My recent article on pay trends for noncertified IT skills revealed more than thirty skills that are earning lucky tech workers cash pay premiums that are well above the average of all 661 skills reported in Foote Partners’ IT Skills and Certifications Pay IndexTM (ITSCPI) and, most importantly, still growing in market value. The remaining skills of the total of 1,245 skills reported in the most recent quarterly update (data collected from 4,010 employers through July 1, 2022) require attaining a formal certification to qualify for this extra pay.
But there is another important difference between certified and noncertified skills: while cash pay premiums for noncertified skills, usually paid in addition to salary, have on average been on a fairly steady climb for the last thirteen years, those for tech certifications have been on a downward trajectory for much of the past seven years. Also, noncertified skills are currently earning an average equivalent of nearly 10% of salary while the cash pay premium for IT certifications is a much lower 6.6% on average.
It’s not that certifications are not highly treasured by employers; many are, especially those in in areas such as security, architecture, project management, and processes. But the law of scarcity in economic theory tells us that losses and gains in cash pay premiums reflects a widening or narrowing, respectively, in the gap between their supply and demand. According to our long-running IT Skills and Certifications Volatility Index, market volatility has traditionally been high for IT certifications with supply often rising faster than demand, which depresses their market value.
Why? A big reason is that the vast majority of certifications have been created by infrastructure technology vendors solely to ensure that organisations who purchase their technology products are trained in how to use them. For this, workers receive a certification. The bar can be set quite low for attaining many certifications: sometimes just a multiple-choice test where a score of 70% correct answers (and even lower) is sufficient to pass. More advanced certifications may add a lab requirement for candidates to demonstrate their knowledge and skills in real time. But even labs can be constructed for easy passing scores. In general, the incentives for certification vendors to fail a candidate can be quite low.
Buy another factor driving excess supply compared to demand is the popularity of a certification for IT professionals choosing to redirect their careers into other areas of specialisation. For example, systems administrators have been hit hard by outsourcing and the popularity of cloud computing which has eliminated a lot of these positions at employers. With fewer opportunities for career advancement, many sys admins have sought full-time jobs in info/cybersecurity and earned security certifications to add new skills, knowledge and capabilities important to performing in this new role.
All of these factors have driven down the average pay premiums for the 121 security certifications tracked in the ITSCPI by nearly 9.4% in the last two years.
IT certifications bucking the downward trend
The following IT certifications meet two prerequisites:
- They recorded substantial gains in cash market value in the six months ending July 1, 2022
- They earned workers cash pay premiums well above the average of all 584 certifications in our IT Skills and Certifications Pay IndexTM
No IT certification that follows is earning less than the equivalent of 9% of base salary—significant considering the average for all skills reported is 6.6% of base—and every certification listed below grew between 9% and 38% in cash market value in the six months ending July 1st. They are listed in descending ranked order of market value gain (including ties).
In alphabetical order they are:
- AWS Certified DevOps Engineer – Professional
- AWS Certified Security - Specialty
- Certificate of Cloud Security Knowledge
- Certified in Governance, Risk and Compliance
- Certified in the Governance of Enterprise IT
- Certified Professional Scrum Product Owner
- GIAC Certified Forensics Analyst
- InfoSys Security Engineering Professional (ISSEP/CISSP)
- InfoSys Security Management Professional (ISSMP/CISSP)
- Okta Certified Administrator
- Okta Certified Consultant
- Okta Certified Developer
- Okta Certified Professional
- PMI Portfolio Management Professional
- SAFe Certification
- SAS® Certified Professional: AI and Machine Learning
- TOGAF 9 Certified (The Open Group Architecture Framework)
- Certified Professional Scrum Product Owner
Average pay premium: 14% of base salary equivalent
Market value increase: 27.3% (in the six months through July 1, 2022)
From a business standpoint, one of the most vital roles on any Scrum team is the Product Owner (PO). It is a challenging role, one that requires the PO to take accountability for making business decisions about the product–decisions such as which features to include and the priority of those features. However, these decisions cannot be made in a vacuum. Because the PO must get input from other business stakeholders, they need skills such as facilitation, conflict management, creative thinking, and the ability to influence the team and other stakeholders.
While the Certified ScrumMaster® helps the Scrum Team work together to learn and implement Scrum, the Certified Professional Scrum Product Owner® creates the product vision; writes or participates in the writing of product requirements; develops and prioritizes the list of these features; reviews, tests and accepts the product; and makes sure the best possible job is done to satisfy the customer. To achieve this certification, the candidate attends a live online or in-person course taught by a Certified Scrum Trainer® or receives private coaching from a Certified Agile Coach.
- GIAC Certified Forensics Analyst (GCFA)
Average pay premium: 12% of base salary equivalent
Market value increase: 20% (in the six months through July 1, 2022)
The GIAC Certified Forensics Analyst focuses on computer forensics in the context of investigation and incident response, and thus also focus on the skills and knowledge needed to collect and analyse data from Windows and/or Linux computer systems during such activities. It certifies that candidates have the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases. The GCFA certification focuses on core skills required to collect and analyse data from Windows and Linux computer systems.
