Certification Roadmaps: OSCP, PNPT, CRTP/CRTO, eJPT, Security+, CISSP & More

The certification market is designed to separate you from your money, and it is very good at it. There are hundreds of security certificates, they cost anywhere from a hundred to several thousand dollars, new ones launch constantly, and every vendor claims theirs is essential. Into this walks the aspiring security professional, anxious about the entry-level paradox from Chapter 1, and the temptation is to buy certainty: “if I just get enough certs, someone will hire me.” This produces the cert collector — a résumé with eight certificates and no job — because certifications, misunderstood, are one of the biggest wastes of time and money in a security career.

Understood correctly, one or two well-chosen certs are among the highest-return investments you can make. The difference is entirely in which certs, why, and when. A certificate is a tool with one main job (getting you past a résumé filter) and a few secondary ones (forcing structured learning, signalling commitment, satisfying a compliance requirement). Matched to your target role from Chapter 1 and your current stage, the right cert opens doors. Bought at random or stacked for their own sake, certs are a costly distraction from the portfolio and experience that actually get you hired (Chapter 3).

This chapter is the map through the market. It rates the certificates that matter by what they actually do for real hiring, groups them by the target roles from Chapter 1, and — most importantly — gives you a decision framework so you buy the one or two certs your specific path needs and skip the rest. It is opinionated and cost-honest on purpose, because the alternative is the vendor-sponsored version that recommends everything.

Why This Matters

Certifications are where beginners waste the most money and time, and where the waste is least visible until later. Every dollar and month spent on a cert your target role does not value is a dollar and month not spent on the portfolio, home lab, or CTF record that would have gotten you hired (Chapter 3). The cert collector’s résumé — many certificates, no demonstrated work — actually reads as a weakness to experienced hiring managers, who recognise it as substituting purchases for practice. Choosing certs well is therefore not just about spending wisely; it is about not sabotaging your candidacy with the wrong signal.

There is also a large regional and role-specific variance that generic advice ignores. In some markets and for some roles (government, compliance-driven enterprises, defense) a specific certificate is a hard gate — no cert, no interview, full stop. In others (many product companies, startups) certs barely register next to demonstrated skill. In offensive security, one particular cert (OSCP) has outsized recognition that no amount of portfolio fully replaces for getting the first interview. Knowing where your target sits on this spectrum — hard-gated, cert-helped, or cert-indifferent — determines whether a certificate is essential or optional for you. Getting that judgment right saves thousands of dollars and months of misdirected effort.

Part 1: What Certifications Actually Do (and Don’t)

Be precise about the job a certificate does, because the myths cause the waste.

What they do:

• Pass the résumé filter. The primary function. Many job postings and applicant-tracking systems screen for specific certs; without one you may never reach a human. This alone can justify the right cert.
• Force structured learning. A good cert with a hands-on exam (OSCP, PNPT) makes you actually learn a body of skills to a tested standard. The learning is often worth more than the paper.
• Signal commitment and baseline. To someone with no experience, a cert says “this person invested seriously and cleared a known bar.”
• Satisfy hard requirements. Some roles (government, DoD 8570, certain compliance and MSSP contracts) require named certs. There it is non-negotiable.

What they do NOT do:

• Guarantee a job. No cert closes an offer alone. They get you in the door; the portfolio, experience, and interview close it.
• Replace demonstrated work. A cert says you passed an exam; a portfolio (Chapter 3) says you can do the work. Managers weight the latter more.
• Stay valuable forever by stacking. The marginal value drops fast — the second cert in a domain adds little, the fifth adds nothing but cost.

The correct mental model: a certificate is a key that opens the résumé-screen door, not the thing that gets you hired once inside. Buy the key your target door needs, then spend everything else on being genuinely good and provable (Chapter 3).

Part 2: How to Read a Certificate’s Value

Evaluate any cert on four axes before buying:

• Recognition — do hiring managers for your target role and region know and respect it? A cert nobody recognises is worthless regardless of how hard it was. Recognition is role- and region-specific: OSCP is gold for pentest, meaningless for GRC.
• Rigor — is the exam hands-on/proctored (proves skill) or multiple-choice (proves study)? Hands-on certs (OSCP, PNPT, CRTO, the OffSec and GIAC practicals) carry far more weight because they are harder to fake.
• Cost & time — total price (exam + often mandatory training + retakes) and study time. A $5,000, six-month cert must clear a much higher bar than a $250 one.
• Fit to stage — is it aimed at your current level? An OSCP is wasted effort if you cannot yet clear an eJPT; a CISSP is impossible (and pointless) with no experience.

