Cybersecurity Engineer Certifications (2026): Security+, SecurityX, CISSP-ISSEP and Cloud Certs by Stage

By Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3   Published: 11/11/26   16 min read
Cyber Security Careers

Published November 11, 2026. Exam facts come from CompTIA, ISC2, AWS, Microsoft, Google Cloud and GIAC pages linked in each section, checked on that date. Exam versions change and fees vary by country, so we link to the official pages instead of listing prices.

A cybersecurity engineer builds the controls that analysts later monitor: network segmentation, identity and access, encryption, hardened systems, cloud guardrails and the automation that keeps them in place. CompTIA describes its SecurityX exam as built for “security architects and senior security engineers” (CompTIA), and ISC2 says its ISSEP concentration recognizes the ability “to apply engineering principles and processes to develop secure systems” (ISC2).

No single certification makes someone a security engineer, and the right one depends on where you are. This guide sorts the certifications engineers actually hold by career stage and by the kind of engineering work, with exam facts from each issuer.

Short answer: start with Security+ once you have networking basics. After a few years of hands-on work, pick one platform cert for the cloud you use (AWS Security Specialty, Microsoft SC-500 or Google Professional Cloud Security Engineer). At the senior level, choose CompTIA SecurityX if you want a hands-on engineering exam, or CISSP followed by the ISSEP concentration if you work on government or systems engineering programs. Architects often add ISSAP.

Free one-page guide

Which cert next

Networking, then Security+, then the cert the job actually names: SecurityX if you stay technical, CISSP over CISM when you want to lead, CCSP after CISSP for cloud, CEH when postings require it, plus where ISC2 CC and PMP fit. From CyberExperts.
Join the CyberExperts Daily Brief. The PDF shows up here after you subscribe.

Cybersecurity engineer certifications at a glance

CertificationIssuerStageEngineering focusExperience the issuer asks for
Security+CompTIAEntryCore security controls, identity, cryptography, monitoringRecommended: Network+ and two years as a security or systems administrator (V7); two years hands-on as a security administrator (V8)
AWS Certified Security – SpecialtyAWSMidSecurity solutions on AWSIntended for five years of IT security experience and two or more years securing AWS workloads
Cloud and AI Security Engineer Associate (SC-500)MicrosoftMidAzure, hybrid and AI workload securityPractical Azure and hybrid administration, strong Microsoft Entra ID familiarity
Professional Cloud Security EngineerGoogle CloudMidGoogle Cloud security design and operationsNone required; 3+ years of industry experience recommended, including 1+ year on Google Cloud
GCSAGIACMidDevSecOps and CI/CD securityNo prerequisite listed
GDSAGIACMid to seniorDefensible security architecture, Zero TrustNo prerequisite listed
SecAI+CompTIAMidSecuring AI systems and AI-assisted securityRecommended: 3 to 4 years in IT and 2+ years hands-on cybersecurity
SecurityX (formerly CASP+)CompTIASeniorSecurity architecture and engineering, hands-onRecommended: 10 years of IT, including 5 years hands-on security
CCSPISC2SeniorCloud security architectureRequired: 5 years in IT, 3 in cybersecurity, 1 in a CCSP domain (CISSP covers it)
CISSPISC2SeniorBroad security program designRequired: 5 years in two or more of eight domains
CISSP-ISSEPISC2Senior specialistSystems security engineeringRequired: CISSP plus 2 years, or 7 years in two or more ISSEP domains
CISSP-ISSAPISC2Senior specialistSecurity architectureRequired: CISSP plus 2 years, or 7 years in two or more ISSAP domains
SecOT+CompTIAMid to senior (pre-order)Operational technology securityRecommended: 3+ years in OT and 2+ years implementing OT security

“Recommended” means the issuer suggests it but does not check it. “Required” means the issuer will not grant the certification without it. ISC2 lets you pass the CISSP or CCSP exam first and become an Associate of ISC2 while you build the experience.

Which certification fits which kind of security engineer

CompTIA’s certification catalog tags SecAI+ and SecOT+ with the Security Engineer job role and SecurityX with Security Architect (CompTIA). Our CompTIA cybersecurity certifications pathway shows how the whole CompTIA lineup fits together, from A+ to SecurityX.

