficult, doesn't mean it shouldn't be "taken seriously." "

HAHAHAHAHA

NOPE.

That's NOT the reason why people don't like the CEH cert.  You need to get out more and learn about EC-Council.  

People don't care for the CEH NOT because its "difficult", but because of some negative things about EC-Council I won't repeat here, issues with the quality of CEH test questions, and how good it is in preparing people for this field.

I know MANY experienced and smart infosec professionals who don't care for either EC-Council or the CEH.

[nkeaton]

@emb021  There are many of us who don't support and won't have our people earn their certifications because of their lack of ethics.  Then there is the matter of their opinion of women and openly saying that are too dumb for cybersecurity.  Thor's write-up is probably the best on the subject.  They have always been too expensive, and their CEH is somewhat questionable.  They are a for profit organization which is indicative of their organization.  When we have someone thinking about CEH, we have them earn PenTest+ (offensive security) or CySA+ (defensive security) instead.  It is a better value to the organization and better quality knowledge.  I know people that are not renewing their CEH over their lack of ethics.  They tell me that if someone wants a physical certificate that costs $75.  We will hire someone with a CEH but will not create new ones because ethics is an important quality where I work.  We do not hold ECC's lack of ethics against those that earned one of their certifications.  Their ethics are not the ones in question.  I do not like being negative, but ECC has earned that opinion.    

[riffjim4069]

@emb021 All excellent points.  As I mentioned in another thread (I'm sure you saw it) besides getting on board the ISACA AAISM beta exam program, and eventually obtaining certification, I'm also set to take the CompTIA SecAI+ beta exam which is more "hands on" assist with AI controls and deployment of AI models and agents.  I take my exam in the coming days, but it won't be scored until March 2026.  I was hoping for something from ISC2, but between the AAISM and SecAI+ I've got all the AI certs I need.  Cheers.