Between the foundational tier and the advanced or specialized credentials earned later sits the intermediate tier. Where an entry-level certification confirms that someone understands core concepts and vocabulary, an intermediate one shows that a professional can apply that knowledge to real work. These exams usually assume a year or two of hands-on experience, and many present scenario-based questions or practical tasks rather than pure recall.
What changes at this tier#
The signal shifts from knowledge to demonstrated competence in a defined area of practice. The boundary between tiers is informal, though: a credential one employer treats as intermediate, another may regard as a starting point. The tier describes what a person can do, not only what they know.
Credentials commonly placed here#
- CompTIA CySA+ (Cybersecurity Analyst) and PenTest+ target analysts and testers who know the basics and now need to demonstrate operational skill.
- The (ISC)2 SSCP (Systems Security Certified Practitioner) addresses implementers who administer security controls day to day.
- Many GIAC certifications from the SANS Institute, such as GCIH (Certified Incident Handler) or GSEC (Security Essentials), occupy this middle ground.
- The EC-Council Certified Ethical Hacker sits here as well.
These are representative examples rather than a fixed list or a required order.
What it signals to employers#
An intermediate credential tells an employer that the holder can be trusted with substantive, often unsupervised tasks within a specialty: triaging alerts, running a scoped assessment, responding to a routine incident, or maintaining a set of controls. These certifications tend to map to specific job functions, which makes them useful shorthand in hiring and in defining role requirements. They do not claim the breadth of judgment that advanced management credentials assert, and they rarely go as deep as specialized credentials in a single narrow domain.
Who pursues it#
This tier suits practitioners who have moved past their first role and want to formalize the skills they use in practice, as well as people entering security from an adjacent technical field, such as systems or network administration, who bring relevant experience. Professionals typically reach it after building a foundation through an entry-level certification, a degree, or time on the job, and often use it to anchor a move into a defined specialty. From here, some pursue the depth of a specialized credential while others work toward the seniority that advanced certifications represent.