Value ~= Recognition(for YOUR role) x Rigor / (Cost x Time)   ... filtered by Fit-to-stage

The two axes people neglect are recognition for the specific role (they buy a respected-in-general cert their target does not care about) and fit to stage (they buy the prestigious hard cert before they are ready and fail or waste it). Both are covered per-cert below.

Part 3: The Foundational Tier

Where most people should start, and where many should stop for a while.

CompTIA Security+. The default baseline. Broad, vendor-neutral, multiple-choice, moderate cost. Recognition: very high — it is the most-requested cert in job filters and a hard requirement for many government/DoD-adjacent roles (it satisfies DoD 8570 IAT II). Rigor: low (it proves study, not skill). Verdict: the single best first cert for most people, especially for defensive/GRC/general roles and anywhere HR filters aggressively. If you are aiming Blue or GRC or unsure, start here.

CompTIA Network+ / A+. Network+ is useful if your networking is weak (it underpins everything); A+ matters mainly for IT-support pivots (Chapter 1’s adjacent-role path). Not essential for most security targets if your fundamentals (Notebooks 1–2) are solid.

ISC2 Certified in Cybersecurity (CC). A newer, free/cheap entry cert from the CISSP body. Growing recognition, good for absolute beginners and résumé-filter passing on a budget. A reasonable Security+ alternative or complement.

Google Cybersecurity Certificate (Coursera). A learning program more than a hiring cert. Fine for structured beginners and career-changers to build fundamentals; low standalone hiring recognition. Treat it as a course, not a credential.

The foundational-tier rule: get one (Security+ for most, CC on a budget) if your target role/region filters for it, then move to demonstrated work and a role-specific cert. Do not stack all four.

Part 4: The Offensive Ladder

The offensive certs have the clearest ladder and the highest prestige — and the highest cost-and-difficulty. Climb only as far as your target role requires.

eJPT (INE/eLearnSecurity). Entry-level, hands-on, affordable. Proves basic pentest methodology. Recognition: moderate and rising; a solid, low-cost first offensive cert and good OSCP preparation. Great value for confirming you are on the pentest path before spending big.

PNPT (TCM Security). A five-day, fully hands-on exam culminating in a real report and a live debrief presentation to assessors. Recognition: strong and growing, especially valued because it tests the whole job including reporting and client communication (Chapter 1’s “40% writing”). Far cheaper than OSCP, no mandatory expensive courseware. Excellent value and, for many, a smarter first serious pentest cert than OSCP.

OSCP (OffSec). The famous one. A 24-hour hands-on hacking exam plus a report, backed by the PEN-200 course. Recognition: the highest in offensive security — for junior pentest roles it is often the cert that gets the interview, and no portfolio fully substitutes for it in résumé filtering. Rigor: very high; cost: high (course + exam bundle, expensive). Verdict: the target cert for anyone serious about penetration testing, but earn it when ready (after eJPT/PNPT-level competence and heavy lab time), not as a first attempt.

The OffSec specialist ladder (after OSCP, for depth): OSEP (advanced evasion/red team), OSWE (advanced web/whitebox), OSED (exploit dev). These are senior specialisation, not entry certs — pursue only when your role demands that depth.

Active Directory & red team specialists:

• CRTP (Altered Security) — hands-on AD attack cert, affordable, high value-for-money, and directly job-relevant given AD’s ubiquity (Notebooks 4, 18). An excellent, cheap, targeted cert.
• CRTO (Zero-Point Security) — modern red team ops with C2 (Cobalt Strike), hands-on, strongly recognised for red team roles and well-priced for its quality. The go-to red team cert.

The offensive-ladder rule: eJPT or PNPT to confirm and enter, OSCP as the recognition-gate for pentest, CRTP/CRTO for AD/red-team targets, OSEP/OSWE/OSED only for senior specialisation. Do not buy OSCP as your first cert or stack the specialists early.

Part 5: Cloud Certifications

Cloud security is one of the highest-demand, best-paid paths (Chapter 1), and cloud certs are genuinely valued because the platforms are complex and provable.

