For every credential: what it actually unlocks, when it matters in your progression, what experience usually comes first, and what it won't magically solve. Anchored on the certifications hiring managers in IT, security, cloud, DevOps and GRC actually recognise.
Written by James, a UK security architect. Hiring panels, not vendor brochures.
CISSP has an experience requirement for full certification, with a potential qualifying waiver. Passing the exam alone is different from holding CISSP. Check ISC2's current eligibility rules and the role you are targeting.
Read the full take on CISSP, in contextAWS SAA and AZ-104 can support applications for work on their respective platforms. Choose according to the responsibilities you want and the platform you can practise. Neither credential guarantees a salary increase or a shortlist place.
Read the full take on AWS SAA, in contextUnfashionable, and that's exactly why it works. Cloud and security engineers who actually understand routing, subnets and TLS handshakes get promoted faster than those who don't. CCNA is still the cleanest way to earn that fluency.
Read the full take on CCNA, in contextUseful where a vacancy names Security+ or accepts it as supporting evidence. It does not guarantee screening success. Check the current employer requirements and demonstrate relevant practical work alongside it.
Read the full take on Security+, in contextThese are our calls based on what hiring panels and infra teams actually look for in 2026. They are professional opinion, not statements about exam quality or vendor conduct. Your context will vary. Treat every verdict as a starting point for your own judgement.
Vendor-neutral baseline certs. HR-recognised, but rarely land roles alone.
Useful as proof you can sit an exam and learn a syllabus. Treat as a starter pistol, not a finish line. Anyone hiring for them already assumes you'll need a year of supervised work after.
The most widely recognised first IT cert. Rarely required, often expected on helpdesk and desktop-support shortlists. A vocabulary and confidence builder more than a skills test.
Useful shared language for service improvement; the badge does not demonstrate that you have improved a service.
Process / service-management cert. Checks an HR box; doesn't make you a better engineer.
Vendor-neutral Linux baseline. Useful only if you can't justify RHCSA or LFCS yet.
Microsoft security/compliance/identity primer. Feeds the SC-200/300/400 lane, nothing more.
MS-900 retired on 31 March 2026. It is no longer available to take. Previously earned credentials remain on the Microsoft Learn transcript; do not book this exam as a new qualification.
Modern Endpoint Administrator. Intune, Autopilot, compliance. The current desktop-engineer cert.
The most widely recognised entry-level security certification. Strong on vocabulary and concepts. Pair it with networking knowledge and hands-on labs to actually land roles.
The base layer cloud and security stand on. Hands-on, durable.
Industry-respected networking certification. Heavy emphasis on labs. Routing, switching, wireless basics, and the IP fabric every other role depends on.
Two-exam track (core + concentration). Validates deep enterprise routing, switching, and increasingly automation skills.
Vendor-neutral networking primer, pair it with CCNA, don't end with it.
Palo Alto Networks confirms PCNSA is a retired exam. Do not plan a new sitting. Existing credentials can remain valid until their individual expiry; inspect the current role-based portfolio for a suitable exam. No precise PCNSA retirement date is asserted here.
Fortinet's mid-tier cert. Strong in regions and verticals where Fortinet dominates.
Juniper foundation, relevant in service-provider and large-enterprise Junos networks.
Azure networking credential. Most relevant when the role includes Azure network design and operations.
CCNP Security. Deep network-security cert; respected in carrier/enterprise, less so in cloud-native shops.
The PCNSE exam retired on 31 July 2025. Palo Alto names Next-Generation Firewall Engineer as its replacement. An existing PCNSE credential can remain valid until its individual expiry; it is not a new exam to book.
SOC, detection, SIEM. The realistic on-ramp into security.
SANS forensic analyst. The gold-standard DFIR credential for serious incident teams.
Blue-team extension of Security+. Useful for SOC promotion talks, weaker as a first cert.
Relevant to Azure, hybrid and AI workload security; prepare a control implementation and verification example alongside study.
