A Cybersecurity Career Roadmap: From Security+ to CySA+, CISSP and CISM

Cybersecurity attracts people from many backgrounds — system administrators, network engineers, developers, auditors and fresh graduates. The field is broad, and the number of certifications can be overwhelming. This roadmap sets out one sensible sequence, explains what each stage is for, and highlights the decisions you will need to make along the way.

Stage 0: Build your IT foundations

Security is about protecting systems, so you need to understand how those systems work. Before your first security certification, make sure you are comfortable with networking (IP addressing, routing, DNS, common ports and protocols), at least one operating system at the command line, and basic concepts of identity and access. If these feel unfamiliar, CompTIA Network+ or a period working in IT support will give you a much stronger base.

This stage is easy to skip and costly to miss. Learners who rush into security without networking fundamentals often struggle with log analysis, firewall rules and incident investigations later.

Stage 1: CompTIA Security+

Security+ is the most common first security certification. It is vendor-neutral and covers a broad baseline: threats and vulnerabilities, security architecture, security operations, and governance, risk and compliance. It does not make you an expert in any one area, but it gives you the vocabulary and mental framework to understand what every other security role is doing.

CompTIA has signalled that a new version, SY0-801, is expected in late 2026, with the English SY0-701 exam retiring later. If you are ready to sit SY0-701 now, there is usually no reason to wait. We cover the version question in more detail in a separate article.

Stage 2: Choose a direction

After Security+, security careers branch. It helps to decide — at least provisionally — which direction suits you, because the next certification depends on it.

Defensive operations: CySA+

If you enjoy investigating alerts, analysing logs, hunting for threats and responding to incidents, the security operations centre (SOC) is a natural home. CompTIA CySA+ focuses on these analyst skills. Pair it with hands-on experience in a SIEM tool and, if your organisation uses Microsoft security products, consider SC-200 as well.

Offensive security: PenTest+ or CEH

If you are drawn to finding weaknesses before attackers do, look at penetration testing. CompTIA PenTest+ and EC-Council’s Certified Ethical Hacker both cover the methodology and tooling. Offensive roles reward practical skill heavily, so build a lab, practise on legal training platforms and document what you learn.

Governance, risk and audit

Not all security work is technical. If you prefer policy, risk assessment, controls and assurance, consider ISO/IEC 27001 Lead Implementer or Lead Auditor training, and later ISACA’s CISA or CRISC. These paths suit people from audit, compliance and quality backgrounds as well as experienced IT staff.

Cloud security

Most new workloads run in the cloud, and securing them requires platform-specific knowledge. Cloud-specific security certifications from Microsoft, AWS or Google Cloud complement a vendor-neutral foundation. CCSP from ISC2 is a senior, vendor-neutral option once you have experience.

Stage 3: Gain real experience

Certifications open doors, but experience is what moves you up. Most senior security certifications require it: ISC2 and ISACA both set work-experience requirements before awarding CISSP, CISM and CISA, even if you pass the exam earlier. Ways to build experience include:

• Taking on security responsibilities in your current IT role — patching, access reviews, hardening, backup testing.
• Volunteering for incident post-mortems, audits or risk assessments.
• Building and documenting a home lab: a small network, a SIEM, some intentionally vulnerable machines.
• Contributing write-ups or tools that show how you think through a problem.

Stage 4: Senior certifications — CISSP and CISM

CISSP

CISSP is a broad, senior certification covering eight domains, from security and risk management to software development security. It suits security engineers, architects and leaders who need to make decisions across the whole field. The exam tests judgement as much as knowledge: many questions ask what a security manager should do first, or what is most important, rather than how to configure something.

CISM

CISM is aimed at people who manage information security programmes: governance, risk management, programme development and incident management. It is less technical than CISSP and more focused on aligning security with business objectives. ISACA has announced an updated CISM outline taking effect on 3 November 2026, so check which outline applies to your exam date.

Which one first?

If your role is technical leadership or architecture, CISSP is usually the better fit. If you manage a security function, report to executives or own a risk register, CISM may be more relevant. Many senior professionals eventually hold both.

A sample sequence

1. Networking and operating system foundations (Network+ or equivalent experience).
2. Security+.
3. A direction-specific certification: CySA+, PenTest+, CEH, or ISO/IEC 27001.
4. Two to five years of hands-on security work, with cloud security skills added along the way.
5. CISSP, CISM, CISA or CCSP depending on your role.

Common mistakes to avoid

• Collecting entry-level certifications instead of building depth in one area.
• Booking senior exams before you have the experience to understand the scenarios.
• Ignoring soft skills — writing clear reports and explaining risk to non-specialists matters at every level.
• Treating study as memorisation. Security exams increasingly test reasoning, and so do interviews.

Final thoughts

There is no single correct route into cybersecurity, but there is a common pattern: strong foundations, a broad baseline certification, a chosen direction, real experience and then senior credentials. If you are unsure where you fit, speak to one of our advisors — we can review your background and suggest a starting point.

Certification requirements, exam versions and experience rules change. Confirm the current details on the CompTIA, EC-Council, ISC2 and ISACA websites before you plan.