One of seven role studies in the ATS Resume Keyword Study counts 3,518 job postings from 81 companies, term by term. Terms counted in more than one role are compared in the same-term comparison across roles.
Keyword study
CISSP appears in 5.7% of them. Python appears in 53.3%.
Before you apply
A government or regulated-industry role may name the certification this sample rarely does. Paste the posting you are applying to and see what it asks for.
Check My ResumeEvery certification we counted, with its 95% interval. At 212 postings, rows this small overlap heavily.
| Certification | Postings | Share | ±95% |
|---|---|---|---|
| CISSP | 12 | 5.7% | ±3.1 |
| OSCP | 12 | 5.7% | ±3.1 |
| CISM | 6 | 2.8% | ±2.2 |
| Security+ | 5 | 2.4% | ±2.1 |
| GIAC / SANS | 5 | 2.4% | ±2.1 |
| CEH | 2 | 0.9% | ±1.3 |
| For scale: the three practices named most | |||
| incident response | 80 | 37.7% | ±6.5 |
| threat modeling | 74 | 34.9% | ±6.4 |
| IAM / identity | 51 | 24.1% | ±5.8 |
The data cannot rank most of these certifications. Of the 15 possible pairings among the six, 13 are inside the margin of error. The only gaps big enough to call are CISSP over CEH and OSCP over CEH. