CompTIA Cybersecurity Career Pathway

With the increase in cyberattacks and the number of new connected devices, the need for skilled cybersecurity professionals is growing at a rapid pace. The CompTIA Cybersecurity Career Pathway can help you get into cybersecurity.

Like it or not, data breaches are a part of our digital world. They are happening every day due to a number of factors. More than half (52%) of data breaches are caused by a malicious attack, according to IBM’s Cost of a Data Breach 2020 report, and on average it takes 280 days to identify a cyberattack. With statistics like these, it’s no surprise that the average cost of a data breach is an astounding $3.86 million.

With cybercrime on the rise and vulnerabilities constantly being exposed, it is imperative that organizations take a proactive stance to protecting assets and employing skilled cybersecurity professionals. In fact, the U.S. Bureau of Labor Statistics (BLS) predicts that the number of information security jobs will increase 31% from 2019 to 2029, making it one of the fastest-growing fields.

Jobs requiring cybersecurity skills continue to grow rapidly, with more than 464,420 cybersecurity job openings, according to CyberSeek. Employers, from government to Fortune 500 companies, value CompTIA as an authority in cybersecurity certifications.

How to Get Into Cybersecurity

The CompTIA Cybersecurity Career Pathway helps IT pros achieve cybersecurity mastery, from beginning to end. When you earn cybersecurity certifications, you’re proving to employers that you are the best candidate for the job and have the skills needed to protect the organization from cyberattacks and threats.

Entry-level Cybersecurity Certification

The centerpiece is the CompTIA Security+ certification. It establishes the foundational knowledge required of any cybersecurity role and provides a springboard to intermediate-level cybersecurity jobs. With performance-based questions, it emphasizes the hands-on practical skills used by junior IT auditors, systems administrators, network administrators and security administrators. 

Here are just a few of the skills that CompTIA Security+ validates:

• Monitor and secure hybrid environments, including cloud, mobile and IoT
• Operate with an awareness of applicable laws and policies, including principles of governance, risk and compliance
• Identify, analyze and respond to security events and incidents
• Help assess the cybersecurity posture of an enterprise environment and recommend and implement appropriate security solutions

Still have questions? Check out CompTIA Security+: Your Questions Answered.

Intermediate-Level Cybersecurity Certifications

After earning CompTIA Security+, cybersecurity professionals can take the next step by pursuing an intermediate-level cybersecurity certification, such as CompTIA Cybersecurity Analyst (CySA+) or CompTIA PenTest+.

The CompTIA Cybersecurity Analyst certification assesses the skills needed to apply behavioral analytics to networks to improve the overall state of IT security. The certification covers tools such as packet sniffers, intrusion detection systems (IDS) and security information and event management (SIEM) systems.

As new methods in threat intelligence emerge, the security analyst job role has gained more importance, making these skills essential for most organizations.

CompTIA CySA+ covers the skills needed by cybersecurity analysts, application security analysts, threat intelligence analysts and more, including the following:  

• Leverage intelligence and threat detection techniques
• Analyze and interpret data
• Identify and address vulnerabilities
• Suggest preventative measures
• Effectively respond to and recover from incidents

Still have questions? Check out CompTIA CySA+: Your Questions Answered.

While CompTIA CySA+ focuses on defense through incident detection and response, CompTIA PenTest+ focuses on offense through penetration testing and vulnerability assessment. It involves launching attacks on systems, discovering the vulnerabilities and managing them.

CompTIA PenTest+ is intended for cybersecurity professionals such as penetration testers and vulnerability assessment analysts who are tasked with scanning, identifying, exploiting, reporting and managing vulnerabilities on a network.

Here are just a few of the skills that CompTIA PenTest+ validates:

• Plan and scope a penetration testing engagement
• Understand legal and compliance requirements
• Perform vulnerability scanning and penetration testing using appropriate tools and techniques, and then analyze the results
• Produce a written report containing proposed remediation techniques, effectively communicate results to the management team and provide practical recommendations

Read more about what CompTIA PenTest+ covers.

The progression from CompTIA Security+ to CompTIA CySA+ and/or CompTIA PenTest+ is logical because Security+ assesses the knowledge, skills and abilities (KSAs) an IT professional demonstrates after two years of cybersecurity field work, and CySA+ and PenTest+ assess three to four years of cybersecurity field work.  

The latest version of CompTIA PenTest+ (PT0-002) includes newer pen testing techniques for the latest attack surfaces, including the cloud, hybrid environments and web applications, as well as more ethical hacking concepts, vulnerability scanning and code analysis.

CompTIA PenTest+ Is Now DoD Approved

CompTIA PenTest+ is now approved by the U.S. Department of Defense (DoD) 8570 for three cybersecurity job categories.

Learn more!

Advanced-Level Cybersecurity Certification

IT pros can pursue CompTIA Advanced Security Practitioner (CASP+) to prove their mastery of cybersecurity skills required at the 5- to 10-year experience level. CASP+ is the pinnacle of cybersecurity certifications and includes performance-based questions.

It is intended for those who wish to remain immersed in hands-on enterprise security, incident response and architecture, for example, as opposed to strictly managing cybersecurity policy and frameworks.

The primary related job roles are senior security engineers and security architects, but CASP+ can also help validate skill sets necessary for digital forensics analysts and network enterprise architects.

For instance, a digital forensic analyst must be able to support the development of organizational forensics policies, analyze the security implications of forensics results and implement analysis of compromised systems, which are covered by CASP+.

