The intermediate tier covers certifications that sit between foundational, entry-level credentials and the advanced or specialized credentials earned later in a career. Where an entry-level certification confirms that someone understands core concepts and vocabulary, an intermediate certification is meant to show that a professional can apply that knowledge to real work. These credentials usually assume a year or two of hands-on experience, and many examinations present scenario-based questions or practical tasks rather than pure recall. The tier signals competence in a defined area of practice, not just familiarity with it.
Several well-known certifications are commonly placed here. CompTIA's CySA+ (Cybersecurity Analyst) and PenTest+ target analysts and testers who already know the basics and now need to demonstrate operational skill. The (ISC)2 SSCP (Systems Security Certified Practitioner) addresses implementers who administer security controls day to day. Many GIAC certifications from the SANS Institute, such as GCIH (Certified Incident Handler) or GSEC (Security Essentials), occupy this middle ground as well, as does the EC-Council's Certified Ethical Hacker. These are representative examples rather than a fixed list or a required order, and the boundary between tiers is informal; a credential one employer treats as intermediate another may regard as a starting point.
What these certifications signal to employers is that the holder can be trusted with substantive, often unsupervised tasks within a specialty: triaging alerts, running a scoped assessment, responding to a routine incident, or maintaining a set of controls. They tend to map to specific job functions, which makes them useful shorthand in hiring and in defining role requirements. They do not claim the breadth of judgment or the leadership scope that advanced management credentials assert, and they rarely go as deep as specialized credentials in a single narrow domain.
The intermediate tier suits practitioners who have moved past their first role and want to formalize the skills they use in practice, as well as people entering security from an adjacent technical field, such as systems or network administration, who bring relevant experience and want a credential that reflects it. Professionals typically approach this tier after building a foundation, whether through an entry-level certification, a degree, or time on the job, and they often use it to anchor a move into a defined specialty. From here, some pursue the depth of a specialized credential while others work toward the breadth and seniority that advanced certifications represent. Read alongside the Entry-Level, Advanced, and Specialized pages, this tier marks the point where a certification starts to describe what a person can do rather than only what they know.