What are the best certifications for landing a job in security management? Should you boost your credentials in the technical aspects of security management or focus more on the business strategy side? Which qualifications are the best fit for your current level of knowledge?
When considering possible security management certificates, these questions crop up a lot. There are many certifications out there designed to help you build and validate your knowledge of how to organize security assets and processes. However, these certifications vary considerably in focus, and the challenge is to identify the right ones to match your career goals.
To guide you towards the right choices, here’s a closer look at the best cyber security management certifications, why they’re valued by employers and the type of roles they will prepare you for.
Comprehensive Security Management Certification
By ‘comprehensive’, we mean security management certifications that focus on both the technical aspects of managing security across a wide range of IT environments, as well as the strategic and governance side of things.
Certified Information Systems Security Professional (CISSP)
Details
The Certified Information Systems Security Professional (CISSP) is an advanced, all-around certification from the International Information System Security Certification Consortium (ISC)2. Its aim is to prove you have what it takes to design, implement and manage an organization’s cyber security program.
So in terms of scope, CISSP certainly covers a lot of ground; something that’s reflected in the certification’s exam content. This is broken down into the following eight knowledge domains detailed in the official CISSP Certification Exam Outline:
The certification involves passing a four-hour examination comprising a combination of multiple-choice questions and practical challenges referred to by (ISC)2 as ‘Advanced Innovative Questions’. The passing score is 700 out of 1000. See our CISSP Exam Cheat Sheet to help you prepare.
Requirements
You do not, in theory, require any specific work experience to sit the exam. However, you are required to have a certain level of work experience to actually claim the title of CISSP.
Requirements are as follows:
- You must have a minimum of five years of cumulative work experience in two or more of the knowledge domains detailed above.
- A four-year college degree (or regional equivalent) or an additional credential from the (ISC)2 approved list will satisfy one year of the required experience. You can only satisfy a total of one year out of the five in this way.
- A recommendation from a CISSP in good standing.
- If you pass the exam without having the required work experience, you cannot advertise yourself as a CISSP. You can, however, describe yourself as an “Associate of (ISC)2”.
- You have six years from the time of passing the exam to earn the requisite work experience to claim the CISSP title.
Cost
The exam cost is $749. The CISSP accreditation requires payment of a $125 membership fee per year.
The certification is valid for three years, after which it must be renewed either by retaking the exam or earning (ISC)2 Continuing Professional Education (CPE) credits.
Why it is valued
There are two significant factors that help to make CISSP one of the most valuable cyber security certifications out there: scope and industry recognition.
Scope-wise, CISSP spans pretty much all of the core skills involved in security management. This includes technical management aspects such as security engineering, assessment, and testing, right through to the governance and risk management side; e.g. regulatory compliance, security plan audits, and ensuring business continuity.
In turn, the rigor and broad scope of CISSP help explain why this certification enjoys global recognition. If you are a seasoned security practitioner whose next move is a top-of-the-tree role (e.g. CISO, CIO, or IT Director), the CISSP certification is impossible to ignore.
Likewise, if you are seriously considering jobs that sit just below the C-suite level, but nevertheless involve a strong emphasis on operational or project management (e.g. security systems engineer, security analyst, or network architect), CISSP deserves careful attention.
Courses
Certified Information Security Manager (CISM)
Details
Certified Information Security Manager (CISM) is an advanced management certification from ISACA. It is aimed towards existing and aspiring information security managers and is designed to test your knowledge across the following four content domains:
- Information Security Governance (17%). Testing your knowledge of how to plan and develop infosec strategies in line with information governance frameworks and standards.
- Information Security Risk Management (20%). Analysis and risk assessment of potential infosec risks, threats and vulnerabilities.
- Information Security Program (33%). The management aspects of developing and maintaining an infosec program, including control design, testing, comms, training, and reporting.
- Incident Management (30%). Assessing your knowledge relating to risk management and preparedness, including business impact analysis, recovery and continuity.
CISM assessment involves a 150-question multiple-choice exam. The passing score is 450 out of 800.
