Security Certifications: Are They Worth It?

Every few months someone on my team, or someone I'm mentoring, asks the same question.

"Should I get my CISSP?" Sometimes it's CISA. Sometimes it's a cloud cert, an ISO 27001 Lead Auditor course, or one of the new AI governance credentials that seem to launch every quarter. The question underneath is always the same: is this worth my nights, my weekends, and my money?

My honest answer: certifications are worth it when they open a specific door you are standing in front of. They are not worth it when they are a substitute for the work that actually makes you good at this job.

Let me unpack that.

What a certification actually proves

A certification proves three things. You studied a defined body of knowledge. You passed an exam on it. And, for the better ones, you have a minimum amount of experience and you keep learning to stay current.

That's real. It's just narrower than people think.

Take the CISSP. ISC2 requires five years of paid experience across at least two of its eight domains, the exam costs $749, and keeping it means 120 continuing education credits every three years plus a $135 annual fee. That's a meaningful bar. It tells a hiring manager you have breadth and that you've been around long enough to see a few things.

What it doesn't tell anyone is whether you can walk into a messy environment, figure out what matters, and get a skeptical engineering lead to fix it. No multiple choice exam measures that.

When a certification is absolutely worth it

When it gets you past the filter. This is the unglamorous truth. Many job postings, especially in government, defense, financial services, and large enterprises, list certifications as hard requirements. Some contracts require them by role. If an applicant tracking system or a contract clause is screening you out, the cert is the key to the door, full stop.

ISC2's own 2025 hiring research found that 89% of security hiring managers would consider an entry or junior candidate who holds only an entry level cybersecurity certification, and certifications ranked as a critical attribute slightly more often than IT experience or a degree. Early in your career, a cert like Security+ or ISC2 CC is one of the cheapest ways to prove you're serious.

When you're changing lanes. Moving from IT ops into security, or from security engineering into GRC and audit? A certification in the new lane gives you vocabulary, structure, and credibility while you build the track record. CISA is a great example for someone moving into audit and assurance work. It forces you to learn how auditors think, which makes you better on both sides of the table.

When your clients or auditors expect it. If you run assessments, lead ISO 27001 audits, or sign your name to PCI work, the credential is part of the job. In some of these roles, you literally can't do the work without it.

When you need the structure. Some people learn best with a syllabus and a deadline. If studying for an exam is what finally gets you to understand risk management or cryptography properly, that's a fine reason. Just be honest that the learning is the value, not the letters.

When it's just letters

When you're collecting instead of building. I've interviewed people with eight certifications after their name who couldn't explain how they'd scope a risk assessment for a business unit they'd never seen. I've also worked with people with zero certifications who were the best GRC practitioners in the building. Past a certain point, more acronyms signal that you're good at exams, not that you're good at security.

When the experience isn't there yet. Passing an advanced exam without the experience behind it creates a strange gap. The resume promises senior judgment, and the first real incident reveals junior instincts. You'd be better served spending that year on projects that give you stories to tell.

When nobody in your target role cares. In a lot of startups and product companies, nobody is going to ask about your certifications. They'll ask what you built, what you shipped, and what you'd do about their SOC 2 gap next quarter. If that's where you want to work, a public write up of a real project will do more for you than another exam.

When it's renewal on autopilot. Certifications carry ongoing costs: annual fees, continuing education, and time. If a cert from ten years ago isn't helping you get work or do work, it's fair to ask whether you're maintaining it out of habit.

The questions I'd ask before you spend the money

Before you book the exam, answer these honestly:

What specific door does this open? Name the job, the contract, the client, or the promotion. If you can't name one, that's your answer.
Do the people I want to work for actually ask for it? Look at twenty real job postings for the role you want next. Count how many list it as required versus nice to have.
Do I have the experience to back it up? If not, would the same time spent on hands on work move me further?
What's the full cost? Exam fees, training, study time, annual maintenance, and continuing education. Multiply by the years you plan to keep it.
Will my employer pay for it? Many will. If yours won't for a cert that directly helps their program, that's a useful conversation to have.

What actually builds a security career

Certifications are one signal. The stronger signals are the ones you build on purpose:

Work you can point to. A risk program you stood up, an audit you got through cleanly, a control you automated, a policy set people actually read.
The ability to explain risk to people who don't live in security. If you can make a CFO understand why a vendor matters, you are more valuable than most of the market.
Judgment under ambiguity. The real job is deciding what matters when the framework doesn't give you a clean answer. That comes from reps, not flashcards.
Curiosity that doesn't stop at the exam. The best people I know keep learning because they want to, not because 120 credits are due.

We wrote about this from the hiring side in Hiring Good Security People. The short version is the same: certifications tell you someone studied, and they're often what gets you in the room. What you do once you're in the room is what builds the career.

Bottom line

Get the certification when it opens a door you actually want to walk through, or when the studying itself will make you better at the job you have. Skip it when it's a trophy, a substitute for experience, or a renewal you keep paying out of habit.

The letters can get you the interview. The work is what gets you the offer, and the reputation that lasts after it.

And if you're building a GRC program while you study, episki keeps your controls, evidence, and risk register in one place, so you can spend your evenings on the exam instead of on spreadsheets.