Likewise, a network enterprise architect has to be able to analyze existing networks and determine the security components, concepts and architectures needed to make it more secure to meet regulatory cybersecurity compliance requirements. CASP+ assesses this knowledge.

Here are just a few of the skills that CASP+ validates:

• Architect, engineer, integrate and implement secure solutions across complex environments to support a resilient enterprise
• Use monitoring, detection, incident response and automation to proactively support ongoing security operations in an enterprise environment
• Apply security practices to cloud, on-premises, endpoint and mobile infrastructure while considering cryptographic technologies and techniques
• Consider the impact of governance, risk and compliance requirements throughout the enterprise

Read how CASP+ validates cybersecurity skills no matter the industry.

The latest version of CASP+ (CAS-004) qualifies the advanced skills required of security architects and senior security engineers to effectively design, implement and manage cybersecurity solutions on complex enterprise networks.

The Building Blocks of Cybersecurity

But how do you get into cybersecurity with no experience? If you have limited experience in IT and aren’t quite ready to start with CompTIA Security+, then you’ll want to start earlier on the pathway.

CompTIA A+ validates the skills employers look for in new and aspiring IT support professionals. In addition to covering today’s core technologies in operating systems, cloud, data management and more, the CompTIA A+ core series covers baseline security skills at the end point device level, including malware detection and removal, privacy concerns, physical security and device hardening. 

Read more about why it’s great to start your cybersecurity career at the help desk.

Where CompTIA A+ considers connectivity from the perspective of the user and their device, CompTIA Network+ focuses on the connections from (and between) the core systems to the endpoint devices. It validates the essential knowledge and skills needed to design, configure, manage and troubleshoot wired and wireless networks. To best support and ultimately secure the systems that exchange information on your network, you must first understand how the network functions.

CompTIA A+ and CompTIA Network+ follow a progression consistent with the KSAs an IT professional exhibits as they move from an early career technical support role with 9-12 months of general IT experience to one with 1-2 years of general IT experience, and with a significant part of that specific to network support and administration.

CompTIA Network+ is also an important and strongly recommended prerequisite to CompTIA Security+. Before you can secure a network, you must understand how it functions. In other words, you shouldn’t skip algebra and start with calculus. Otherwise, you are learning security skills and applying them to a network you don’t understand.

Now that we’ve covered the IT certifications in the cybersecurity pathway, let’s explore some of the common questions surrounding it.

Questions About the CompTIA Cybersecurity Career Pathway

Where should I start on the CompTIA Cybersecurity Career Pathway?

The pathway is intended to help people get into the field of cybersecurity. IT pros can enter at any point, depending on their IT experience, existing certifications or course of study.

There are no required prerequisites for these CompTIA certifications. For example, if you have two years of IT security experience or equivalent knowledge, you might start with CompTIA Security+ to prove your knowledge. If you already have CompTIA Security+, you can move ahead to CompTIA CySA+, CompTIA PenTest+ or CASP+. Find your place on the CompTIA Cybersecurity Career Pathway.

Do I need to take these certifications in order? Do I need to take all of them?

No. This is a recommended pathway, but it’s not a requirement. Your pathway will vary depending on your job needs or interests. In general, the pathway follows a hierarchy of skills needed for IT security; each certification builds upon the skills from the previous one. Find out which CompTIA certification is best for your job role.

Can I take these exams with no IT or cybersecurity experience?

Yes, you can, however we recommend a minimum amount of hands-on experience before taking any of our certifications. (Each one has different recommendations, found in the Exam Details section of the certification webpage.)

But hands-on experience doesn’t have to be on-the-job experience. It could mean any hands-on work, including practical experience gained while taking a class or through self-study, like with official CompTIA training products. CompTIA develops these solutions from the ground up and rigorously evaluates them to ensure in-depth coverage of the exam objectives. Then, take what you’ve learned to the next level by helping friends, family or local nonprofits with their IT and cybersecurity issues. 

CompTIA certifications mirror the current job roles of IT professionals, so it makes sense to earn these certifications to validate the knowledge and hands-on skills currently being used in the workforce, whether you have job experience or not.    

Do these certifications replace on-the-job experience?

If you are an IT professional or an employer, you understand the value of on-the-job experience. IT certifications are a great place to start, but they do not replace hands-on experience. If you have CompTIA certifications and on-the-job experience, you have the best of both worlds.

The recommended CompTIA Cybersecurity Career Pathway offers guidance for IT pros, employers, instructors and students. You can start wherever it makes sense, depending on your personal background, job requirements or course of study. The pathway is unique because it offers vendor-neutral skills for IT professionals to achieve cybersecurity mastery, from beginning to end.

Is your next move a CompTIA cybersecurity certification? Download the exam objectives for free today.

Patrick Lane, M.Ed., Network+, MCSE, CISSP, directs cybersecurity workforce certifications for CompTIA, including Security+, PenTest+, CySA+ and CASP+. He assisted the U.S. National Cybersecurity Alliance (NCSA) to create the “Lock Down Your Login” campaign to promote multi-factor authentication nationwide. He has implemented a wide variety of IT projects as a network, security and server administrator, security analyst and architect. Patrick is an Armed Forces Communications and Electronics Association (AFCEA) lifetime member, born and raised on U.S. military bases, and has authored and co-authored multiple books, including Hack Proofing Linux: A Guide to Open Source Security.

Jen Blackwell also contributed to this article. She is a products marketing director at CompTIA and oversees the certifications along the CompTIA Cybersecurity Career Pathway.