One of seven role studies in the ATS Resume Keyword Study — 3,518 job postings from 81 companies, counted term by term.
CISSP appears in 5.7% of them. Python appears in 53.3%.
51 companies · collected 2026-08-29 · written for anyone deciding whether a certification or a codebase belongs at the top of their resume · Updated September 28, 2026 · By ZoeVera
A government or regulated-industry role may name the certification this sample rarely does. Paste the posting you are applying to and see what it asks for.
Check My Resume →Or read the infrastructure postings, where the cloud rows overlap · how often engineering postings name Python and Go
Every certification we counted, with its 95% interval. At 212 postings, rows this small overlap heavily.
| Certification | Postings | Share | ±95% |
|---|---|---|---|
| CISSP | 12 | 5.7% | ±3.1 |
| OSCP | 12 | 5.7% | ±3.1 |
| CISM | 6 | 2.8% | ±2.2 |
| Security+ | 5 | 2.4% | ±2.1 |
| GIAC / SANS | 5 | 2.4% | ±2.1 |
| CEH | 2 | 0.9% | ±1.3 |
| For scale: the three practices named most | |||
| incident response | 80 | 37.7% | ±6.5 |
| threat modeling | 74 | 34.9% | ±6.4 |
| IAM / identity | 51 | 24.1% | ±5.8 |
The data cannot rank most of these certifications. Of the 15 possible pairings among the six, 13 are inside the margin of error. The only gaps big enough to call are CISSP over CEH and OSCP over CEH. Anyone telling you, on evidence like this, that one certification is “what employers want” is reading an order into noise.
What the data can say is the scale. Add up every mention of all six certifications and you get 42 — counting a posting twice if it names two. Python alone is in 113 postings, and incident response in 80. At these companies the credential is rarely the thing written into the posting.
The finding above has a hard boundary, and it matters more here than anywhere else on this page.
These are 51 technology companies hiring through modern applicant tracking systems. Government agencies, defense contractors, and the firms that serve them are not in this sample — and that is exactly where security certifications are frequently mandatory rather than optional. US Department of Defense roles have long carried explicit certification requirements for security positions, and banking, healthcare and consulting each have their own conventions.
So the honest reading is narrow: if you are targeting security roles at technology companies, your resume should lead with the systems you have secured and the code you have written, not the credentials after your name. If you are targeting the public sector or a regulated industry, this data says nothing about you.
Code. Python appears in 53.3% of postings and Go in 30.7%. Security work at these companies is engineering work, and a resume built around certifications rather than shipped code is answering a question they did not ask.
A named cloud. AWS is in 46.7%, GCP in 34%, Azure in 21.7%. Naming the specific cloud you have secured matters more than the generic phrase “cloud security,” because that is the term recruiters search on.
The generic category, more than the product. SIEM is named in 26.9% and Splunk in 6.6%; EDR or XDR in 19.3%. If you ran Splunk, write both words.
Frameworks, occasionally. MITRE ATT&CK and SOC 2 sit at 10.8% each, ISO 27001 at 9.4%, NIST at 8.5%. Compliance vocabulary is worth including when you have it, but it is not what most of these roles are screening for.
Share of the 212 postings mentioning each term, with its 95% interval. Read gaps smaller than the interval as ties.