Vendor cert that proves you can drive a Splunk SIEM, narrow, but instantly useful in Splunk shops.
GIAC foundational security credential. Training and exam costs are separate considerations; check current vendor pricing and demonstrate the work behind the credential.
GIAC intrusion-analysis credential focused on network traffic and detection. Compare exam-only and training options using current vendor prices; course attendance is not a universal hiring requirement.
GIAC incident-handling credential. Consider it for incident-response responsibilities, using the current vendor price and your own experience rather than assuming a fixed training package is required.
The canonical Microsoft SOC credential, direct fit for Sentinel / Defender shops.
Security Blue Team Level 1. A practical option for developing junior SOC investigation skills.
CyberDefenders CCDL2, formerly CCD. A practical threat-hunting and forensic-investigation credential; employer recognition depends on the vacancy.
EC-Council forensic investigator, common in law-enforcement-adjacent and compliance markets.
Microsoft Information Protection / Purview specialty, the compliance-coded cert in the SC series.
SANS continuous-monitoring cert, closest SANS equivalent to a detection-engineering credential.
SANS network forensic analyst, narrow but credible for telemetry-heavy IR teams.
SANS malware RE cert, the strongest mainstream credential for malware analysts.
EC-Council Network Defender. Recognised in compliance-driven environments; practitioners typically pair it with labs or SOC work.
Pentest, red team. Slow ramp; entered after SOC or SWE experience.
Offensive Security Certified Professional. A 24-hour practical exam that remains the industry's most respected entry-to-mid penetration testing credential.
Practical, AD-heavy offensive cert. Cheaper and arguably more realistic than OSCP for internal pentest work.
Recognised in compliance-driven shops; carries far less weight than OSCP/PNPT in technical interviews.
Still passes HR filters in compliance-driven hiring; practitioners typically pair it with hands-on work (HTB / labs / OSCP).
SANS pentest cert. Strong in gov/consulting markets, expensive vs OSCP for similar signal.
SANS web app pentest cert. Credible in SANS-funded shops; OSWE is the deeper alternative.
HTB's modern offensive benchmark, respected by practitioners, still building HR recognition.
Zero-Point Security red-team cert. Modern Cobalt Strike tradecraft, increasingly the de-facto red-team cert.
OffSec's evasion / advanced AD cert, only meaningful after OSCP and red-team exposure.
OffSec's web-exploitation cert. The deepest hands-on AppSec credential for source-aware testers.
SANS exploit-dev cert. Narrow, expensive, only meaningful in vuln-research-adjacent roles.
Cheap, hands-on entry to offensive security, great warm-up, not a hiring credential by itself.
Data platforms, pipelines and applied AI. Match the credential to the work and platform.
A foundation for discussing Azure AI services; not evidence that you can build and operate production AI systems.
Snowflake platform knowledge; check the current Core exam guide. Pair study with a documented, tested example; the credential does not prove production ownership.
Relevant to Fabric data engineering; pair preparation with a tested pipeline and a clear account of data quality failures.
Retired on 31 March 2025, along with its renewal assessment. Microsoft points new candidates at DP-700, which is built on Fabric rather than Synapse.
Introductory data engineering on the Databricks platform. Pair study with a documented, tested example; the credential does not prove production ownership.
AI-900 retired on 30 June 2026. It is no longer available to take. Previously earned credentials remain on the Microsoft Learn transcript; do not book this exam as a new qualification.
AWS / Azure / GCP. Strongest senior salary ladder in tech.
The most popular AWS certification. Broad coverage of core services, the Well-Architected Framework, and basic design tradeoffs.
AWS vocabulary primer. Useful for first cloud roles, transparent at any senior level.
Useful for AWS operations work when paired with a documented incident, recovery or monitoring example.
A Windows Server administration route for people who can explain identity, recovery and hybrid operations in practice.
AWS states the last day to take the SysOps Administrator - Associate exam was 29 September 2025, and that the updated exam is now known as AWS Certified CloudOps Engineer - Associate. Anyone planning this exam should register for CloudOps instead. A SysOps certification already held stays valid for its three year term.
