CIO
Top IT certs paying the highest premiums today
By: Sarah K. White
IT certifications can boost your career, but it’s not always easy to tell which certifications hold the most value for your resume. Moreover, the pay associated with any given certification can fluctuate based on business interest in the credential and the supply of IT pros who hold it. To help gauge certification values, Foote Partners tracks premiums paid for popular IT certifications in its 2020 IT Skills and Certifications Pay Index report.
As opposed to non-certified IT skills, the cash value of IT certifications is less volatile, according to David Foote, co-founder, chief analyst and chief research officer at Foote Partners. But certifications do tend to spike in value after they’re launched and then level out as more people get certified.
Foote Partners has identified the following 10 certifications as increasing the most in value over the past year, based on compensation data provided by more than 3,300 private- and public-sector employers in the U.S. and Canada. Here, certification value is based off what percentage of base salary accounts for a single certification, on average. Whether you already have one of these certifications or you’re planning to earn one, there’s no better time to have one of these 10 IT certifications on your resume.
GIAC Security Expert (GSE)
The GIAC Security Expert (GSE) certification is an IT security credential that offers performance-based and hands-on validation of your skills. It’s an advanced certification designed for seasoned security professionals who want to set themselves apart at the top of the field. There are several prerequisites for the GSE, with various options for what you’ll need to have completed, but at the baseline you’ll need your GSEC, GHIC, GCIA with two Gold certifications.
The GSE exam consists of two parts, including an entrance exam with 24 questions and a hands-on lab that takes place in-person over two days. The proctored entrance exam lasts three hours and covers general security, incident handling and intrusion detection and analysis skills; it covers both Windows and Linux environments. On day one of the two-day hands-on lab portion of the exam, you will be given an incident response scenario and asked to analyze the data and present a written report. On day two, you’ll be given a “rigorous battery of hands-on exercises” to test your skills in several security domains.
The GSE certification is the highest paying certification on the list, with IT professionals earning a median of 15 percent of their base salary, according to the data from Foote Partners. That value has held steady over the past 12 months, earning IT professionals anywhere from 12 to 18 percent of their base salary, according to the data.
Exam fee: $529, entrance exam; $2,579, hands-on lab fee
Expiration: The certification needs to be renewed every four years, but you’ll only need to take the current version of the multiple-choice exam to recertify.
Certified Forensic Computer Examiner (CFCE)
As companies scramble to hire cybersecurity pros, certifications such as the Certified Forensic Computer Examiner (CFCE) have seen increased demand, rising 25 percent in value over the past year. The certification, which is offered through the International Association of Computer Investigative Specialists (IACIS), covers the fundamentals of computer and digital forensics and is designed for current and former law enforcement professionals or government employees who work with digital forensics. It used to be exclusive to law enforcement or government employees but has been opened to contract and former employees of law enforcement agencies.
Unlike other certifications, the CFCE requires you to first complete a peer review phase where you will complete four scenario-based problems alongside a forensic professional. After you pass the practical exercise portion, you can move on to the certification phase, which includes an independent exercise and a written examination. You’ll need to maintain 40 continuing education credits every three years to keep your certification valid and pay a yearly fee of $75, which includes membership to IACIS. The credential also requires a background check.
Despite being one of the highest paying certifications on the list, the CFCE certification declined nearly 13 percent in pay premium value over the past year, but still earns IT professionals a median 14 percent of their base salary.
Exam fee: Fees vary, but you will need a membership to the IACIS, which starts at $100 per year.
Expiration: You will need to be recertified every 3 years to maintain your CFCE certification.
CompTIA Advanced Security Practitioner (CASP)
The CompTIA Advanced Security Practitioner (CASP) certification is designed for advanced cybersecurity professionals, including security architects, application security engineers, technical lead analysts and security engineers. The certification validates your knowledge and skills with analyzing security risks, integrating networks and applications, virtualization technologies, research methods, industry trends and implementing incident response and recovery procedures. It’s a pretty straightforward path to certification, but to qualify for the 90-question exam, candidates will need a minimum of 10 years of experience in IT administration, with five years of hands-on technical security experience.
