Your Job Posting Doesn't Require a Certification. The Software Screening It Still Does.
October 15, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Only 6.9% of cybersecurity job postings explicitly require a certification in their text, yet 89% of hiring managers say they prefer certified candidates and most applications never reach a human until software has already ranked them. That gap between what a posting says and what the screening system actually rewards is where certification decisions are quietly being made, long before a recruiter opens a resume.
Why Do So Few Job Postings Require a Certification?
Most employers have learned that writing "certification required" into a job ad shrinks the applicant pool more than it improves it. An analysis of nearly 2,700 cybersecurity postings found that almost 3 in 4 listings made no reference to any of 20 major certifications at all, and only 187 postings used language that counted as a true requirement rather than a preference. Legal and HR teams tend to favor broad language that avoids disqualifying an otherwise strong candidate over a missing acronym.
That caution is a reasonable response to a real problem. A separate ISC2 study found that 38% of hiring managers require the CISA certification for entry-level roles even though it demands five or more years of auditing experience, and 34% expect CISSP from entry-level candidates despite the same experience floor. Postings written this way filter out the exact junior talent the industry says it needs, which is why many HR departments have quietly backed off hard certification language rather than fix the mismatch.
How Does the Screening Software Actually Decide?
Removing the word "required" from a job posting does not remove certification from the ranking logic. Applicant tracking systems parse a resume into structured fields and then match keywords in that resume against the skills, job titles, certifications, and industry terms the employer specified, whether or not those terms appear as a hard requirement in the posting's visible text. A recruiter searching that database for "CISSP" or "Security+" will surface certified candidates first regardless of how the job ad was worded.
This is the mechanism that explains the gap between the 6.9% hard-requirement figure and the much larger preference numbers. Fortinet's 2025 workforce survey found that 65% of respondents consider professional certifications when hiring and 89% prefer to hire candidates who hold one, even though the same survey shows employer willingness to pay for an employee's certification has fallen from 89% in 2023 to 73% today. Employers want the signal. Fewer of them want to fund it. That shift moves the financial burden of earning a credential toward the employee and toward teams that decide to invest ahead of the requirement rather than reacting to it.
Among the credentials employers do search for, not all carry equal weight. CISSP is referenced in 17.6% of all cybersecurity job postings, the single most-mentioned credential tracked, while CompTIA Security+ carries the highest hard-requirement rate of any major certification at 41%. That split matters for planning. CISSP functions mostly as a ranking signal across a huge volume of postings. Security+ is far more likely to be the one credential standing between a candidate and an interview.
The One Place Certification Really Is a Hard Gate
Federal contracting removes the ambiguity entirely. Under Department of Defense policy, anyone performing information assurance work on a government contract must hold an approved baseline certification for that specific work role, with no exception made for equivalent experience. Security+ satisfies the most common tier of that requirement, and contracting officers verify it directly rather than taking a resume's word for it. An otherwise qualified candidate without the credential simply cannot be placed in the role, no interview needed.
This is a useful contrast for any leadership team sizing up where to put training dollars. In the commercial market, certification is a probabilistic advantage that moves a resume higher in a ranked list. In government and defense contracting, it is a binary pass or fail condition on day one. Teams that bid on both kinds of work need a workforce strategy that treats certification as compliance infrastructure for one segment and as competitive positioning for the other, not as the same line item.
What This Means for Hiring and Training Budgets
The practical consequence is that certification investment decisions should be driven by how screening systems actually behave, not by the literal text of job postings. A few patterns are worth building into hiring and development plans directly.
- CyberSeek data compiled from job postings shows CISSP, Security+, CISA, and CISM as the four most frequently requested credentials across all cybersecurity roles, which makes them the safest default targets for a team building a certified bench rather than reacting posting by posting.
- Because ATS platforms rank on keyword presence rather than requirement language, an employee who earns a credential before it appears in a job description becomes visible to recruiters searching for that exact term, well ahead of competitors who wait for the posting to spell it out.
| Signal type | Example | What it means for hiring |
|---|---|---|
| Hard requirement (compliance) | DoD 8570/8140, Security+ for IAT Level II roles | No credential, no placement, regardless of experience |
| Hard requirement (posting text) | Security+ at a 41% hard-requirement rate | Explicit disqualifier if missing |
| Soft signal (ATS ranking) | CISSP mentioned in 17.6% of postings | Moves a resume up a ranked list, not a disqualifier |
| Preference without posting text | 89% of hiring managers prefer certified candidates | Invisible in the job ad, active in the decision |
Reading that table the way a CFO would, the conclusion is straightforward: certification spend that waits for a job posting to demand it is reacting to the smallest and least informative category in the table. The larger, less visible categories are where hiring decisions actually get made.
For security leaders building out a team, this argues for treating certification as a standing part of workforce development rather than a line item tied to a specific open requisition. Forge University's CompTIA Security+ certification prep maps directly to the credential with the highest hard-requirement rate in commercial postings and the credential most commonly named in DoD 8570/8140 compliance work, which makes it a reasonable starting point whether the goal is passing an ATS filter or clearing a federal contract gate. Teams weighing where to start can review the curriculum overview and certification comparison in the resources section before committing a training budget to one path over another. If you want a plan built around the specific roles you are hiring or developing for, you can start training and work from the actual requirements rather than guessing at them.
None of this means job seekers or hiring teams should treat every certification as equally valuable, or assume a credential substitutes for real experience. It does mean that the absence of the word "required" in a posting tells you far less than it used to about whether certification will decide the outcome. The screening software was built around keyword matching long before most job descriptions caught up to how that software actually works, and that mismatch is not closing on its own.
Organizations that keep a pipeline of certified staff ahead of specific openings are not hedging against a formal requirement. They are positioning for a ranking system that already favors certification, whether or not anyone wrote that down in the posting.