Roadmaps Certifications
Which certifications to take, in what order, for each career. With the real cost, what the exam is like, how long it stays valid, and an honest word on which ones are worth it.
Prices in US dollars, checked
Watch for attacks, investigate alerts and respond to incidents.
Step 1: Start here. If you can afford only one, take Security+.
A cheap first step that proves you know the basics. Fine to skip if you go straight to Security+.
The most asked-for entry security certification in job ads, and accepted for many government roles.
Step 2: Proves you can do the analyst job. Pick SC-200 if local jobs use Microsoft tools.
Shows you can read logs, triage alerts and respond to incidents: the daily work of a SOC analyst.
Good value if employers near you run Microsoft security tools, which many do.
Step 3: Optional, but a hands-on exam makes your CV stand out.
Fully hands-on, so it proves real skill. Less known to HR than CySA+.
Step 4: Once you have experience, ideally paid for by your employer.
Highly respected for incident response. Usually worth it only when your employer pays.
Step 5: For senior and lead roles after about five years.
The standard certification for senior security and management roles.
Break into systems, with permission, to find weaknesses before criminals do.
Step 1: Optional, but it covers the basics and passes HR filters.
The most asked-for entry security certification in job ads, and accepted for many government roles.
Step 2: Your first practical hacking certification.
The best first hacking certification: affordable and fully practical.
Step 3: Real-world style exams with full reports. Either one prepares you well for OSCP.
Feels like a real job: you hack an Active Directory network and defend your report to an assessor.
One of the hardest and most practical mid-level exams. Strong preparation for OSCP.
Step 4: The certification most pentest job ads name.
The best-known penetration testing certification. Many pentest job ads ask for it by name.
Step 5: Only if jobs you are applying for require it; many government roles do.
Often required in government and Gulf job ads, but it tests theory, not hacking skill. Take it only if jobs you want ask for it.
Lead security teams, manage risk, write policy and handle audits.
Step 1: The shared foundation.
The most asked-for entry security certification in job ads, and accepted for many government roles.
Step 2: Pass the exam early and become an Associate of ISC2 while you build experience.
The standard certification for senior security and management roles.
Step 3: For management roles.
For people who lead security programmes, write policy and manage risk.
Step 4: New: governance and security of AI systems.
New in 2025: shows you can govern and secure AI systems. Rare, so it stands out.
Build and secure systems on AWS or Microsoft Azure. Pick one cloud and stay with it.
Step 1: Optional first step.
A gentle start that teaches cloud words and services. Skip it if you already work with AWS.
The Azure version of a first cloud certification. Microsoft often gives free vouchers at its virtual training days.
Step 2: The certification cloud employers look for.
The most valuable cloud certification for most people. Employers know it everywhere.
The core Azure job certification for running real systems.
Step 3: Add this for cloud security roles.
Proves you can secure cloud workloads, one of the most in-demand security skills.
Replaced AZ-500 on 31 August 2026. The Azure route into cloud security.
Build, deploy and secure AI systems. In AI, a strong project portfolio counts more than any certification.
Step 1: Optional basics.
A first look at AI and generative AI concepts. Useful, but projects matter far more in AI.
Replaced AI-900 in 2026. The Azure version of a first AI certification.
Step 2: Shows you can put models and AI apps into production.
Shows you can take a model from a notebook to production on AWS.
Replaced AI-102 in 2026. For building AI apps and agents on Azure.
Step 3: A respected advanced certification.
One of the most respected ML certifications from a cloud provider.
Step 4: For AI security and governance roles, after CISSP or CISM.
New in 2025: shows you can govern and secure AI systems. Rare, so it stands out.
Turn data into answers, and build the pipelines behind them.
Step 1: The most useful first certification for data analysts.
Power BI is one of the tools data analyst job ads ask for most, so this is a useful first data certification.
Step 2: For moving into data engineering.
Covers pipelines, storage and data warehouses on AWS.
Step 3: Advanced, and well known where companies use Google Cloud.
Well respected, especially where companies use BigQuery.
Run networks, automate infrastructure and keep services up.
Step 1: Networking knowledge helps in every IT career.
The classic networking certification. Very useful for security and cloud careers too.
Step 2: Cheap and practical.
Cheap, and infrastructure as code is in most DevOps job ads.
Step 3: Hands-on Kubernetes skills.
Fully practical and highly valued for DevOps and platform roles.
Looking for what to learn, not what to certify? See the learning roadmaps.
Spotted a price change or a retired exam? Contact