Skip to content
CertGPS
Career path

Choosing Your First Security Certification: Match It to Your First Job and What It Counts Toward

How to pick a first security certification: by the first job you'll apply for, then by upkeep cost and what each exam counts toward, from DoD 8140 to the CISSP.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

Choosing Your First Security Certification: Match It to Your First Job and What It Counts Toward

Pick your first certification for the first job you'll apply to, then for what it keeps doing after you pass. On that second test Security+ wins clearly: CompTIA maps it to DoD 8140 work roles, ISC2 accepts it for one of the CISSP's five years of experience, and it renews Network+ for free. The other entry exams each fit a narrower case.

Start from the first posting

Most first security jobs fall into a few groups, and each points to a different exam.

If the first job you can realistically get is IT support or junior networking, you'll be hired to keep the network running, and Network+ tests exactly that: CompTIA maps it to the DoD 8140 technical support specialist, network operations specialist and system administrator roles, and recommends 9 to 12 months of network support work before you sit it.

For a security operations center (SOC) or junior analyst role, Security+ is the safest first exam, because CompTIA maps it to the DoD 8140 cyber defense analyst role. If the employers you're targeting run Microsoft's security stack, SC-200 tests Defender XDR, Sentinel and threat hunting in KQL; it renews free each year through an online assessment, and Microsoft updates the English exam on October 21, 2026. If you can afford a second exam, a lab-graded one such as BTL1 shows you can investigate as well as recognize terms. Centri, which runs BTL1, recommends it for people with up to two years of experience and maps its content to the NICE cyber defense analyst role.

For governance, risk and compliance (GRC) roles, ISC2 Certified in Cybersecurity is cheap and on topic. Its outline since September 1, 2026 gives Security Governance 17.3% of the exam.

For penetration testing, the entry exam that tests the work is INE's eJPT, a 48-hour lab in which you answer 45 questions by scanning and exploiting a small network. INE revised it on March 26, 2026, so check that any course you buy matches the new version. For defense contractors and government work, check which certifications the DoD 8140 matrix lists for the work role in the posting; Security+ covers many of them.

If you don't know yet which job you want, GFACT checks your computing foundations, and GIAC names career changers and self-driven learners among its audience.

What each exam costs to keep, and what it counts toward

CertificationExam priceUpkeepCounts toward later
CC$199$50 a yearApproved under DoDM 8140.03; not on ISC2's list of credentials that waive a CISSP year
Security+$43950 CEUs and $150 every three yearsDoD 8140 work roles; waives one CISSP year; renews Network+ and A+
Network+$39930 CEUs and $150 every three years, or renewed by passing Security+DoD 8140 support, network and administrator roles
GFACT$39936 CPEs and $199 every four yearsA foundations check before GIAC's $999 exams
BTL1£399 with trainingNone; it doesn't expireNICE cyber defense analyst content, per Centri
eJPTVoucher needs an INE subscription36 CPEs and $99 every three years, or renewed by eCPPT or eWPTINE's penetration testing path

The CISSP asks for five years of experience in two or more of its eight domains, and ISC2 will take one year off for a credential on its waiver list. Security+ is on it, as are CySA+, SSCP and CCNA; CC isn't. And CompTIA's hierarchy means passing Security+ renews any Network+ or A+ you already hold, so taking Network+ first costs nothing extra to maintain once you move up.

What changes the choice this year

Security+ is changing version. SY0-801 is expected to launch on or around November 17, 2026, and English SY0-701 retires on June 11, 2027. CompTIA's voucher terms say an exam's retirement date overrides the voucher's expiry, so a V7 voucher bought late can lapse with the exam. If you're starting from scratch this autumn, prepare for SY0-801.

CC is no longer free for new candidates. ISC2 closed its One Million Certified in Cybersecurity program to new enrollments on May 20, 2026. Anyone already holding a free exam code must sit by December 31, 2026; everyone else pays $199.

The experience recommendations are also worth reading as signals. CompTIA writes Security+ for someone with two years as a security or systems administrator, and Network+ for 9 to 12 months of network support. These aren't requirements, and people pass sooner, but they tell you how much hands-on practice each exam assumes.

If you still can't decide

Take Security+ if you can give it the lab time; it counts toward more later than any other exam here. Take CC first if you're unsure security is for you, or if Security+'s price is the obstacle, then move to Security+ once you're committed. Take Network+ first only if networking questions keep defeating you in Security+ practice tests. Take eJPT instead if you already know you want to test, and you can afford the INE subscription.

Whatever you choose, stop at one knowledge exam and one practical credential, and put the rest of the effort into getting hired. Our route from no experience covers the job search that follows, the Security+ and CC comparison goes deeper on those two, and our self-taught guide compares the lab-graded options in more detail.

Our view

Security+ is a sensible default, and an unexciting one. A practical exam will usually tell an interviewer more about you. But in our view no other first certification keeps working for you in so many places at once: federal and contractor screens through DoD 8140, ISC2's experience rules, and CompTIA's own renewals. Pair it with one practical credential in the direction you want to work.

Sources