01Python
53.3% ±6.7
02AWS
46.7% ±6.7
03incident response
37.7% ±6.5
04threat modeling
34.9% ±6.4
05GCP / Google Cloud
34% ±6.4
06Go
30.7% ±6.2
07SIEM
26.9% ±6
08IAM / identity
24.1% ±5.8
09Kubernetes
23.1% ±5.7
10Azure
21.7% ±5.5
11vulnerability management
19.8% ±5.4
12EDR / XDR
19.3% ±5.3
13penetration testing
19.3% ±5.3
14detection engineering
19.3% ±5.3
15on-call
18.9% ±5.3
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| CISSP | 12 | 5.7% | ±3.1 |
| OSCP | 12 | 5.7% | ±3.1 |
| CISM | 6 | 2.8% | ±2.2 |
| Security+ | 5 | 2.4% | ±2.1 |
| GIAC / SANS | 5 | 2.4% | ±2.1 |
| CEH | 2 | 0.9% | ±1.3 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| incident response | 80 | 37.7% | ±6.5 |
| threat modeling | 74 | 34.9% | ±6.4 |
| IAM / identity | 51 | 24.1% | ±5.8 |
| vulnerability management | 42 | 19.8% | ±5.4 |
| penetration testing | 41 | 19.3% | ±5.3 |
| detection engineering | 41 | 19.3% | ±5.3 |
| on-call | 40 | 18.9% | ±5.3 |
| cryptography | 29 | 13.7% | ±4.6 |
| secure code review | 26 | 12.3% | ±4.4 |
| red team | 24 | 11.3% | ±4.3 |
| zero trust | 22 | 10.4% | ±4.1 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| AWS | 99 | 46.7% | ±6.7 |
| GCP / Google Cloud | 72 | 34% | ±6.4 |
| Kubernetes | 49 | 23.1% | ±5.7 |
| Azure | 46 | 21.7% | ±5.5 |
| Terraform | 36 | 17% | ±5.1 |
| Linux | 25 | 11.8% | ±4.3 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| SIEM | 57 | 26.9% | ±6 |
| EDR / XDR | 41 | 19.3% | ±5.3 |
| SAST / DAST | 24 | 11.3% | ±4.3 |
| Splunk | 14 | 6.6% | ±3.3 |
| vulnerability scanning | 9 | 4.2% | ±2.7 |
| Burp Suite | 5 | 2.4% | ±2.1 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| SOC 2 | 23 | 10.8% | ±4.2 |
| MITRE ATT&CK | 23 | 10.8% | ±4.2 |
| ISO 27001 | 20 | 9.4% | ±3.9 |
| NIST | 18 | 8.5% | ±3.8 |
| FedRAMP | 13 | 6.1% | ±3.2 |
| GDPR | 10 | 4.7% | ±2.8 |
| PCI DSS | 7 | 3.3% | ±2.4 |
| HIPAA | 2 | 0.9% | ±1.3 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| Python | 113 | 53.3% | ±6.7 |
| Go | 65 | 30.7% | ±6.2 |
| Bash / shell | 12 | 5.7% | ±3.1 |
Which titles counted. Titles naming a cybersecurity role — security engineer, application or product security, detection, incident response, red team, threat intelligence, appsec and related. Physical security roles are explicitly excluded: “Lead Physical Security Engineer” matches the same words and is a different profession.
Terms that needed care. “Go” is matched case-sensitively with exclusions, because a bare match also catches “go to market.” Certification acronyms are matched as whole words only, and CEH case-sensitively as well.
Limits. 212 postings gives margins of error between ±1.3 and ±6.7 points, shown against every figure. Terms outside the 40-term list are uncounted, so absence here is not evidence of absence. It is a snapshot of open roles on 2026-08-29. And as above: technology companies only, so the certification finding stops at their door.
affirm · anaplan · anthropic · asana · bitgo · braze · brex · chime · cloudflare · coinbase · databricks · datadog · discord · elastic · faire · figma · flexport · gemini · gitlab · gusto · gympass · hellofresh · instacart · intercom · justworks · klaviyo · launchdarkly · lyft · mixpanel · mongodb · okta · oscar · peloton · pinterest · postman · reddit · ridgeline · ripple · robinhood · samsara · smartsheet · sofi · squarespace · stripe · tide · tripadvisor · twilio · vercel · verkada · zocdoc · zscaler
The table as it stands: 212 postings from 51 companies, 40 terms, method v1.0.
Every withdrawn row and corrected figure across the studies is listed in the corrections log. The analysis script that built this table and the collector it reads from are published as plain text.
Quote any figure on this page. If you do, link back to it so readers can see the sample and its limits rather than the number alone.
General citation
ZoeVera, “What 212 Cybersecurity Job Postings Actually Ask For” (method v1.0, data collected 2026-08-29). https://www.zoevera.com/resume/cybersecurity-job-description-keywords
APA style
ZoeVera. (2026-08-29). What 212 Cybersecurity Job Postings Actually Ask For. https://www.zoevera.com/resume/cybersecurity-job-description-keywords
MLA style
ZoeVera. “What 212 Cybersecurity Job Postings Actually Ask For.” ZoeVera, 2026-08-29, www.zoevera.com/resume/cybersecurity-job-description-keywords.
Chicago style
ZoeVera. “What 212 Cybersecurity Job Postings Actually Ask For.” ZoeVera, 2026-08-29. https://www.zoevera.com/resume/cybersecurity-job-description-keywords.
A government or regulated-industry role may name the certification this sample rarely does. Paste the posting you are applying to and see what it asks for.
Check My Resume →Or read the infrastructure postings, where the cloud rows overlap · how often engineering postings name Python and Go
The rest of the research
This role is one corpus of seven. The study hub holds the method, every role's figures, the limits of each sample, and the full dataset as a CSV.