Security+: the baseline most engineers start with

Security+ covers the controls an engineer configures every day: security architecture, identity and access management, cryptography, monitoring and incident response. Two versions are in play right now.

CompTIA lists Security+ V7 against DoD 8140 work roles that include system administrator, network specialist and security control assessor (CompTIA). Our Security+ exam guide walks through the SY0-701 objectives domain by domain.

SecurityX: CompTIA’s exam for senior security engineers

SecurityX (exam CAS-005, the renamed CASP+) launched December 17, 2024. It has up to 90 multiple-choice and performance-based questions, a 165-minute limit, and a pass/fail result with no scaled score. CompTIA recommends at least ten years of hands-on IT experience, including five years of hands-on security, with Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge (CompTIA).

SecurityX V5 domainWeightEngineering topics in the objectives
Security engineering31%Scripting (PowerShell, Bash, Python), infrastructure as code, cloud APIs, SOAR, vulnerability management, SCAP, post-quantum and other advanced cryptography
Security architecture27%CASB, CI/CD pipelines, Terraform and Ansible, container security, segmentation and microsegmentation, SASE, Zero Trust
Security operations22%SIEM tuning, threat hunting with Sigma, YARA and Snort, malware analysis, root cause analysis
Governance, risk and compliance20%Threat modeling (ATT&CK, CAPEC, STRIDE), risk assessment, compliance frameworks

CompTIA maps SecurityX to NICE and DoD 8140 work roles including security architect, systems requirements planner and security control assessor. Retirement is estimated for 2027, about three years after launch. For the comparison people search most, read SecurityX vs CISSP or our SecurityX exam guide.

CISSP, then ISSEP or ISSAP

CISSP tests security program design across eight domains rather than hands-on configuration. ISC2 requires five years of cumulative, full-time experience in two or more of those domains. A degree or a credential from ISC2’s approved list can cover one year; that list includes Security+, SecurityX, CASP+, CySA+, CCSP, AWS Certified Security – Specialty and CCNA (ISC2). ISC2 notes that the CISSP exam moves to a new outline on April 15, 2027 (ISC2). Our CISSP exam guide covers the format.

After CISSP, ISC2 offers two concentrations that matter to engineers:

CISSP-ISSEP (Systems Security Engineering)CISSP-ISSAP (Security Architecture)
Exam125 items, 3 hours, multiple choice and advanced item types125 items, 3 hours, multiple choice and advanced item types
Passing grade700 out of 1000700 out of 1000
Language and deliveryEnglish, Pearson test centerEnglish, Pearson test center
Domains and weightsSystems Security Engineering Foundations 24%; Risk Management 20%; Security Planning and Engineering 22%; Implementation, Verification and Validation 20%; Secure Operations, Change Management and Disposal 14%Governance, Risk and Compliance 21%; Security Architecture Modeling 22%; Infrastructure and System Security 32%; IAM Architecture 25%
ExperienceCISSP in good standing plus 2 years in an ISSEP domain, or 7 years in two or more ISSEP domains (one year can be waived)CISSP in good standing plus 2 years in an ISSAP domain, or 7 years in two or more ISSAP domains (one year can be waived)
Typical roles ISC2 listsSenior systems engineer, information assurance systems engineer, information assurance officerSystem architect, CTO, system and network designer, chief security officer

Sources: ISSEP exam outline, ISSAP exam outline. ISSEP’s outline follows the systems engineering life cycle: requirements, design, verification and validation, operations and disposal. ISC2 describes the ISSEP as supporting “system security assessment and authorization for government and industry.” Both concentrations are ANAB accredited under ISO/IEC 17024 and listed as DoDM 8140 approved on ISC2’s pages. See our DoD 8140 certifications guide for how work roles map to certifications.