Provider certs (know one cloud deeply):

• AWS: Solutions Architect Associate (fundamentals) → AWS Security Specialty (the security-focused one).
• Azure: AZ-900 (fundamentals) → AZ-500 (Azure Security Engineer).
• GCP: Associate Cloud Engineer → Professional Cloud Security Engineer.

Pick the cloud your target market uses (AWS dominates broadly; Azure in enterprise/Microsoft shops). A provider security cert plus real hands-on (Notebook 37) is a powerful combination for security-engineering roles.

Vendor-neutral cloud security:

• CCSP (ISC2) — cloud security at a governance/architecture level; recognised, experience-gated, pairs with CISSP-track careers.
• Certified Kubernetes Security Specialist (CKS) — for container/K8s-heavy roles.

Cloud-cert rule: one provider security cert for your target cloud beats collecting all three providers. Depth in one cloud is worth more than shallow breadth across all.

Part 6: Blue Team, SOC, and GRC/Management Certs

Defensive / SOC:

• BTL1 (Blue Team Labs / Security Blue Team) — hands-on, affordable, and increasingly recognised; an excellent practical entry cert for SOC/detection/DFIR, and a strong Blue counterpart to eJPT. Great value.
• CompTIA CySA+ — vendor-neutral analyst cert; decent recognition and satisfies some compliance filters. Reasonable for SOC-analyst targets.
• GIAC family (SANS) — the gold standard for depth, and the most expensive in the market: GCIH (incident handling), GCIA (intrusion analysis), GCFA/GCFE (forensics), GNFA (network forensics), GREM (malware RE). Recognition: very high; cost: very high (SANS training is thousands). Usually employer-funded — a superb reason to get a defensive job first and have them pay. Do not self-fund GIAC early.

GRC / Management (mostly experience-gated — not first certs):

• CISSP (ISC2) — the flagship management/architecture cert. Requires 5 years of experience (waivable to 4 with a degree; you can pass and become an “Associate” until you have the years). Recognition: extremely high for senior, management, and many enterprise roles. A career-defining cert later, not a starter.
• CISM (ISACA) — security management; strong for the management track.
• CISA (ISACA) — audit/GRC; the standard for audit and compliance careers (Notebook 42).
• CRISC (ISACA) — risk management; niche but respected in GRC.

The blue/GRC rule: BTL1 or CySA+ for SOC entry; let an employer fund GIAC; treat CISSP/CISM/CISA as mid-career targets once you have the experience they require.

Part 7: The ROI Analysis and Avoiding Cert Collecting

Run the numbers before buying. A certificate’s true cost is exam + mandatory training + study time + retakes, and its return is the doors it opens for your specific target.

Worth it when:
  - Your target role/region HARD-REQUIRES it (gov, DoD 8570, MSSP, some enterprise)
  - It passes the résumé filter your target employers use (Security+, OSCP for pentest)
  - It forces you to learn a body of skills you actually need (hands-on certs)
  - An employer will fund it (especially GIAC/SANS)

Waste when:
  - It's your 3rd+ cert in the same domain (marginal value ~ 0)
  - Your target role doesn't recognise it (OSCP for a GRC role, CISSP with no exp)
  - You're buying it to delay building a portfolio (the collector's trap)
  - You can't yet pass the tier below it (OSCP before eJPT-level skill)

The cert collector’s trap is the central danger: substituting purchases for practice because certs feel like measurable progress and portfolios feel ambiguous. Eight certs and no project reads as weakness, not strength. The rule that prevents it: one foundational cert + one role-specific cert is enough to be competitive for most first jobs. Everything beyond that should be demonstrated work (Chapter 3) until you are employed and can specialise (often employer-funded). If you are reaching for a third cert before you have a portfolio, stop and build the portfolio.

Part 8: Exam Strategy — Actually Passing the Hard Ones

Hands-on exams (OSCP, PNPT, CRTO, BTL1, the GIAC practicals) are pass/fail on skill under time pressure, and strategy matters as much as knowledge.

