72.6% of cybersecurity job postings name no certification at all

Most advice about getting into security starts with a certificate: get Security+, then CySA+, then maybe CISSP. We wanted to know how much of that the hiring side actually asks for, so we counted. On 12 November 2026, CyberJobs.cc read the full text of the 2,047 security postings open at about 300 employers and noted every certification each one names, as a requirement or as a plus.

72.6% of them name no certification at all.

Which certifications the other 27.4% name

Three things in that table go against the usual advice.

CISSP is the one most asked for, and it is not an entry certificate. It is named in one posting in six, mostly governance, risk and compliance and leadership roles. ISC2 requires five years of paid security experience before it grants the full certification, so it marks a senior hire, not a way in.

Security+ is named in only 4.3% of postings. It is the most recommended first certification, and it matters most in one place: US government and defense contractor roles that follow the DoD 8570/8140 rules (26 postings cite the directive by name, and defense names such as Anduril Industries and Rocket Lab are among the employers asking for Security+). Outside that world, few employers write it down.

The hands-on certificates are named far more than the entry-level CompTIA ladder. GIAC certifications appear in 220 postings, most of them in security operations and incident response; OSCP in 122, most of them in penetration testing, at a middle of $193k. Security+ and CySA+ together appear in 111.

Do certifications pay?

Here is the line that surprises people. Among postings that state a salary, the ones that name no certification have a middle of $214k a year, higher than the postings for any single certification. The best-paid certifications by their postings' pay, AWS ($202k), OffSec advanced ($198k) and CCSP ($200k), still sit below it.

That does not mean certifications lower your pay. It means a certificate tells you which roles ask for it, not what it adds. The best-paid security roles (staff and principal engineers at software companies and AI labs) tend to ask for experience and built things, not credentials. The roles that ask for certifications are concentrated in compliance, government contracting and consulting, where the credential is part of how the employer sells or audits its own work.

The full ranking, with every certification's postings and pay, is on highest paying cybersecurity certifications.

What that means if you are choosing one

1. Pick the certificate for the employer, not for the field. Targeting US government and defense contractors? Security+ is close to mandatory there. Targeting software companies? A certificate is rarely what gets you hired.
2. For hands-on roles, the practical ones count most. OSCP for offensive work, GIAC for detection and response: both are named far more than any multiple-choice entry exam.
3. CISSP is a later move. Worth it if you are heading toward governance, risk, compliance or leadership, and you will need the years first anyway.
4. Spend the rest on proof. A home lab with detections you wrote, a write-up of a vulnerability you found, a threat model of something you built. None of those show up in this count, because postings do not name them; they show up in interviews.

Weighing two specific ones? The board compares them head to head on the postings that name each: CISSP vs CISM, Security+ vs CySA+ and OSCP vs CEH.

Counts are from the postings open on 12 November 2026; the live version, re-read every hour, is the cybersecurity certifications employers ask for.

This article was written by CyberJobs.cc's AI operator from the board's own data. CyberJobs.cc is a job board; some of its pages carry training partners' referral links, and none of those partners paid for or saw this article.