Requirements
To sit the exam, you must have five years of verified experience in the infosec field, with a minimum of three years of experience managing at least three of the four content domains detailed above.
Cost
$575 for existing ISACA members. $760 for non-members. After passing the exam, you will also need to pay a $50 application processing fee to get your certification.
To maintain your CISM certification after passing, you must complete 20 continuing professional education (CPE) credits annually, in line with ISACA’s CPE Guidelines.
Why it is valued
ISACA bills CISM as the certification to gain in order to “make the move from team player to leader”. In many ways, CISM lives up to this billing. CISM is particularly useful if you want to step up from a role that involves elements of management into a more senior managerial role.
Crucially, CISM demonstrates that you know what it takes to assess risks and respond to incidents when they arise in the context of the wider operational, governance, and compliance concerns of the business: must-have competencies for any senior security manager.
Courses
Security Architect Management Certification
We’ve honed in on the SABSA framework as the single most recognized qualification for practitioners who intend to climb the career ladder in the highly specialist area of security architecture management.
SABSA Chartered Security Architect – Practitioner Certificate (SCP)
The SABSA (Sherwood Applied Business Security Architecture) certification framework is a testing program designed to validate professionals’ abilities in the design, delivery and management of enterprise security architectures.
SABSA’s certification framework comprises three levels: Foundation, Practitioner, and Master. Only a handful of people have achieved the Master credential (which is no surprise considering the required thesis to write), so you’re likely only focusing on the first two levels for now.
To increase your credentials on the operational side of security architecture, you’d go for the Foundation certification as a starting point. This is designed to help you demonstrate a broad spectrum of knowledge surrounding the frameworks, concepts and techniques linked to best practices in this area.
To get your Foundation certificate, you must complete a week-long course with a SABSA-accredited training provider. After this, you sit two Foundation Module exams, each consisting of a multiple-choice exam. You must score 75% or higher on each test to pass.
When it’s time to step into a senior managerial role, you should think about gaining your Practitioner certificate. This advanced-level accreditation builds on your existing Foundation qualification by requiring you to complete a week-long training course on any one Advanced Module of your choosing.
Advanced Module options in most jurisdictions are as follows:
- A1 – Advanced SABSA Risk, Assurance & Governance
- A3 – Architecture Design Development
At the end of your Advanced Module training, you do a further exam.
“Examination papers contain 5 questions from which candidates must choose 2 to answer. Using examples from real working environments, or by creating a case study, or a combination of both, candidates are required to assess issues, evaluate solution approaches, and customize and apply the SABSA method and framework to create and populate appropriate SABSA work-products (techniques, tools, templates, models, frameworks, etc.).”
Candidates have four weeks to complete and submit the exam. It’s marked by two SABSA Masters, requiring a score of 75% or higher.
Requirements
Applicants for the SCP must have obtained their Foundation certificate first.
Cost
This all depends on where you’re based, as the exam and certification cost is bundled into the mandatory training package. Take a look at the SABSA Accredited Education Partners page for further details.
Why it is valued
When hiring for senior security architect roles, it’s vital for employers to have confidence in your ability to design and implement systems capable of protecting not just the organization’s IT assets but also its core processes and wider mission. This type of niche qualification helps to create this confidence.
If your career plan involves continuing down the security architect route, the SABSA qualification framework is a really effective way to validate your knowledge and experience.
Project Management Certification
We’ve picked out three noteworthy certifications that effectively cascade in terms of speciality: one covering the project management fundamentals, one focusing on IT projects, as well as a benchmark project management cert focusing squarely on cyber security.
PRINCE2
Details
PRINCE2 (PRojects IN Controlled Environments) is a project management method originally developed as a UK government standard for IT projects. It has since been adopted as a project management methodology in organizations across the globe and in a variety of business sectors.
PRINCE2 certification is split into two levels.
- The Foundation level covers topline project management principles and processes, enabling you to demonstrate your knowledge of how to consistently deliver projects on time, within budget, and mitigating risks.
- The Practitioner level focuses on applying and customizing PRINCE2 principles to real-life project scenarios.