GCFAs are front line investigators during computer intrusion breaches across the enterprise. They can help identify and secure compromised systems even if the adversary uses anti-forensic techniques. Using advanced techniques such as file system timeline analysis, registry analysis, and memory inspection, GCFAs are adept at finding unknown malware, rootkits, and data that the intruders thought had been eliminated from the system.
Areas of expertise covered in this certification include:
- Advanced Incident Response and Digital Forensics
- Memory Forensics, Timeline Analysis, and Anti-Forensics Detection
- Threat Hunting and APT Intrusion Incident Response
These are the most common roles for GPEN certificants:
- Incident Response Team Members
- Threat Hunters
- SOC Analysts
- Experienced Digital Forensic Analysts
- Information Security Professionals
- Federal Agents and Law Enforcement Professionals
- Red Team Members, Penetration Testers, and Exploit Developers
- GCFE and GCIH Cert Holders
- InfoSys Security Engineering Professional (ISSEP/CISSP)
Average pay premium: 12% of base salary equivalent
Market value increase: 9.1% (in the six months through July 1, 2022)
Despite corporate America and the US government sounding the cybersecurity alarm for years, there's a significant shortage of skilled information security professionals globally. Although numbers vary among various sources, a conservative estimate is that the number of unfilled cybersecurity jobs grew by 350% in the last eight years, from one million positions in 2013 to 3.5 million in 2021. Almost every day, around 10,000 positions are available on US job sites that request a Certified Information Systems Security Professional (CISSP). These are seasoned employees or consultants, usually with a title such as security manager, security analyst or chief information security officer, to name just a few. This person has been on the job for five or more years, and has thorough knowledge of the IT threat landscape, including emerging and advanced persistent threats, as well as controls and technology to minimise attack surfaces. A CISSP also creates policies that set a framework for proper controls and can perform or oversee risk management and software development security.
The Information System Security Engineering Professional offered by ISC(2) is primarily a concentration certification of its Certified Information Systems Security Professional (CISSP) certification, designed for those CISSP certificants working on enhancing their skills in security engineering. Originally developed in conjunction with the US National Security Agency, the ISSEP certification is ideally suited for security engineers, security analysts, information assurance analysts and officers, and security application developers who have had practical system engineering experience focused on developing highly secure systems. This security engineering certification recognises the keen ability to practically apply systems engineering principles and processes to develop secure systems. Certificants have the knowledge and skills to incorporate security into projects, applications, business processes and all information systems.
To qualify for the ISSEP certification exam, the candidate must first be CISSP-certified and have a minimum of two years of experience in engineering. The exam validates candidate’s skills in:
- Understanding of relationship between systems and security engineering
- Identifying information protection needs
- Defining security requirements, design security architecture and develop a security design
- Implementing system security
To meet the above skill areas the CISSP-ISSEP exam domains include:
- Domain 1 - Systems Security Engineering Foundations
- Domain 2 - Risk Management
- Domain 3 - Security Planning and Design
- Domain 4 - Systems Implementation, Verification and Validation
- Domain 5 - Secure Operations, Change Management and Disposal
- Certificate of Cloud Security Knowledge (CCSK)
Average pay premium: 11% of base salary equivalent
Market value increase: 37.5% (in the six months through July 1, 2022)
As organisations migrate to the cloud, they need information security professionals who are cloud-savvy. The Certificate of Cloud Security Knowledge from the Cloud Security Alliance is recognised as a standard of expertise for cloud security and gives you a cohesive and vendor-neutral understanding of how to secure data in the cloud. Earning the CCSK proves the knowledge to effectively develop a holistic cloud security program relative to globally accepted standards. It covers key areas, including best practices for IAM, cloud incident response, application security, data encryption, SecaaS, securing emerging technologies, and more. Plus, the CCSK credential is the foundation to prepare you to earn additional cloud credentials specific to certain vendors or job functions.
- [Tie] InfoSys Security Management Professional (ISSMP/CISSP)
Okta Certified Developer
TOGAF 9 Certified
Average pay premium: 11% of base salary equivalent
Market value increase: 10% (in the six months through July 1, 2022)
Similar to the ISSEP, the Information Systems Security Management Professional is another concentration certification of the Certified Information Systems Security Professional certification from ISC(2). The ISSMP is designed for those CISSP certificants working on enhancing their skills to show excellence at establishing, presenting and governing information security programs, demonstrating deep management and leadership skills whether you’re leading incident handling and/or a breach mitigation team. It allows CISSPs to concentrate further in security management areas and stresses the following elements of the CBK: Enterprise security management practices; enterprise-wide system development security; overseeing compliance of operations security; understanding BCP, DRP and continuity of operations planning (COOP); law, investigations, forensics and ethics. A CISSP-ISSMP certification is ideal for those working in roles such as: Chief Information Officer; Chief Information Security Officer; Chief Technology Officer; Senior Security Executive.