A sound cybersecurity certification roadmap starts with the role you want, not the credential: Security+ for foundations, CEH for offensive testing, CISSP for security management, CISA for audit and assurance. This guide, from JCSS Indonesia's IS-audit perspective, explains what each requires and how to sequence them.
What should a cybersecurity certification roadmap look like?
Pick the career track first, then take one foundation certificate, one specialist certificate and one senior credential, in that order, while building hands-on experience alongside.
Certificates are signalling devices. Employers read them as evidence that you studied a recognised body of knowledge, and experience-based credentials also signal that someone verified your work history. The sequence that works for most people is foundation, then specialism, then a management or audit credential once the experience requirement is within reach. Collecting several entry-level certificates adds little once you hold one.
Which certifications suit which career track?
Operations and engineering roles lean towards CompTIA and EC-Council credentials, security leadership towards ISC2 and ISACA credentials, and audit and assurance towards ISACA.
| Track | Starting credential | Next step | Senior credential |
|---|---|---|---|
| Security operations and engineering | CompTIA Security+ | CEH or vendor cloud credentials | CISSP |
| Offensive security and testing | CompTIA Security+ | CEH, then a practical lab-based exam | CISSP or specialist |
| Governance, risk and management | Security+ | CISM or CISSP | CISM or CISSP |
| IS audit and assurance | Security+ or audit foundation | CISA | CISA with CISM or CDPSE |
| Privacy | General security foundation | CDPSE | CDPSE with CISA or CISM |
CISM and CDPSE are also ISACA credentials; check ISACA's site for their current requirements.
What do Security+, CEH, CISSP and CISA require?
Security+ and CEH are exam-focused entry and mid-level credentials, while CISSP and CISA also require several years of verified professional experience.
| Credential | Issuer | What the issuer publishes |
|---|---|---|
| Security+ | CompTIA | Exam with up to 90 questions in 90 minutes; passing score 750 on a 100 to 900 scale |
| CEH v13 | EC-Council | 125 multiple-choice questions in 4 hours; official training or an eligibility application |
| CISSP | ISC2 | Five years cumulative paid or unpaid work experience in two or more of the eight exam domains; one year may be waived by a degree or approved credential |
| CISA | ISACA | Five years of IS audit, control, assurance or security experience within the last ten years; scaled passing score of 450 on a 200 to 800 scale |
Two practical points. First, CompTIA's page announces a new Security+ version, so confirm the current exam code before you book or buy study materials. Second, a candidate without the experience for CISSP can pass the exam and become an Associate of ISC2 while accumulating it, and ISACA likewise allows the CISA exam to be taken before the experience is complete, with certification awarded only once it is. Fees, retake rules and pass marks change, so treat the issuer's page as the authority.
How do you build experience while studying?
Study alone does not satisfy experience-based credentials, so deliberately collect work that maps to the exam domains and keep evidence your verifier can sign off.
- Keep a log: record projects, controls tested, incidents handled and tools used, with dates and a supervisor who can verify them.
- Practise in a lab: run your own vulnerable test environment; skills are tested more directly in lab-based exams.
- Volunteer for audits and reviews: access reviews, backup restoration tests and change-management sampling count as real control work.
- Read primary sources: the NIST Cybersecurity Framework 2.0 and the OWASP API Security Top 10 (2023) are free and appear throughout professional exams and real engagements.
For ISACA's experience rule, note that the five years must fall within ten years before the application, and that verification is by a third party.
What do certificates not tell an employer?
A certificate shows you passed an exam; it does not show judgement, communication or the discipline of documenting evidence, which is what auditors and clients actually pay for.
Hiring managers in assurance teams look for people who can explain a control failure in plain language to a finance director, size its impact, and propose a proportionate fix. If you are choosing between a fourth certificate and a documented project that did this, take the project. Certificates open the interview; the project wins it.
How does this connect to the IS-audit profession?
Audit-oriented credentials such as CISA sit where cybersecurity meets finance and risk, which is also how our practice approaches IT general controls and information security reviews. If your interest is the audit side, our notes on what VAPT testing is and the ISO 27001 certification process show how technical testing and management-system assurance are scoped in practice. For organisations rather than individuals, JCSS Indonesia provides internal audit, ITGC and cybersecurity reviews as independent assurance over these same controls.
Frequently asked questions
Which cybersecurity certification should a beginner take first?
CompTIA Security+ is the usual starting point because it covers general security concepts without requiring prior work experience. CompTIA lists up to 90 questions in 90 minutes with a 750 passing score on a 100 to 900 scale. Check CompTIA's site for the current exam version before booking, because a new version has been announced.
Is CISSP or CISA better for an audit career?
CISA is built for auditing, control and assurance, so it fits an IS-audit career more directly. CISSP is broader and aimed at security management and architecture. Many senior practitioners hold both. Choose by the work you do day to day; each needs five years of relevant experience, with limited waivers for CISSP.
Can I take CISSP or CISA without the required experience?
Yes, in both cases you can sit the exam first. Passing CISSP without the experience makes you an Associate of ISC2 until you meet it, and ISACA allows the CISA exam before the experience requirement is met, awarding certification afterwards. Confirm the current timelines and fees with ISC2 and ISACA directly.
How long does a CISA stay valid?
ISACA requires certified members to report a minimum of 120 continuing professional education hours over a three-year cycle, with at least 20 hours each year, and to follow its Code of Professional Ethics and auditing standards. Maintenance requirements change, so check ISACA's current rules for your renewal period.
Are certifications enough to get a cybersecurity job?
Rarely on their own. Certificates help you pass screening, but employers also look for demonstrable hands-on work, clear writing and sound judgement. Pair each credential with a documented project, such as a lab build, an access review or a control test, so you can show what you did with the knowledge.
General information only, not legal or tax advice for your specific facts. Regulations change; confirm the current position with JCSS Indonesia before acting.