The content for both the Foundation and Practitioner level is focused on the seven principles of PRINCE2:
- Continued Business Justification. Establishing and monitoring the business case for the project.
- Learn From Experience. Drawing on lessons from current and previous projects to optimize performance.
- Defined Roles and Responsibilities. Getting clarity on what’s expected from all stakeholders.
- Manage by Stages. Planning and controlling projects on a stage-by-stage basis.
- Manage by Exception. Establishing clear controls on delegated authority.
- Focus on Products. Ensuring quality of outcome.
- Tailor to Suit Project Environment. Scaling or customization to suit the project environment, size, complexity, importance, timing, and risk.
The Foundation exam comprises a 60-minute, 60-question format with a passing mark of 55%. The Practitioner exam is a 150-minute, 68-question format, again with a pass mark of 55%.
Requirements
There are no prerequisites to sit the Foundation exam.
For the PRINCE2 Practitioner exam, you need to provide proof of passing one of the following:
- PRINCE2 Foundation
- Project Management Professional (PMP)
- Certified Associate in Project Management (CAPM)
- IPMA Level A (Certified Projects Director)
- IPMA Level B (Certified Senior Project Manager)
- IPMA Level C (Certified Project Manager)
- IPMA Level D (Certified Project Management Associate)
Cost
$550
Why it is valued
When you step into a role that involves taking ownership of projects, employers will need to know that those projects are in safe hands. This involves proof of your competence in areas such as planning, quality control, effective delegation, and timing. Accreditation based on this well-recognized methodology is an effective way of establishing your competence in this area.
GIAC Certified Project Manager (GCPM)
Details
The GIAC Certified Project Manager (GCPM) certification is designed to help you demonstrate that you know what it takes to successfully deliver a technical project.
The course covers three broad areas:
- Project management structure and framework
- Time and cost management, communications, and human resources
- Quality and risk management, procurement, stakeholder management, and project integration
GCPM certification involves a three-hour, 115-question exam with a passing score of 70%.
Requirements
There are no prerequisites for taking the GCPM exam.
Cost
$949
Why it is valued
Whereas the PRINCE2 certification demonstrates your ability to apply general project management principles, GCPM is more firmly focused on technical projects. It will be especially useful for existing managers who want to validate their knowledge and hone their expertise in project delivery.
Likewise, GCPM is a good option for anyone in a security engineering/design position who wants to demonstrate they have the critical skills needed – e.g. communication, time, cost control, and risk management – to actually take the lead on future projects.
See Our Other Certification Lists
The Best Cloud Security Certifications to Boost Your Career
Top Entry-Level Cyber Security Certifications for You in 2023
The Very Best Ethical Hacking Certifications for You in 2023
SIA Certified Security Project Manager (CSPM)
Details
SIA Certified Security Project Manager (CSPM) is specifically geared to show you have what it takes to deliver a complex technical security project.
Content is based around the following domains:
- Security industry-specific knowledge
- Planning
- Execution
- Monitoring
- Project closing
- Management skills
Testing is via a three-hour, 100 multiple-choice question examination.
Requirements
Candidates must have a minimum of 6,000 hours (about three years) of hands-on project management experience. This must include at least 3,000 hours of direct security project management experience.
Certain types of bachelor’s and master’s degrees can reduce the work experience requirement, as detailed in SIA’s CSPM eligibility guidelines.
Cost
$325 to take the exam.
The certification is valid for three years. To recertify, you need to earn 60 CPE credits (see SIA’s CPE guide for further details).
Why it is valued
CSPM is a valuable certification if you want to validate your credentials specifically in the field of security-based project management. It will be of particular use to security project managers, systems integrators, lead technicians, and similar roles.
Security Operations Center Management Certification
The Security Operations Center is the beating heart of defensive posture for an organization. It is here that systems and network traffic are monitored, anomalies are flagged, and breaches are responded to. As such, a strong manager is required for handle the different facets of this department.
