Twice a week, someone emails me asking "is CISSP still worth it?" The answer used to be "yes, obviously." By 2026 the answer is "yes, but for a narrower set of reasons than it used to be." I pulled the last 90 days of CISSP-tagged job posts off three major boards last month to answer this properly.

The salary data

Median compensation for roles that explicitly require or prefer CISSP:

United States (90-day sample, 2,408 postings):

  • Security Engineer / Senior: $142,000–$178,000
  • Security Architect: $168,000–$215,000
  • Security Manager / Program Manager: $155,000–$190,000
  • CISO / VP Security: $220,000+

United Kingdom (340 postings):

  • Security Engineer: £68,000–£92,000
  • Security Architect: £95,000–£130,000
  • CISO: £160,000+

India (420 postings):

  • Security Engineer: ₹18L–₹32L
  • Security Architect: ₹32L–₹60L
  • CISO: ₹80L+

Compared to the same-sample data from 2021, US CISSP-tagged postings are up on median base pay by about 11% — roughly in line with tech pay broadly, not above. The "CISSP premium" as a specific number is harder to isolate in 2026 than it was five years ago.

Where CISSP still clearly wins

Two specific job categories have not weakened:

1. Government and defense-adjacent roles

DoD 8570 / 8140 still lists CISSP for IAT Level III and IAM Level II/III. If your career track is US federal, cleared contractor, UK MoD, or NATO-country defense, CISSP is often a hard requirement. No other cert substitutes cleanly.

2. Security architect roles at large enterprises

The "Security Architect" job family, especially at financial services and healthcare, still lists CISSP as required or preferred on 80%+ of postings I audited. CISSP signals the breadth (eight domains) that those employers want — they do not want a technically deep engineer, they want someone who can connect security to risk, compliance, and business.

Where CISSP matters less than it used to

Three places:

1. Pure cloud security roles

"AWS Security Specialty" or "Azure AZ-500" or "GCP Professional Cloud Security Engineer" now matches the job posting better on cloud-native security roles. When a hiring manager for a cloud-first security team writes a job description, they increasingly name the cloud-specific cert first. CISSP is still nice to have but no longer the only path in.

2. Red team / offensive security

CISSP was never strong here, and it is weaker now. OSCP, OSEP, OSCE³, and CRTO do a better job of signaling technical depth for offensive roles. If your career is penetration testing or adversary simulation, CISSP is optional at best.

3. GRC-only roles

CISA and CRISC have taken share from CISSP for audit-and-compliance-heavy roles. CISSP still works, but it is no longer the default.

The time cost vs the return

CISSP requires:

  • Five years of paid, full-time work experience in at least two of the eight domains (four with a degree or waiver)
  • 100–200 hours of study, depending on background
  • $749 exam fee
  • $125/year AMF
  • 120 CPE credits per three-year cycle

If you have the experience, 150 hours of study, and $749, and you land a role paying $15–25k more than you would otherwise, CISSP pays for itself in the first paycheck.

If you are in a cloud-specific security track, the same 150 hours might better be spent on the cloud specialty cert for your target platform, plus maybe AWS Security Specialty as a second credential. Combined time is about the same; the match to job descriptions is better.

The one use case I would not skip CISSP for

If you are planning a security management track — BISO, CISO, VP Security — CISSP is still the single most broadly recognized credential for the title. Hiring managers for those roles are often non-technical themselves; they recognize CISSP. They may not recognize AWS Security Specialty even at the CISO-hiring level.

If management is your trajectory, get CISSP.

One 2025 development worth noting

ISC² launched the Certified in Cybersecurity (CC) entry-level cert in 2023 and has been pushing it heavily as the "Associate of ISC²" pathway. By 2026, a measurable number of junior security analysts are entering the field with CC first, then building toward CISSP with experience. That is a reasonable pathway — CC is free for students and free first-year for career-changers through the ISC² One Million initiative. If you are pre-experience, take CC first and work toward CISSP.

The 2026 decision tree

  • Government / defense track? → Yes, get CISSP.
  • Aiming at security architect or management? → Yes, get CISSP.
  • Cloud-native security engineer? → Cloud cert first, CISSP second if your employer rewards it.
  • Red team / offensive? → Skip CISSP, go OSCP/OSEP instead.
  • Pre-experience? → CC first, CISSP in 4–5 years when you hit the experience bar.

CISSP is not the credential it was in 2010 when it was the only game in town. It is still the credential it is in 2026: broad, recognized by non-technical hiring managers, mandatory in specific sectors, and a strong career investment for the right track. Match the cert to the track, not the other way around.