Cloud security engineer certifications

Architecture, DevSecOps and AI options from GIAC and CompTIA

A typical certification path for a cybersecurity engineer

  1. IT and networking foundation. CompTIA recommends Network+ before Security+ for V7 (Network+). Our Network+ guide covers N10-009.
  2. Security+. The first security cert for most engineers, and on ISC2’s list of credentials that can waive a year of CISSP experience.
  3. A hands-on job. Systems administrator, network engineer, cloud engineer or SOC analyst. Every senior certification here asks for years of work, so the job matters more than a second entry-level cert.
  4. A platform cert. AWS Security Specialty, SC-500 or Google Professional Cloud Security Engineer, matched to the cloud you run.
  5. A senior cert. SecurityX if you stay hands-on, CISSP if you are moving toward design and leadership.
  6. A concentration. ISSEP for systems security engineering, ISSAP for architecture.

Our cybersecurity certification path and map shows the same steps for every domain, and how to become a cybersecurity specialist covers the experience side.

Job outlook for security engineering work

The U.S. Bureau of Labor Statistics counts most security engineering jobs under information security analysts. It projects employment in that occupation to grow 21 percent from 2025 to 2035, with about 14,100 openings a year on average. BLS says many employers prefer to hire candidates who have information security certification, and that many analysts first work in an IT department, often as network and computer systems administrators (BLS).

Cybersecurity engineer certification cost: who pays

Fees differ by issuer, country and exam version, so check the official price on each certification page before you budget:

Before paying yourself, ask whether your employer funds certifications tied to your work, such as a cloud cert before a migration. Under DoD 8140, service members, DoD civilians and contractors in covered work roles should ask their command or contract lead how certification is funded. Renewal costs count too: CompTIA certifications renew on a three-year cycle with continuing education units (50 for Security+, 75 for SecurityX) (CompTIA CEUs). If you are paying yourself, compare totals in our certification cost calculator and cheapest cybersecurity certifications list.

Cybersecurity engineer certification questions

What certifications do you need to be a cybersecurity engineer?

No certification is legally required, but most engineers start with CompTIA Security+ and add a cloud platform certification (AWS Security Specialty, Microsoft SC-500 or Google Professional Cloud Security Engineer). Senior engineers usually hold CompTIA SecurityX, ISC2 CISSP, or both, and some add the CISSP-ISSEP or CISSP-ISSAP concentration.

Is SecurityX or CISSP better for a security engineer?

SecurityX is the more hands-on engineering exam: its largest domain is security engineering (31%), and it includes performance-based questions. CISSP is broader and leans toward program design and management, and it requires five years of experience. Engineers who plan to stay technical often take SecurityX first; those moving toward architecture or leadership take CISSP.

What is the ISSEP certification?

ISSEP (Information Systems Security Engineering Professional) is an ISC2 concentration for CISSP holders, developed with the U.S. National Security Agency. The exam has 125 items in 3 hours with a passing grade of 700 out of 1000, across five domains that follow the systems engineering life cycle. You need CISSP plus two years of ISSEP-domain experience, or seven years of experience in two or more ISSEP domains.

What is the best cloud security engineer certification?

Pick the platform you work on: AWS Certified Security – Specialty for AWS, Microsoft SC-500 (Cloud and AI Security Engineer Associate, which replaced AZ-500 on August 31, 2026) for Azure, or Google Professional Cloud Security Engineer for Google Cloud. ISC2 CCSP is the vendor-neutral option for senior cloud security roles.

Can I become a security engineer with only Security+?

Security+ is an entry-level certification. CompTIA recommends two years of hands-on experience as a security or systems administrator for it. Most security engineer roles also expect hands-on work in systems, networks or cloud, which is why the senior engineering certifications ask for five to ten years of experience.

How much do cybersecurity engineer certifications cost?

Each issuer publishes its fees on the certification page: CompTIA in the Buy Now section, ISC2 on its register for exam page, AWS on its exam pricing page, and GIAC at giac.org/pricing. Employers and DoD 8140 programs often pay, and AWS gives a 50% discount on your next AWS exam after your first certification.

Which CompTIA certification is for security engineers?

SecurityX (exam CAS-005) is CompTIA’s certification for security architects and senior security engineers. CompTIA also tags SecAI+ and the upcoming SecOT+ with the Security Engineer job role. Security+ is the usual starting point before any of them.

Sources

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.