Resources
Where to start, and what comes next.
Most people don't stall because the material is too hard. They stall because nobody told them which certification to take first, or that half the training is free. This page is that answer.
The path, stage by stage
There is no single right route, but there is a common one. Each stage assumes the one before it. Pick the certifications inside a stage that match where you want to end up — you do not need all of them.
Get in the door
0–6 monthsLeads to: help desk technician · desktop support · NOC technician · IT support specialist
Start here — A+ is the credential help desk managers actually look for. AZ-900 and Cloud Practitioner are cheap, take a couple of weeks, and prove to an employer that you finish what you start. Nobody skips this stage as fast as they think they will.
Cross into security
6–18 monthsLeads to: SOC analyst (tier 1) · security support · junior systems administrator
The one that matters — Security+ is the DoD 8140 baseline for most entry-level cyber work roles. If you want cleared or contractor work, this is the certification that opens the door, and it is the one we fund most often.
Do the work
18 months–3 yearsLeads to: SOC analyst (tier 2) · detection engineer · cloud support engineer · network administrator
Pick a lane — this is the stage where detection, cloud, and networking split apart. Choose based on the work you actually enjoyed in stage 2, not on which certification pays most on a salary survey.
Specialize
3 years and beyondLeads to: senior analyst · security engineer · automation and SOAR engineer · security architect
Don't pay for these yourself — by stage 4 you're employed, and most employers will cover advanced certifications and the renewal fees behind them. Ask before you spend your own money. Our funding is aimed at stages 1 through 3, where people have the least support.
Cost key: $ under roughly $150 · $$ roughly $150–450 · $$$ roughly $450 and up. Vendor pricing changes regularly — check the vendor's own site before you budget.
Training that costs nothing
Splunk free courses
Splunk gives away a large catalog of self-paced training, including everything you need for the Core Certified User exam.
Microsoft Learn
Complete free learning paths for AZ-900, SC-900, AZ-104, and SC-200. No account cost, no trial period.
AWS Skill Builder
A free tier covering Cloud Practitioner and much of Solutions Architect Associate.
Cisco Networking Academy
Free introductory networking and cybersecurity courses, and the on-ramp to CCNA.
CISA free services and tools
A federal catalogue of free security tools and services — worth knowing about, and worth naming in an interview.
Hands-on labs
TryHackMe and Hack The Box both run substantial free tiers. Start there before paying for either.
Money that isn't ours
We're not the only source of funding, and we're often not the largest. Check these first.
GI Bill & VET TEC
If you served, your benefits may cover certification training and exam fees outright. VET TEC has restarted as VET TEC 2.0 — check current enrollment status with the VA, since it has opened and closed before.
Virginia Career Works
Federally funded workforce training through your local workforce board. Underused, and it can cover a full training program rather than a single exam.
Employer tuition benefits
If you're already working anywhere, check whether your employer reimburses certifications. Many do and never advertise it.
Vendor scholarships
CompTIA and several vendors run periodic scholarship and voucher programs. Availability changes; ask us and we'll tell you what's open.
Note: ISC2's free Certified in Cybersecurity program, which many older guides still point to, closed in May 2026 after reaching one million certifications. The exam is now paid.
Requirements, jobs, and people
DoD 8140 work roles
The official qualification matrix on DoD Cyber Exchange — which certification a given federal cyber work role actually requires. The single most useful page on the internet if you want cleared work.
NICE Framework
The standard vocabulary for cyber work roles. Useful for translating a job posting into what the work really is.
ClearanceJobs & USAJOBS
Where cleared and federal roles are actually posted. Different conventions from commercial boards — we'll walk you through reading them.
Local community
BSides NoVA, and the Northern Virginia ISSA and ISACA chapters. More people get hired through a conversation at one of these than through any job board.
Current advisories
Live vulnerability and threat advisories from the Cybersecurity and Infrastructure Security Agency. Reading these regularly is the cheapest way to sound like someone who works in the field.