RMFInsider

“What certs do I need to get into cybersecurity, and what order do I take them in?” Here is the order that works if you are aiming at DoD or cleared work: a baseline cert that clears the hiring filter, a hands-on analyst cert that proves you can do the work, a role specific cert once you know which chair you want, and a senior cert at the end. Security+ first, CySA+ or an equivalent second, cloud or GRC or audit third, CISSP or SecurityX last. The order carries more weight than the brand names, because every cert you pay for has to unlock one of exactly two things: a job filter you are currently failing, or a pay band you cannot reach without it. A cert that unlocks neither is the money that quietly disappears in this field.

The four stage roadmap, in order

• Stage one, the filter cert. CompTIA Security+ or ISC2 CC. This is the line a contract recruiter searches for and the line that satisfies a DoD baseline screen. It does not make you good. It makes you visible.
• Stage two, the proof cert. CompTIA CySA+, Splunk Core Certified User, or a cloud associate credential. This one says you can read a log, write a finding, and survive a technical screen.
• Stage three, the role cert. Cloud security, GRC, or audit, chosen after you have read fifty real job postings for the role you actually want and seen what repeats.
• Stage four, the pay cert. CISSP, SecurityX, or CISA. You take it when you already have the experience it certifies, because at that point it is a salary negotiation instrument, not a learning exercise.

Four stages, three to five years, three or four vouchers if you do it cleanly. Compare that to the path I watch people take: five certs in eighteen months, no job, and a renewal bill every January for credentials that never came up in a single interview.

Why sequence beats selection

Certifications do not accumulate value linearly. They work like keys, and a key is worth whatever the door behind it is worth. A baseline cert opens the door marked “a human reads the resume.” An analyst cert opens the door marked “the technical screen goes well.” A senior cert opens the door marked “the offer comes in higher.” Hold three keys to the same door and you have paid three times to stand in one hallway.

This is why the Security+ versus CySA+ versus CCNA question for a first cert gets answered wrong so often. People debate which one teaches more. That is the wrong axis. At stage one you are not buying education, you are buying passage through an automated filter, and the filter has a specific list. Pick the cert that is on the list for the jobs you are applying to, pass it, and move on.

The second reason sequence matters is credit. Experience counts toward senior certs, and a stage four cert taken too early turns into an associate designation that sits in limbo until the years arrive. You paid full price for a provisional title. Taken in order, that same exam lands the week you become eligible and converts into a raise conversation.

Stage one: clear the filter before you try to impress anyone

Security+ is the default stage one choice for DoD adjacent work, and as of 2026 the published voucher price sits at roughly $439 in the United States, with study material pushing a realistic first attempt to roughly $500 to $700 as of 2026. That is real money for a career changer. It is also the cheapest filter clearance available, which is why it comes first.

What Security+ actually buys you

Three things. It satisfies the baseline requirement attached to a long list of DoD cyber work roles, so a contractor can place you without a waiver conversation. It gets your resume past the keyword screen on postings where the cert name is written into the requisition. And it gives you shared vocabulary, so when an assessor says “compensating control” in a kickoff meeting you are not quietly googling under the table.

What it does not buy you

It does not buy you a job offer by itself, and the sooner you accept that the less money you waste. I have fired a resume carrying three entry level certs into an applicant tracking system and been rewarded with a silence so complete that I logged into a second email account to confirm mine still worked. The cert cleared the filter. It had nothing to say about whether I could do the work, and the hiring side knew it.

Stage two: prove you can do the work

Stage two is where the resume stops being a list and starts being an argument. CySA+ is the common choice because it is analyst shaped: detection, triage, vulnerability management, incident response. As of 2026 the voucher runs roughly $425 to $450. A cloud associate credential works here too, as does a vendor cert in whatever tool the posting names, frequently Splunk, Tenable, or a cloud provider’s native security console.

The test for a stage two cert is simple. Does it give you something to say when an interviewer asks what you would do with an alert? If the honest answer is “I would recognize the vocabulary,” you are still at stage one. Pair the cert with a home lab and a written artifact: the cert earns you the question, the artifact answers it.