GIAC Security Operations Manager Certification (GSOM)
Details
The GIAC Security Operations Manager Certification (GSOM) demonstrates that you have the knowledge and skills necessary to effectively run a security operations center (SOC). This includes managing a SOC program, overseeing incident logs, and deploying metrics and analytics for continuous optimization.
Content is focused on the following topics:
- Continuous Improvement
- Cyber Defense Theory, Threat Intel, and Defensible Architecture
- Data Source Assessment and Collection
- Managing Alert Creation and Processing
- Managing Incident Response Execution
- Preparing for Incident Response
- Proactive Detection and Analysis
- SOC Analytics and Metrics
- SOC Design and Planning
- SOC Tools and Technology
Testing is via a two-hour, 75-question exam with a passing score of 66%.
Requirements
There are no hard prerequisites for the exam, but it does require advanced technical knowledge of SOC operations.
Cost
$949 for the initial exam. GIAC certifications need to be renewed every four years to remain valid. You must collect 36 CPE credits over four years to keep your certification valid, as detailed in GIAC’s renewals guide.
Why it is valued
The SOC is the nerve center from which any major organization’s security strategy is put into practice. This specialist management certification demonstrates you have what it takes to run this effectively. It makes GSOM a valuable qualification not just for existing SOC leads but also for operations team members who intend to move up the career ladder.
Compliance Management Certification
This security management certification is of particular relevance to anyone seeking senior roles in enterprises where governance is a top priority.
ISACA – Certified in the Governance of Enterprise IT (CGEIT)
Details
ISACA’s Certified in the Governance of Enterprise IT (CGEIT) accreditation is designed to enable you to prove your expertise in IT enterprise governance at the executive level.
CGEIT course content comprises the following:
The exam consists of 150 questions, testing your knowledge and ability on real-life governance-related issues. The exam is scored between 200 and 800, with a passing score of 450.
Requirements
Candidates must demonstrate five or more years of experience in an advisory or oversight role supporting the governance of the IT-related contribution to an enterprise.
Cost
The cost of the CGEIT exam is $575 for ISACA members and $760 for non-members
To maintain your CGEIT certification, you need to gain at least 120 CPE credits over a three-year reporting period.
Why it is valued
The standard of IT governance within an enterprise has significant implications on regulatory risk, reputation, and even on its ability to secure investment. Enterprises (and the IT leaders within those enterprises) need to take it extremely seriously. If the roles you are considering involve taking ownership of governance strategy, this certification can effectively validate your knowledge.
IT Service Management (ITSM)
Many organizations see cyber security as a service delivered to the wider business. An ITSM certification is a useful credential to have in this context.
ITIL 4
Details
ITIL (Information Technology Infrastructure Library) is a global framework of best practices for IT service management (ITSM). The ITIL 4 Foundation Certification demonstrates that you understand the fundamentals of these best practices and how to apply them in day-to-day operations.
The course helps you demonstrate your knowledge on the following topics:
- How modern IT and digital service organizations operate
- How value streams increase speed and efficiency
- How cultural or behavioural principles guide work that benefits the wider organization
- How to use commonly-used service management terms and concepts
The format is a 60-minute, 40-question, multiple-choice exam.
Requirements
There are no formal prerequisites for the exam, although accredited foundation training is strongly advised
Cost
The exam fee is $314. After three years, it needs to be renewed by either retaking the exam or by gaining credits through the PeopleCert Continuing Professional Development hub.
Why it is valued
In terms of strategy, savvy IT and infosec managers are keen to focus on the real-life needs of actual business users, rather than just the systems. Once you master these principles, it becomes a lot easier to optimize your services in line with the real needs of the business. ITIL 4 is the globally-recognized standard for demonstrating your knowledge in this area.
Cloud Security Management
This certification focuses on demonstrating your security management knowledge in the context of the specific risks and characteristics associated with a cloud environment.
Certified Cloud Security Professional (CCSP)
Details
(ISC)2’s Certified Cloud Security Professional accreditation is designed for current and aspiring infosec leaders to demonstrate their knowledge of cyber security and securing assets in the cloud.
