Which security certifications should I list, and where?

List current, relevant certifications in a dedicated Certifications section near the top, with issuer and year. In security hiring, certifications are often checked early, so do not bury them.

Commonly listed examples:

• CompTIA Security+, CySA+ or PenTest+
• ISC2 CC (Certified in Cybersecurity) or CISSP
• GIAC certifications such as GSEC, GCIH or GCIA
• EC-Council CEH
• ISACA CISM or CISA, for governance and audit roles
• Vendor certifications, such as Microsoft SC-200 or Splunk Core Certified User

Example (fictional): "CompTIA CySA+, 2025; Microsoft Certified: Security Operations Analyst Associate (SC-200), 2024."

Some employers and contracts ask for particular certifications, so check each advert. Remove or renew expired ones rather than listing them as current. If you are preparing for an exam, you can add "CISSP – exam booked" or "in progress", but never list it as earned. Pair each certification with at least one bullet in your experience that shows the skill being used, because certifications without practice carry less weight with security hiring managers.