The pay premium value of the CASP certification has grown 40 percent over the past 12 months, earning IT professionals a median 14 percent of their base salary.
Exam fee: $452 for an exam voucher
Expiration: Good for three years from the date of exam; you can extend your certification in three-year intervals with the continuing education (CE) program by attending training that relates to your certification.
PMI Risk Management Professional (PMI-RMP)
The PMI Risk Management Professional (PMI-RMP) certification is designed for those with “advanced knowledge and experience in risk management” and project managers working on project risk management or on large projects in complex environments.
The PMI-RMP exam consists of 170 multiple-choice questions and covers topics such as risk strategy and planning, stakeholder engagement, risk process facilitation, risk monitoring and reporting and performing specialized risk analyses. To qualify for the exam, you will need a secondary degree, at least three years of experience of project risk management within the past five years and 40 hours of project risk management education. Alternatively, if you hold a four-year degree you can qualify with 2 years of experience and 30 hours of project risk management education.
In the past year the PMI-RMP has held steady with a pay premium median of 15 percent of IT professional’s base salary, according to Foote Partners.
Exam fee: $520 for members of the PMI, $670 for non-members
Expiration: To maintain your certification you will need to earn 30 professional development units (PDUs) in risk management topics every three years.
Certified Secure Software Lifecycle Professional (CSSLP)
The ISC2 offers the Certified Secure Software Lifecycle Professional (CSSLP) certification to validate that you have the skills required to authenticate, authorize and audit throughout the software development lifecycle (SDLC) using best practices established by cybersecurity experts. The exam will be updated as of Sept. 15 to cover eight specific domains, including secure software concepts, requirements, architecture and design, implementation, testing, lifecycle management, deployment and maintenance, and supply chain. The certification is designed for software architects, developers and engineers as well as project managers, security managers, penetration testers, software procurement analysts, application security specialists, software program managers, quality assurance testers and IT directors and managers.
To qualify for the exam you will need at least four years of SDLC experience in one or more of the eight domains covered on the exam. Alternatively, if you have a four year degree in computer science, information technology or a related field, you can qualify with three years of SDLC experience in a professional setting.
While the CSSLP certification dropped 18 percent in premium pay value over the past 12 months, it still earns IT professionals a median 13 percent of their base pay.
Exam fee: $599
Expiration: Certifications are valid for three years. You will need to complete CPE credits annually to maintain your certification. You will also pay an annual maintenance fee of $125, due on the anniversary of your certification date.
Cisco Certified Network Professional Security
The Cisco Certified Network Professional Security (CCNP) certification was updated in February 2020 and all active CCNP certifications have been automatically upgraded to the newest certification. The certification is for security engineers, network engineers, network administrators, systems engineers, technical solutions architects and network managers. The CCNP Security exam does not have any prerequisites; in the past it was required to hold an associate-level certification to qualify for the exam, but Cisco changed the process and you can now take CCNP exams in any order. Candidates typically have three to five years of experience in security before taking the exam, but it is not required.
You will need to pass two exams to earn your CCNP Security certification and with each exam you will earn an individual Specialist certification to recognize your accomplishments. First you will need to pass the core exam Implementing and Operating Cisco Security Core Technologies (SCOR) and then you will need to choose from several concentration exams that focus on specific areas of security such as firewalls, web security and VPNs.
The CCNP certification has earned IT professionals a median 13 percent of their base salary steadily for the past 12 months, according to data from Foote Partners.
Exam fee: $325
Expiration: The CCNP certification is good for three years
CyberSecurity Forensic Analyst (CSFA)
The CyberSecurity Forensic Analyst (CSFA) is designed to validate your ability to “conduct a thorough and sound forensic examination of a computer system and other digital/electronic devices, properly interpret the evidence and communicate the examination results effectively and understandably,” according to the website. The CSFA designation is held “exclusively by the most qualified digital forensic professionals” and attests to your ability to perform a “comprehensive analysis” in a short time frame. This isn’t your typical exam; for instance, you will need to pass a background check to earn this certification and anyone with a felony or “the majority of misdemeanor offenses” on their record will be disqualified from taking the exam. The certification is designed to not only showcase your cybersecurity forensic skills, but also to demonstrate your ethical and moral values, according to the website.
