In cybersecurity, certifications carry more weight than in most other tech jobs. Job ads often cite them, some clients require them from their service providers, and they allow a junior candidate to prove skills they have not yet been able to use in a company. But they are not all equal and, above all, they do not serve the same jobs. A SOC analyst, a penetration tester and a governance, risk and compliance profile do not take the same exams, nor at the same point in their careers. This article reviews them by family of roles, then explains how to present them on a resume together with the labs and CTFs that go with them.
Why certifications carry weight in cybersecurity
Three reasons explain the particular weight of certifications in this field.
It is hard to prove a skill any other way. A developer can show their code; a security analyst can rarely show the incidents they handled or the vulnerabilities they found at a client, which are covered by confidentiality. A hands-on certification, taken in a controlled environment, offers verifiable proof.
Client and procurement requirements. Security service providers often work for clients who ask for certified staff, particularly in calls for tender. In France, the national cybersecurity agency ANSSI also qualifies service providers (audit, incident response, detection), and these qualifications partly rely on the assessed skills of the individuals involved.
A market that hires varied profiles. The overview of cybersecurity jobs 🔗 published by ANSSI gives a sense of this, and many analysts and consultants come from other jobs (systems administration, networking, development, audit). Certification gives them a recognised bridge.
The limit remains the same as everywhere: a certification without practice is quickly spotted in the interview. Recruiters in the sector readily ask very concrete questions, sometimes in the form of a practical scenario.
SOC analyst: entry-level certifications
A SOC analyst monitors an organisation’s systems, qualifies alerts and responds to incidents. Onisep describes the job in its SOC analyst profile 🔗. For a first job, recruiters look for solid foundations in networking, systems and security, and familiarity with detection tools.
Useful certifications at this stage:
- CompTIA Security+ 🔗: the most widespread general entry-level certification, covering security fundamentals (threats, architecture, operations, risk management). It reassures on the foundations, without being specialised.
- CompTIA CySA+ 🔗: focused on security analysis and detection, one notch higher.
- Detection tool vendors’ certifications (SIEM, EDR): useful if the target employer uses the tool in question. Check the ad.
- Hands-on defence-oriented certifications, such as those from organisations specialising in blue team training, or GIAC’s GCIH 🔗 for incident handling, which is more expensive and more often funded by the employer.
For this role, a personal lab environment (log collection, detection rules, analysis of a simulated attack) complements an entry-level certification very well.
Penetration testing: the place of the OSCP
A penetration tester attacks systems with their owner’s permission to reveal their weaknesses, then writes a report. It is a very hands-on job, and the certifications that count are too.
- OffSec’s OSCP 🔗 remains the reference most often cited in pentest job ads. The exam is practical: twenty-four hours to compromise several machines in an environment, including an Active Directory set, under proctoring. The organisation has introduced an OSCP+ variant with limited validity, alongside the historical OSCP, which does not expire. Many recruiters see it as the entry threshold for an autonomous pentester.
- Hands-on entry-level certifications, such as INE’s eJPT 🔗, let you start before the OSCP and show progression.
- EC-Council’s CEH 🔗 is known to procurement departments and appears in some calls for tender, but technical pentest teams generally prefer hands-on certifications. It can be useful for some institutional clients.
- Specialised certifications (web applications, Active Directory, cloud environments) come next, depending on your preferred area.
In pentesting more than anywhere else, CTFs and training platforms count: a ranking on Root-Me 🔗, machines solved on a training platform, published write-ups of your solutions (when the platform’s rules allow) prove regular practice.
Governance and compliance: ISO 27001 and CISSP
Governance, risk and compliance (GRC) jobs organise a company’s security: policies, risk analyses, compliance with standards and regulations, management of action plans. The CISO is the best-known figure, but there are also consultants and compliance officers.
- ISO/IEC 27001 Lead Implementer and Lead Auditor: these certifications, issued by several personnel certification bodies, attest to mastery of the international standard on information security management systems. The first prepares you to implement such a system, the second to audit it.
- ISC2’s CISSP 🔗: the reference certification for experienced security managers. It requires several years of professional experience in the domains covered; a candidate who passes the exam without that experience obtains associate status while they accumulate it.
- Certifications linked to risk management (such as EBIOS Risk Manager, a method published by ANSSI) and to data protection, depending on the sector.
These roles are rarely first jobs. People often reach them after technical or audit experience. Security governance also intersects with information systems audit: the resume of an IT auditor at a firm 🔗 shows how this neighbouring profile presents its frameworks and control assignments.
For initial education, ANSSI awards the SecNumedu 🔗 label to higher education programmes that meet its criteria. For a student, choosing a labelled programme is a useful reference point, distinct from a certification.
Labs, CTFs and certifications on the resume
A certification goes in the education section (or in a "Certifications" section), with its official title, the issuing body and the date obtained. But in cybersecurity, it benefits from being surrounded by proof of practice.
Before: "Certifications: Security+, CEH, OSCP in progress. Skills: pentest, Kali Linux, Metasploit, Burp Suite, Wireshark, Nmap."
After:
- "OSCP (OffSec), obtained in March; CompTIA Security+, obtained the previous year."
- "Regular practice on Root-Me and a training platform: Windows and Active Directory machines, solution write-ups published on my blog."
- "Personal lab: virtualised Active Directory domain, logs collected in an open source SIEM, detection rules written for three common attack techniques."
The second version links each certification to a practice, and turns a list of tools into environments and techniques. The tools (Burp Suite, Nmap, Wireshark) stay in the skills section, grouped by use, as explained in our article on presenting your tech stack.
If you come from infrastructure, highlight what you secured: server hardening, access management, network segmentation, cluster security. The DevOps or SRE engineer resume template shows an operations profile for whom cluster security is part of daily work, a good starting point for a move towards security. For the general logic of entry-level certifications, our article on cloud certifications offers a method of choosing that also applies here.
A cybersecurity resume is often read by applicant tracking software before a recruiter, which looks for the exact acronyms of certifications. The TechCV editor keeps your titles as readable text, in standard sections, so that keyword searches find them. You can update your resume with your certifications and labs.
Frequently asked questions
Which certification should I take first to get into cybersecurity?
For a profile with no experience, a general entry-level certification such as CompTIA Security+ provides recognised foundations. If you already know you are aiming for pentesting, a hands-on entry-level certification followed by the OSCP speaks more clearly to offensive teams.
Does a certification replace a cybersecurity degree?
No, they play different roles. A degree, ideally from a labelled programme, attests to complete training; a certification proves a specific, recent skill. For a career changer, however, the combination of a certification and documented labs can open doors.
Do CTFs really have value on a resume?
Yes, especially for offensive roles. A ranking, challenges solved in specific categories or team participation in competitions show regular practice. State verifiable results rather than mere participation.
Does the employer pay for certifications?
Often, particularly at specialised IT services companies and at providers that must present certified staff to their clients. The most expensive certifications are generally taken after being hired, with funding from the employer.