Module 6: Certifications

Free course · Start Your Cybersecurity Career · Module 6 of 8 · About 20 minutes

Certifications can open doors, especially when you are new to cybersecurity or changing career. But the wrong certification, or too many, wastes time and money. This module explains certification levels, paths by role, Japan’s national qualifications, how to choose, and the most common money-wasting mistakes.

Three levels of certification

• Entry level: proves you understand the basics. Examples include CompTIA Security+, ISC2 Certified in Cybersecurity (CC) and the Google Cybersecurity Certificate.
• Intermediate: proves skills for a specific role. Examples include CompTIA CySA+, Microsoft SC-200 (Security Operations Analyst), eJPT for junior penetration testers, and ISO/IEC 27001 Lead Implementer.
• Advanced: proves deep expertise and experience. Examples include CISSP and CISM, which require several years of professional experience, OSCP for penetration testing, and the GIAC family.

Certification paths by role

• SOC and blue team: start with Security+ or ISC2 CC, then CySA+ or Microsoft SC-200, and later GIAC GCIH or CISSP.
• Penetration testing: start with Security+ or eJPT, then OSCP, and later advanced OffSec or GIAC certifications.
• GRC and consulting: start with Security+ or Japan’s SG exam, then ISO/IEC 27001 Lead Implementer or Lead Auditor and CISA, and later CISM, CISSP or CRISC.
• Cloud security: start with AWS or Azure fundamentals, then Microsoft AZ-500 or the AWS security certification, and later CCSP.

These are common examples, not rules. Exam names and versions change, so always check the official website before you buy.

Japan’s national security qualifications

If you want to work in Japan, two national qualifications run by IPA (Information-technology Promotion Agency, Japan) are worth knowing:

• 情報セキュリティマネジメント試験 (SG), the Information Security Management Examination: covers security basics for all staff and managers. A good first step, especially for GRC roles.
• 情報処理安全確保支援士 (RISS), the Registered Information Security Specialist: a respected national qualification for security professionals.

Japanese employers and clients know these well, particularly in Japanese companies. The exams are in Japanese, so passing them also demonstrates strong Japanese ability.

How to choose your next certification

1. Pick a target role using Module 4.
2. Read 10 to 20 real job posts for that role and note which certifications appear most often.
3. Choose one certification at a time.
4. Book the exam date: a fixed date creates focus.
5. Make a weekly study plan based on the official exam objectives.

Avoid wasting money

• Collecting many unrelated certifications: one certification that matches your target role, plus practical projects, is worth more.
• Paying for an expensive bootcamp first: start with the official objectives and low-cost resources; pay for training only where you are stuck.
• Using leaked “brain dump” questions: they break exam rules and can get you banned. Practise with legitimate questions.
• Expecting free exams to last: check offers on official sites. For example, ISC2’s One Million Certified in Cybersecurity program, which gave the CC exam for free, stopped accepting new participants on 20 May 2026.

Quick check

1. What should you check before choosing a certification?
2. Name one entry-level and one advanced certification.
3. Which Japanese national exam is a good start for security basics?

Answers: 1. Real job posts for your target role. 2. For example Security+ (entry) and CISSP (advanced). 3. The Information Security Management Examination (SG).

Key takeaways

• Choose certifications by target role, not by popularity.
• Take one at a time, with a booked exam date and a weekly plan.
• In Japan, SG and RISS are respected national qualifications.

Next: Module 7 · Frameworks Made Simple. NIST CSF, ISO 27001, CIS Controls and more, explained in plain language.

Slides

Download the slides as PDF