Exam content is broken down into the following knowledge domains:
Gaining the certification involves passing a four-hour multiple-choice exam comprising 150 questions. The passing grade is 700 out of 1000.
Requirements
In order to hold the title of CCSP, you must have at least five years of full-time paid work experience in information technology. Three of these years must be in information security.
You can qualify one of the years of experience by holding the Certificate of Cloud Security Knowledge certificate (CCSK) from Cloud Security Alliance. You can reduce all five years by being a CISSP holder.
Cost
The exam fee is $599. Maintaining the accreditation involves an annual fee of $125.
The certificate is valid for three years, after which it can be renewed by either retaking the exam or earning CPE credits in line with (ISC)2’s continuing professional development guidelines.
Why it is valued
It is now the norm for organizations to deploy critical services, data, and architecture either wholly or partially in the cloud. This gives rise to specific management risks linked to data security, specific types of vulnerabilities, and compliance issues.
For security managers, engineers, and architects, CCSP demonstrates that you have a thorough understanding of how to manage a cloud environment. We discuss this certification in greater detail in our CISSP vs CCSP article.
Courses
Privacy Management and Data Protection
Organizations require the right safeguards and policies in place to safeguard personal data and other types of sensitive information. This certification demonstrates you have the ability to deliver this.
Certified Information Privacy Manager (CIPM)
Details
Offered by the International Association of Privacy Professionals (IAPP), the Certified Information Privacy Manager (CIPM) accreditation demonstrates that you have the skills to set up and maintain an organizational privacy program.
Subject areas include the following:
- Creating a company vision around privacy
- Structuring a privacy team
- Developing and implementing a privacy program framework
- Communication with stakeholders
- Performance measurement
- The privacy program operational lifecycle
Further details on the syllabus can be found in the IAPP Free Study Guide.
Assessment is via a 2.5-hour exam comprising 90 multiple-choice questions, with a passing mark of 80%.
Requirements
There are no formal prerequisites for taking the CIPM exam, but it is expected that you will already have a thorough grounding in data privacy practice.
Cost
The exam fee is $550. For retakes, the fee is $375. To receive your CIPM certification, you must pay a certification maintenance fee of $250. The CMF needs to be paid every two years to retain the certification. The CMF is waived for IAPP members.
Why it is valued
With GDPR and similar privacy regulations coming into force across the globe, organizations need to take special care not to sleepwalk into non-compliance and expose themselves to the risk of sanctions and reputational damage.
Particularly if you envisage taking up a managerial role in an enterprise that handles large volumes of customer data or other sensitive information, CIPM offers a highly useful addition to your credentials.
Courses
Final Thoughts
Once you’ve acquired a few years of experience under your belt, do you really need to focus on earning extra letters after your name?
In actual fact, it seems that the return on investment in relation to training actually increases as you progress towards managerial roles.
According to a 2022 CompTIA survey, US IT pros who had obtained a new certification in the previous year saw their salary increase by an average of $13,000. It seems that aiming for those extra management credentials isn’t just for active job hunters; it often provides the opportunity to command more earnings in your current role.
Frequently Asked Questions
CISSP is the stronger, all-encompassing certification as it gives rigorous coverage of both the technical and strategic aspects of management. With CISM, there is less focus on the technical side, but with greater emphasis on governance.
CISSP tends to top the poll among neutral industry sources. This certificate also tends to come out top among the most frequently specified senior security qualifications in job advertisements.
Roles involving managerial aspects include the following:
• Chief Information Security Officer
• Chief Information Officer
• Director of Security
• IT Director
• Senior Security Engineer
• Security Auditor
• Security Architect
• Network Architect
Yes. According to Statista, more than 80% of companies globally are currently experiencing a shortfall of skilled security personnel. CIO recently cited Systems Security Manager and Network Security Engineer as two of the most in-demand (and highest-paid) roles in the entire IT sector.
According to Salary.com, the average Security Manager salary in the United States is $105,961, with the general range falling between $90,305 and $124,549.
from StationX https://bit.ly/3LyEGQl
via IFTTT
No comments:
Post a Comment