Cybersecurity & IT Certification Roadmap

IT support roadmap

For people new to IT who want a first job supporting users, devices and small networks.

1. CompTIA A+ Core 1 (220-1201) (Entry) — Hardware, mobile devices, networking basics and troubleshooting. Free A+ Core 1 practice test
2. CompTIA A+ Core 2 (220-1202) (Entry) — Operating systems, security basics, software troubleshooting and operational procedures. Free A+ Core 2 practice test
3. CompTIA Network+ (N10-009) (Entry) — The networking depth most support roles grow into. Free Network+ practice test
4. CompTIA Security+ (Entry) — Opens junior security and sysadmin roles. Free Security+ practice test

Networking roadmap

For people who want to build and run networks.

1. CompTIA Network+ (N10-009) (Entry) — Vendor-neutral foundations: addressing, routing, switching, wireless, troubleshooting. Free Network+ practice test
2. Cisco CCNA (200-301) (Intermediate) — The most requested networking certification; hands-on Cisco configuration and troubleshooting. Free CCNA practice test
3. CompTIA Security+ (Entry) — Network roles increasingly own security controls such as ACLs, VPNs and segmentation. Free Security+ practice test

Security operations (SOC) roadmap

For people who want to detect and respond to attacks.

1. CompTIA Security+ (Entry) — The common entry point for security jobs. Free Security+ practice test
2. CompTIA CySA+ (CS0-004) (Intermediate) — Analyst skills: log analysis, threat hunting, vulnerability management and incident response. Free CySA+ practice test
3. GIAC Certified Incident Handler (GCIH) (Advanced) — Deeper incident handling, valued by SOC and IR teams. Free GCIH practice test
4. CompTIA SecurityX (CAS-005) (Advanced) — Advanced, hands-on security architecture and engineering. Free SecurityX practice test
5. ISC2 CISSP (Expert) — The senior credential for security leads and managers. Full certification needs 5 years of paid work in 2+ of the 8 domains (a degree or approved credential waives 1 year); without it you become an Associate of ISC2. Free CISSP practice test

Penetration testing roadmap

For people who want to find vulnerabilities before attackers do.

1. CompTIA Security+ (Entry) — Know the defences you'll be testing. Free Security+ practice test
2. INE eJPT (Entry) — A practical, entry-level hands-on pentest exam. Free eJPT practice test
3. EC-Council CEH (Intermediate) — Broad ethical-hacking coverage that many employers and government roles list. Requires official EC-Council training or an approved application showing 2 years of security experience. Free CEH practice test
4. OffSec OSCP (Advanced) — The best-known hands-on pentest certification: a timed practical exam. Free OSCP practice test

Cloud security roadmap

For people who want to build and secure cloud workloads.

1. AWS Certified Cloud Practitioner (Entry) — Cloud concepts, billing and core services (AZ-900 is the Azure equivalent). Free AWS CCP practice test
2. CompTIA Security+ (Entry) — Security fundamentals that apply in any cloud. Free Security+ practice test
3. AWS Solutions Architect – Associate (Intermediate) — Designing secure, resilient AWS architectures. Free AWS SAA practice test
4. ISC2 CCSP (Expert) — The senior vendor-neutral cloud security credential. Full certification needs 5 years of paid IT experience, including 3 in information security and 1 in a CCSP domain. Free CCSP practice test

Governance, risk & audit (GRC) roadmap

For people who want to manage risk, compliance and security programmes.

1. CompTIA Security+ (Entry) — The technical baseline auditors and risk analysts are expected to have. Free Security+ practice test
2. ISACA CISA (Advanced) — The standard credential for IT audit. Certification needs 5 years of IS audit, control, assurance or security experience (some substitutions allowed); you can pass the exam first. Free CISA practice test
3. ISACA CRISC (Advanced) — IT risk identification, assessment and control. Certification needs 3 years of IT risk and control experience. Free CRISC practice test
4. ISACA CISM (Expert) — Security programme management. Certification needs 5 years of information security experience, 3 of them in security management. Free CISM practice test
5. ISC2 CISSP (Expert) — Broad senior security credential across all eight domains. Full certification needs 5 years of paid work in 2+ of the 8 domains (a degree or approved credential waives 1 year); without it you become an Associate of ISC2. Free CISSP practice test

Certification roadmap: frequently asked questions

Which certification should I get first?

With no IT experience, start with CompTIA A+ for support roles or Network+ if you want networking. For cybersecurity, most people start with Security+: it's entry-level, vendor-neutral and widely requested in job postings. Then specialise — CySA+ for SOC work, eJPT for penetration testing, CCNA for networking, or a cloud fundamentals exam for cloud security.

Do I need A+ before Security+?

No. CompTIA recommends experience rather than requiring earlier certifications, so you can take Security+ first. A+ and Network+ help most if you're new to IT and want a support job while you study security.

Is CySA+ or PenTest+ / eJPT better after Security+?

Choose by role: CySA+ for defensive SOC and analyst jobs, a practical pentest exam such as eJPT (then OSCP) for offensive roles.

Which certifications have experience requirements?

CompTIA and Cisco exams have no formal requirements. ISC2 (CISSP, CCSP) and ISACA (CISA, CISM, CRISC) require years of relevant work to become fully certified, though you can usually pass the exam first. CEH requires official training or an approved experience application.

How long does the roadmap take?

Entry-level exams typically take 1–3 months of study each alongside work. Plan on 1–2 years to go from no experience to an intermediate certification such as CySA+ or CCNA.