The exam takes place over three days, with a written component with 50 multiple choice questions, while the rest of the exam will be hands-on. The hands-on portions include a scenario-based test that isn’t necessarily the same for everyone — candidates are presented with a computer, hard drive, cellular phone or other handheld device to process and analyze. To qualify for the exam, you will need to pass the background check and have at least two years of experience conducting forensic analysis. It’s also recommended to have at least one other relevant cybersecurity certification.
The CFSA earns IT professionals a median 13 percent of their base salary, which is nearly a 19 percent drop in premium value in the past 12 months.
Exam fee: $750
Expiration: Once you are certified, you will need to maintain 80 hours of digital forensics or information security training every two years and complete four digital forensic examinations.
GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)
The GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) certification is designed for network and systems penetration testers, incident handlers, application developers, IDS engineers and security personnel responsible for assessing networks, systems and applications for vulnerabilities. You will be tested on network attacks, crypto, network booting, restricted environments, Python, Scapy, Fuzzing and exploiting Windows and Linux for penetration testing.
The GXPN exam consists of hands-on testing in a lab environment where you will be tested on using actual programs, code and virtual machines. You will then be asked between 55 to 75 questions that “require performance of real-world-like tasks that mimic specialized job roles.” Exams take place online using a virtual learning environment that lets students get the experience of a proctored, hands-on lab exam, without the need to travel.
The GXPN certification is one of the highest earning IT certifications, earning professionals a median of 13 percent their base salary, which is an eight percent increase over the past 12 months and 30 percent of that growth took place in the past three months.
Exam fee: $1,999
Expiration: Certifications expire after four years, but during that time you will need to pay an annual maintenance fee and complete CPE credits.
Information Systems Security Architecture Professional (CISSP-ISSAP)
The ISC2 offers the Information Systems Security Architecture Professional (CISSP-ISSAP) as a concentration to the main Certified Information Systems Security Professional (CISSP) certification. You’ll need to earn your CISSP before you can take the ISSAP concentration exam, which is a specialized architecture credential that requires you to have two years of cumulative paid work experience in one or more of the six domains found in the CISSP-ISSAP Common Book of Knowledge.
The credential is designed for people responsible for security implementation and who have responsibilities that fall “between the C-suite and upper managerial level,” such as chief security architects and analysts. As of Oct. 14, the exam will cover six domain areas, including architect for governance and risk management, security architecture modeling, infrastructure security, identity and access management architecture, architect for application security and security operations architecture.
While the CISSP-ISSAP certification declined in value over the past 12 months, dropping 7 percent in premium pay value, it still earns IT professionals a median 13 percent of their base salary pay.
Exam fee: $599
Expiration: Certifications are valid for three years. You will need to complete CPE credits annually to maintain your certification. You will also pay an annual maintenance fee of $125, due on the anniversary of your certification date.
PMI Program Management Professional (PgMP)
The PMI Program Management Professional (PgMP) certification is designed for program managers or anyone who has the responsibility or ability to manage multiple projects, navigate complex environments and activities across several departments and to align those projects with organizational goals.
To qualify for the exam you will need a secondary degree, 4 years of project management experience or your PMP certification and 7 years of program management experience within the past 15 years. Alternatively, if you have a four-year degree, you can qualify with 4 years of project management experience or your PMP certification and 4 years of program management experience within the past 15 years.
The PMI certification dropped 7 percent in premium pay value over the past 12 months, earning IT professionals a median of 13 percent of their base salary.
Exam fee: $800
Expiration: The PgMP certification expires after three years. You will also need to earn 60 professional development credits during those three years to maintain your certification.