This is also the point where the trifecta argument shows up. Someone will tell you to collect A+, Network+, and Security+ before you apply anywhere. Read the case for and against the full CompTIA trifecta before you commit eighteen months and three vouchers to that plan, because the answer depends entirely on whether you are coming from a help desk background or from outside IT altogether.

Stage three: pick the role, then the cert

Stage three gets skipped because it requires a decision people would rather postpone. You cannot pick a role specific cert until you have picked a role. Cloud security, GRC, security engineering, and detection engineering all have different third certs, and the wrong one is not merely neutral, it points your resume at jobs you do not want.

If cloud is the direction, the cloud security certifications worth taking for a first cyber job conversation is where to start, and the price spread matters: as of 2026 a Microsoft security associate exam sits near $165 while an AWS specialty exam sits near $300. If GRC is the direction, the practical third qualification in the federal space is less a cert than demonstrated eMASS and RMF package experience.

Do this before you buy: open fifty live postings for the role, and tally which certifications appear in the requirements section rather than the nice to have section. The tally picks your cert. Your preferences do not.

Stage four: the senior cert is a pay event, not a learning event

CISSP sits at stage four. As of 2026 the exam registration fee is roughly $749, the annual maintenance fee runs near $135, and the credential requires five years of cumulative paid experience across two or more of its domains. I am working toward it myself, which means I can tell you what the study load feels like and what the eligibility math looks like, and nothing at all about what it feels like to hold it.

What I can tell you is how it functions in the market. CyberSeek’s 2025 reporting counted over 82,000 United States job postings naming CISSP, more than any other security certification, and that demand sits at the senior and management end. Which is exactly why buying it in year one is a poor trade. You pay the full fee, pass the exam, and receive an associate status that converts to the real credential only when the experience arrives. A recruiter reading a senior credential on top of a junior history sees a mismatch, not a feature.

Take it when the experience is already in hand. Then it is a number you negotiate with.

The DoD wrinkle: your work role picks your options

Aim this at DoD work and the roadmap stops being a preference and becomes a compliance artifact. Your assigned cyber work role determines which certifications are acceptable, and that list differs for an ISSO, a SOC analyst, and a system administrator. You can hold an excellent certification that does not qualify you for the role your contract needs filled.

Two things are worth reading before you buy anything in this lane. First, which certifications actually qualify an ISSO under DoD 8140, because the ISSO lane has its own acceptable list and it is narrower than people assume. Second, what changed in the move from DoD 8570 to 8140, because the old rigid baseline chart was replaced with a qualification model that counts education and experience alongside certifications. The practical effect is that your relevant experience can now carry weight it did not carry under the old chart, which changes the math on whether a third cert is worth buying.

The cleared angle is the other half. A clearance is the one filter no certification substitutes for, and the advice inverts: take the job that sponsors the investigation even if the title is dull, because a clearance appreciates while a cert depreciates on a three year renewal clock.

The orders that waste money

• Starting at stage four. Buying CISSP with no qualifying experience converts roughly $749 into a provisional title and a maintenance fee.
• Stacking stage one. Three baseline certs clear the same filter once. The second and third add a renewal bill and nothing else.
• Buying a role cert before picking a role. A cloud specialty on a resume aimed at GRC postings reads as indecision.
• Renewing a cert the roadmap has moved past. CompTIA’s continuing education pyramid renews lower credentials automatically when you pass a higher exam, so paying separate fees down the stack is avoidable.
• Letting a qualifying cert lapse. An expired baseline cert can cost you a work role assignment on a federal contract, which is a far more expensive problem than a renewal fee.

What to skip entirely

Skip any certification whose selling point is that it is easy. Skip bundled bootcamp packages promising four certifications and a job, because the certifications are real and the job is not part of the transaction. Skip a second baseline cert. And skip the instinct to keep studying instead of applying, which is a comfortable way to spend a year getting no closer to a paycheck. Applying is the part that produces offers.

One stage at a time, with a job application campaign running between stages, will outperform a stack of credentials collected in a vacuum. If you want the sequencing, the resume work, and the application campaign laid out as one plan with deadlines attached, that is exactly what Zero to Hired walks you through, and it is built around the order above rather than a shopping list.