Which Certification to Get First After Your Cybersecurity Degree
Do you need a certification at all, and if so which one first? The honest answer depends on your experience, because several well-known certifications are designed for people who already work in the field. This guide separates the ones that are open to graduates from the ones that are not.
What the UK job market shows
IT Jobs Watch, which tracks UK permanent job adverts, counted 6,765 adverts citing cybersecurity in the six months to 2 November 2026. CISSP appeared in 8.9% of them, and 14.3% mentioned security clearance. In the sample adverts we read, certifications such as Security+, CySA+, CISSP, CISM and Microsoft security exams were mostly listed as desirable rather than essential. We have not measured how often Security+ appears, so we do not claim it is the most requested.
Three common options compared
| Certification | Experience published | What to know |
|---|---|---|
| ISC2 Certified in Cybersecurity (CC) | None; ISC2 describes it as entry level with no work experience required | Designed for people entering the field. ISC2 says CC holders must earn continuing education credits over a three-year cycle |
| CompTIA Security+ | No formal prerequisite; training providers summarising CompTIA’s guidance say it recommends Network+ and around two years in IT administration with a security focus | The exam version changes, and certification is valid for three years. Check which version is current before you book |
| ISC2 CISSP | At least five years of paid experience in two or more domains | ISC2 offers an Associate route: you can pass the exam first and then have time to earn the experience. Plan this as a later goal |
What the adverts we read ask for
In the UK adverts we read, entry and mid-level engineering roles list options such as Security+, CySA+, PenTest+ or Microsoft security certifications. Senior and management roles tend to list CISSP, CISM or similar. Because most are marked desirable, a certification is best treated as supporting evidence, not a gate.
How to choose, in our reading
- Read ten real adverts for the role you want and note which certifications repeat.
- Check each certification’s published requirements and current exam version on the provider’s own page.
- Match it to your gap. If your degree is light on networking or practical security, a foundation certification helps most.
- Pair it with something you can show, such as a lab write-up, so you can talk about it in an interview. Our guide to writing a CV for UK cybersecurity roles shows how.
What we could not confirm
We could not read CompTIA’s own certification page, so the Security+ details come from training providers summarising it. We have not given exam prices because they change and vary by country. Certifications do not affect your visa. For how sponsorship works, read do UK cybersecurity employers sponsor international graduates, and for pay, see our salary guide.
Sources and checks
- ISC2, Cybersecurity certifications, read on 5 November 2026
- ISC2, Why Certified in Cybersecurity suits entry-level hiring (ISC2’s own view as a certifying body), read on 5 November 2026
- IT Jobs Watch, Cybersecurity job trends (six months to 2 November 2026), read on 5 November 2026
- Pluralsight, CompTIA Security+ SY0-701 path (a training provider’s summary of CompTIA’s recommendations), read on 5 November 2026
Figures checked: November 2026. This is general information, not career or financial advice. Certification rules, versions and prices change, so confirm them with the provider.