Which certification should I choose first?

For most beginners CompTIA Security+ is a good start — it is vendor-neutral, widely recognized and gives a common foundation for every track. Before it, it is useful to build up the basics of Linux and networking hands-on.

Which certification fits the defense (Blue Team) track?

One of the hands-on certifications aimed at SOC analyst and incident response roles is BTL1 (Blue Team Level 1). It is a topic-based, hands-on certification that tests defensive skills on real tasks.

CEH or OSCP — which one for the offense track?

CEH gives broad conceptual coverage and is usually taken at an earlier stage; OSCP is a hands-on exam that requires deep, real penetration testing and is at a more advanced level. The sequence of CEH first, then OSCP is most often chosen.

Is it possible to get hired without a certification?

Yes, with a strong portfolio and a demonstration of practical skill. For many employers real lab work is more convincing than a certification — but the ideal option is a combination of both.

Do certifications expire?

Some certifications must be renewed after a certain period with continuing education units (CEU). The exact terms are listed on each certification's official site, so you need to check them before making a decision.

Does a course guarantee the certification?

No serious course can guarantee an exam result. Log Academy aims not at the certification exam but at real skill — which makes preparing for recognized certifications easier, because the skill is already in place.

Kibertəhlükəsizlik · 9 min read

Cybersecurity certifications: which one to choose and in what order?

A cybersecurity certification is a document that independently confirms your knowledge and signals it to employers on your resume. But a certification by itself does not land you a job — it is proof of a real skill. For a beginner, the most logical sequence is this: first a broad foundational certification (for example CompTIA Security+), then a hands-on certification matched to your chosen track — BTL1 for defense, and for offense CEH or the deeper OSCP. The key rule: aim for a certification not ahead of the skill, but as confirmation of the skill.

A certification confirms a skill, it does not replace it — skill first, certification second.
A broad foundation for starting out: CompTIA Security+ — a vendor-neutral, widely recognized certification.
A practical target for the defense (Blue Team) track: BTL1 (Blue Team Level 1).
For the offense (Red Team) track: CEH (broad) or OSCP (deep, hands-on).
Certifications are split into "vendor-neutral" and "vendor-specific" — both have their place.
A good course prepares you for real work, not for a certification exam; the certification is a by-product of that.
At Log Academy every track ends with a practical portfolio and a certificate; the first lesson is free.

Why do you need a cybersecurity certification?

A certification serves three purposes: it confirms your knowledge against a standard measure, it helps your resume get through initial filters, and for some vacancies it is a formal requirement. Especially for a candidate with little experience so far, a recognized certification sends the signal "this person knows the basics." However, a certification never replaces a real skill — in an interview you are expected to read logs, operate tools and explain your reasoning. That is why the right strategy is to earn the certification together with the skill, as its confirmation.

How do vendor-neutral and vendor-specific certifications differ?

Vendor-neutral certifications test general principles and are not tied to a specific product — for example CompTIA Security+. Vendor-specific certifications, on the other hand, confirm that you know a particular platform — for example a specific SIEM or cloud platform. For a beginner it is usually more logical to start with a vendor-neutral foundation and then add a vendor-specific certification matched to the environment you work in.

How do the main cybersecurity certifications compare?

Widely recognized certifications, their level and matching track
Certification	Level	Focus / track
CompTIA Security+	Entry, foundational	Broad fundamentals — a common base for every track
BTL1 (Blue Team Level 1)	Entry–intermediate, hands-on	Defense: SOC analyst, triage, incident response
CEH (Certified Ethical Hacker)	Intermediate, broad	Offense: ethical hacking concepts, broad topic coverage
OSCP	Advanced, deep hands-on	Offense: real penetration testing, a practical exam
CompTIA Network+	Entry, foundational	Networking fundamentals — a useful step before Security+

The order in the table is a rough difficulty line: foundational certifications test concepts, while hands-on certifications (BTL1, OSCP) require you to demonstrate skill in a real environment. OSCP is especially demanding — the exam is not a theoretical test but working against real targets under controlled conditions.

What should a certification roadmap look like for a beginner?

Build the foundation: learn the basics of Linux, networking and operating systems hands-on — skill before the certification.
A broad foundational certification: confirm general cybersecurity concepts with CompTIA Security+.
Choose a track: defense (Blue Team) or offense (Red Team) — based on your interest and market demand.
A hands-on certification for the track: BTL1 for defense; for offense CEH first, then OSCP.
Build a portfolio: at every stage gather real lab work and reports — together with the certification, these are decisive in an interview.

Note

Seeing a certification as a "shortcut" is a mistake. When an employer sees a certification, the next question is often: "Show me this in practice." So when you prepare for a certification, put your main focus not on the exam question but on applying that skill in a real environment. A portfolio and lab experience are a stronger argument than a certification alone.

Is it better to prepare for a certification on your own or with a course?

An experienced professional can prepare for some certifications on their own. But for a beginner a structured course offers two advantages: first, the lab environment comes ready — you do not waste time setting up a virtual range, configuring tools and building real scenarios; second, mentor feedback corrects mistakes quickly. The right course prepares you not only for the exam but also for the working environment — and the certification becomes a natural by-product of that preparation.

How we do it in our lab

Teaching at Log Academy is aimed not at cramming for a certification exam but at real skill. Each track (Blue Team, Red Team, DevSecOps) runs for 6 months and is built on an individual virtual lab: the student works with real tools, prepares a final project and gathers a portfolio. This foundation then makes preparing for recognized certifications much easier (for example hands-on certifications such as BTL1 for defense), because the skill is already in place. If you cannot decide which certification fits your goal, a free consultation will recommend a track and sequence. Groups are 8–12 people, and the first lesson is free.

Can you start working in cybersecurity without a certification?

Yes, especially with a strong portfolio. For many employers real lab work, research reports and a demonstration of practical skill are more convincing than a certification. The ideal scenario is a combination of both: the skill + a certification that confirms it + a portfolio that shows it. That is why it is right to see a certification not as the goal but as part of a larger preparation.

Which certification should I choose first?: For most beginners CompTIA Security+ is a good start — it is vendor-neutral, widely recognized and gives a common foundation for every track. Before it, it is useful to build up the basics of Linux and networking hands-on.
Which certification fits the defense (Blue Team) track?: One of the hands-on certifications aimed at SOC analyst and incident response roles is BTL1 (Blue Team Level 1). It is a topic-based, hands-on certification that tests defensive skills on real tasks.
CEH or OSCP — which one for the offense track?: CEH gives broad conceptual coverage and is usually taken at an earlier stage; OSCP is a hands-on exam that requires deep, real penetration testing and is at a more advanced level. The sequence of CEH first, then OSCP is most often chosen.
Is it possible to get hired without a certification?: Yes, with a strong portfolio and a demonstration of practical skill. For many employers real lab work is more convincing than a certification — but the ideal option is a combination of both.
Do certifications expire?: Some certifications must be renewed after a certain period with continuing education units (CEU). The exact terms are listed on each certification's official site, so you need to check them before making a decision.
Does a course guarantee the certification?: No serious course can guarantee an exam result. Log Academy aims not at the certification exam but at real skill — which makes preparing for recognized certifications easier, because the skill is already in place.