For hands-on hacking exams (OSCP-style):

• Methodology over tricks. Examiners test whether you follow a repeatable process (enumerate thoroughly, don’t tunnel-vision). Most failures are enumeration failures. “When stuck, enumerate harder” is the OSCP mantra for a reason.
• Time and rest management. A 24-hour exam is an endurance test. Plan sleep, breaks, and a “move on if stuck for N hours” rule (Chapter 43’s abandon discipline applies directly).
• Documentation as you go. The report is graded; screenshot and note every step during the exam, not after. A valid exploit with no proof screenshot scores zero.
• Lab time is the preparation. For OSCP, the PEN-200 labs (and PG Practice, HTB, TryHackMe boxes) are the actual study. Practical certs are earned in the labs, not the courseware.

For the report/debrief exams (PNPT): the report and live debrief are the point — practise writing professional findings and presenting them, because the technical part is only half.

For multiple-choice exams (Security+, CISSP): these reward structured study — official study guide, a question bank (practice exams), and understanding the exam’s way of thinking (CISSP famously wants the “manager’s answer,” not the technician’s). They are study problems, not skill problems.

The universal exam rule: train the exam’s actual format. A hands-on exam is passed by doing labs; a written exam is passed by drilling questions. Mismatched preparation is the top cause of failure.

Part 9: Hands-On — Build Your Certification Roadmap

Turn this chapter into a concrete, budgeted plan tied to your Chapter 1 target.

9.1 The decision framework

1. TARGET ROLE (from Chapter 1): ______________________
2. Does it HARD-REQUIRE a cert? (check 10 real postings in your region)
     - If yes, which? -> that cert is priority #1, non-negotiable.
3. FOUNDATIONAL: do postings filter for Security+ / CC?  -> get one if yes.
4. ROLE-SPECIFIC (pick ONE for your target):
     Pentest      -> eJPT/PNPT now, OSCP when ready
     Red/AD       -> CRTP (AD) or CRTO (red team ops)
     SOC/Blue     -> BTL1 or CySA+  (GIAC later, employer-funded)
     Cloud eng    -> one provider security cert (AWS/Azure/GCP)
     GRC          -> CySA+/CC now; CISA/CISM/CISSP when experienced
5. STOP. Two certs (foundational + role-specific) is enough to start.
     Everything else = portfolio (Chapter 3) until employed.

9.2 Budget and sequence it

CERT ROADMAP — <your target role>

Now (0-6 months):
  [ ] <foundational cert>   cost $____  study ~__ weeks   (résumé filter)
  [ ] <role-specific entry> cost $____  study ~__ weeks   (eJPT/BTL1/CRTP/...)
  Budget so far: $______

Later (after first job or when ready):
  [ ] <recognition-gate cert>  (OSCP / provider security / CISSP-track)
      -> ask if employer will FUND it
Deliberately SKIPPED (and why): _______________________________

9.3 A sanity check

Before paying for anything, answer: “Would this month and this money produce more job offers as a certificate, or as a portfolio project / home lab / CTF push?” (Chapter 3). If the honest answer is the portfolio, do the portfolio. Certs are a means to pass filters and learn structured skills — not a substitute for being provably good.

9.4 Extending the plan

• Re-run the posting check quarterly; cert demand shifts, and what your target requires today may change.
• Build a small fund and watch for exam sales/vouchers (OffSec, CompTIA, and SANS work-study/discounts materially cut cost).
• If aiming Blue, prioritise getting an employer who funds GIAC over self-funding it.

Part 10: Common Pitfalls

Cert collecting. Stacking certificates as a substitute for a portfolio. Eight certs, no project reads as weakness. Two well-chosen certs + demonstrated work wins.

Buying prestige for the wrong role. OSCP for a GRC job, CISSP with no experience. Recognition is role- and stage-specific; match it.

Starting at the top. Attempting OSCP before eJPT-level skill and failing (and losing the fee). Climb the ladder; earn hands-on certs in the labs.

Self-funding SANS/GIAC early. They are thousands of dollars and usually employer-funded. Get the job first, then have them pay.

Ignoring hard requirements. Missing that your target (gov/DoD/MSSP) mandates a specific cert, and applying without it. Check real postings first.

Mismatched exam prep. Studying courseware for a hands-on exam, or doing labs for a multiple-choice one. Train the exam’s actual format.

No report/documentation discipline on practical exams. Losing a pass because valid exploits had no proof screenshots. Document as you go.

Treating certs as the finish line. They open the résumé-screen door; the portfolio and interview get you hired. Budget accordingly.