Developer-flavoured AWS cert. Most useful if you actually ship code on Lambda/DynamoDB/CDK.
Practical Azure administrator cert. The closest equivalent to AWS SysOps in the Microsoft world.
GCP's associate cert, niche but premium-paid where Google Cloud lands.
Vendor-neutral cloud-security primer. Cheap, broad, lighter than CCSP.
Hybrid Windows Server on Azure. The cert ex-sysadmins use to translate into the cloud.
AZ-800's senior sibling, hybrid security, monitoring, recovery.
Microsoft 365 Administrator, tenants, Exchange Online, Entra, Teams, compliance.
Strong signal for cloud-security-leaning roles. Assumes you already speak AWS fluently.
The certification, its exam and its renewal assessment were retired on 31 August 2026. Microsoft's replacement is SC-500, and there is no transition path from a held AZ-500; the new credential has to be earned on its own.
Advanced AWS architecture study is most useful after you have real design trade-offs to analyse.
Azure solutions architect. The senior design cert, only credible with production scars.
GCP's senior cloud-security credential, narrow market, strong signal inside GCP shops.
(ISC)²'s senior cloud-security cert. CISSP-adjacent, weighted toward architecture and program work.
Azure vocabulary primer. The knowledge can support AZ-104 preparation; passing AZ-900 is not a formal prerequisite for AZ-104.
IAM, PAM, SSO, Zero Trust. Often entered from AD or cloud.
User management, SSO and basic security configuration. Pair study with a documented, tested example; the credential does not prove production ownership.
Okta administration, user and group management and policy troubleshooting. Pair study with a documented, tested example; the credential does not prove production ownership.
The dedicated Entra ID / IAM credential. The strongest single signal for cloud-IAM hiring on Azure.
Audit, risk and compliance. Senior management lane.
ISACA's audit cert. The credential of choice for internal/external IT audit and audit-adjacent GRC.
Certified Information Systems Security Professional. The gold standard for senior security roles, with a heavy governance and architecture focus across 8 broad domains.
ISACA's management-coded cert. The CISSP alternative for governance and program leads.
ISACA's risk credential. The dedicated counterpart to CISM for risk-coded governance lanes.
ISC2 governance / risk / compliance cert (formerly CAP). Narrow but credible in federal / regulated markets.
Hands-on senior security generalist cert, quietly respected, mostly in defence/contractor space.
ISO 27001 Lead Implementer. The cert that gets you on certification programs, not running them.
ISO 27001 Lead Auditor, for the audit side of the same standard.
TOGAF is a certification family, not one exam. Consider the specific credential where architecture methods and governance match the work.
Microsoft security architect. The senior design cert for the Microsoft security stack.
EC-Council's CISO-prep cert. Narrower employer recognition than CISM/CISSP in most markets.
Kubernetes, IaC, pipelines. Code fluency required.
Validates working knowledge of Terraform: state, modules, providers, and core workflow. Cheap, practical, and useful across every cloud.
A fully hands-on, performance-based exam. You're given real clusters and a task list. Speed and command-line fluency matter as much as concepts.
Hands-on Linux signal that infra and platform interviewers actually trust.
Distro-neutral counterpart to RHCSA, slightly less prestige, equally hands-on.
Supports experienced AWS delivery and operations work; exam success is not a substitute for a tested deployment and rollback.
Developer-side counterpart to CKA. Useful for engineers shipping to k8s, less so for operators.
VMware professional cert, narrowing market, still meaningful in regulated enterprise.
Cisco's network-automation cert. Useful proof that a network engineer actually codes.
DevOps engineer on the Microsoft stack. Azure DevOps, GitHub, pipelines, IaC.
Practical Ansible automation makes this relevant to Linux operations; confirm the EX294 version and credential requirements before booking.
k8s security depth cert. Only meaningful if you already hold CKA and ship clusters.
