Skip to content
CertGPS
Career path

After a Cybersecurity Bootcamp: Your Voucher, the Next Certification and the Experience Gap

For bootcamp graduates: using a CompTIA voucher before the Security+ and CySA+ version changes, picking the next exam by job, and routes to work experience.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

After a Cybersecurity Bootcamp: Your Voucher, the Next Certification and the Experience Gap

If your bootcamp ended with an exam voucher, check the exam code on it this week. CompTIA expects Security+ SY0-801 to launch on or around November 17, 2026, CySA+ CS0-003 retires in English on December 22, 2026, and an exam's retirement date overrides a voucher's expiry. Once that exam is done, the gap the Bureau of Labor Statistics describes is work experience, so choose the next certification for how well it helps you get hired.

First, the voucher

CompTIA's voucher terms tie each voucher to an exam series, and sometimes to a specific exam code. If the exam retires first, the voucher goes with it, whatever expiry date is printed on it. Retake vouchers can't be moved to another version.

For Security+, that leaves two cases. If your bootcamp taught SY0-701 and you're close to ready, sit it before spring 2027. English SY0-701 retires on June 11, 2027, and you'll want room for a second attempt: CompTIA allows one straight away but makes you wait 14 days before a third. If you're starting your revision mostly from scratch, prepare for SY0-801 instead, which adds objectives on threats from artificial intelligence and drops blockchain, and check whether your voucher covers the new code.

CySA+ is the tighter deadline. English CS0-003 retires on December 22, 2026, and CS0-004 has been live since June 23, 2026. A bootcamp that taught V3 material leaves you about ten weeks to sit it. CompTIA also writes CySA+ for about four years as a level 2 SOC or vulnerability analyst, so a pass without that experience proves knowledge rather than a work history. Sit it if the voucher is paid for; don't buy it new as your second certification.

Other vouchers run on their own clocks. An INE eJPT voucher is valid for 180 days from purchase, and a GIAC attempt must be used within 120 days of activation.

Take stock of what you practised

A bootcamp covers a lot in a short time, and some of it was demonstrated rather than done. Go back through the syllabus and mark each topic one of three ways: done hands-on in a lab, watched or read about, or skipped. Then compare it against something outside the bootcamp. The NICE Workforce Framework's Defensive Cybersecurity work role (PD-WRL-001) lists tasks such as identifying anomalous network activity, detecting intrusions, isolating malware and resolving incidents. The Security+ objectives list the scenarios CompTIA expects you to handle. Anything you only watched goes back into a home lab before you rely on it in an interview.

The next certification, chosen by the job

Pick the next credential by the posting you're applying for.

For SOC and incident response roles, take a lab-graded exam that proves you can investigate. BTL1 gives you up to 24 hours inside a compromised network to answer 20 task-based questions, and Centri, which runs it, recommends it for people with up to two years of experience. HTB CDSA is a seven-day investigation graded on a written incident report, and you must complete Hack The Box Academy's SOC Analyst path before you can buy the $210 voucher. If the employers you're targeting run Microsoft Defender XDR and Sentinel, SC-200 costs $165 and tests that stack.

For penetration testing, the eJPT is the entry point. It asks you to scan, exploit and pivot through a lab over 48 hours, and INE aims it at people with little to no security experience. Leave PenTest+ until later, since CompTIA writes it for three to four years in a penetration tester role.

For governance, risk and compliance (GRC) roles, ISC2 Certified in Cybersecurity is a cheap, relevant step. It costs $199 plus a $50 yearly fee, needs no experience, and its outline since September 1, 2026 includes a Security Governance domain worth 17.3%, covering how GRC work is planned and measured with metrics and key risk indicators.

Whatever the direction, stop after one practical credential and put the effort into applications. In our view, a second lab-graded result next to a bootcamp certificate adds little over the first.

Closing the experience gap

The Bureau of Labor Statistics (BLS) lists related work experience among the usual requirements for information security analysts and says many come from IT departments, often as network and computer systems administrators. CyberSeek, the job-posting tool CompTIA runs with Lightcast, names IT support, networking and systems engineering as feeder roles into security. BLS also says computer support jobs can be open to people with a high school diploma plus IT certifications, an entry route worth considering for a bootcamp graduate with Security+. Individual employers still set the requirements for each vacancy.

Registered apprenticeships are the other route. The Department of Labor lists cybersecurity support technician, cyber defense incident responder and cybersecurity analyst among the cybersecurity occupations run as registered apprenticeships, which combine paid work, classroom instruction and a nationally recognized credential. Apprenticeship.gov, the Department of Labor's apprenticeship site, is the place to search for programs.

If you want an ISC2 credential while you look, SSCP ($249) lets you pass the exam now and hold the Associate of ISC2 designation, with two years to earn the one year of experience it requires. Veterans paying for training through VA programs should read our military transition guide, which covers GI Bill test reimbursement.

Our view

Bootcamps are usually judged by their placement claims, a question our bootcamp and self-study comparison takes up. Your own next six months matter more. Use the voucher before it lapses, add one practical credential, and apply for IT support, apprenticeship and junior SOC roles in parallel. Graduates who'd rather keep studying alone for a while can use our self-taught plan, and anyone who lands an IT job first can follow the IT-to-security route from there.

Sources