Final Revision / Summary

• A certificate’s main job is passing the résumé filter; its secondary jobs are forcing structured learning, signalling commitment, and satisfying hard requirements. It does not guarantee a job or replace demonstrated work.
• Read value on four axes: recognition for your role and region, rigor (hands-on beats multiple-choice), cost/time, and fit to your stage. The neglected two are role-specific recognition and stage fit.
• Foundational tier: get one (Security+ for most, ISC2 CC on a budget) if your target filters for it — then move on. Don’t stack A+/Network+/Google/CC together.
• Offensive ladder: eJPT/PNPT to enter (PNPT is excellent value and tests reporting), OSCP as the recognition-gate for pentest, CRTP (AD) / CRTO (red team) for those targets, OSEP/OSWE/OSED for senior specialisation only.
• Cloud: one provider security cert for your target cloud (AWS Security Specialty / AZ-500 / GCP PCSE) beats collecting all three; CCSP/CKS for architecture/K8s.
• Blue/GRC: BTL1 or CySA+ for SOC entry; GIAC is gold but expensive — let an employer fund it; CISSP/CISM/CISA are experience-gated mid-career targets, not first certs.
• ROI: worth it when hard-required, filter-passing, skill-forcing, or employer-funded; waste when it’s your 3rd+ in a domain, unrecognised by your role, a portfolio-avoidance tactic, or above your current tier. One foundational + one role-specific is enough to start.
• Avoid the cert collector’s trap: reaching for a third cert before you have a portfolio is the signal to stop and build the portfolio (Chapter 3).
• Pass hard exams by training their actual format: labs and methodology + documentation for hands-on (OSCP/PNPT/BTL1), question-drilling and the exam’s mindset for written (Security+/CISSP).
• The roadmap exercise produces a budgeted, sequenced two-cert plan tied to your Chapter 1 target, with a sanity check against spending the same time/money on a portfolio instead.

Cheat Sheet / Quick Reference

Pick by target role (foundational + ONE role-specific)

Everyone/filter-heavy : Security+ (or ISC2 CC budget)
Pentest               : eJPT/PNPT -> OSCP (when ready)
Red team / AD         : CRTP (AD) / CRTO (red ops)
SOC / Blue            : BTL1 or CySA+  (GIAC later, employer-funded)
Cloud engineering     : AWS Sec Specialty / AZ-500 / GCP PCSE (pick your cloud)
GRC / management      : CySA+/CC now; CISA/CISM/CISSP when experienced

Value formula

Recognition(for YOUR role) x Rigor / (Cost x Time), filtered by fit-to-stage
hands-on > multiple-choice   |   role-specific recognition > general prestige

Rules

one foundational + one role-specific = enough to start
3rd cert before a portfolio = STOP, build the portfolio
GIAC/SANS = employer-funded   |   CISSP = mid-career, needs experience
OSCP = earn in the labs; document as you go; enumerate harder when stuck

Practice / Resources

Do this now

• Complete the Part 9 roadmap: check 10 real postings for hard requirements, pick one foundational + one role-specific cert, budget and sequence them, and record what you deliberately skip.
• Run the sanity check: cert vs portfolio for your next month/dollars.

Cert sources (official)

• CompTIA (Security+/CySA+), OffSec (OSCP/OSEP/OSWE/OSED), TCM Security (PNPT), INE/eLearnSecurity (eJPT), Altered Security (CRTP), Zero-Point Security (CRTO), Security Blue Team (BTL1), ISC2 (CC/CISSP/CCSP), ISACA (CISM/CISA/CRISC), SANS/GIAC, and AWS/Azure/GCP training.

Prep

• Hands-on: HackTheBox, TryHackMe, OffSec Proving Grounds, and Notebook 43 (CTF) for OSCP-style skill.
• Written: official study guides + a reputable question bank; for CISSP, practice the “manager’s answer” mindset.
• Community exam reviews (r/oscp, TCM/OffSec Discords) for honest difficulty and prep guidance.

Next in this notebook

• Chapter 3 (Portfolio, Home Lab & CTF Plan) — the demonstrated work that certs cannot replace and that beats a third certificate every time.
• Chapter 4 (Resume & Interviews) — putting the cert on the résumé where it does its one job, and closing the offer.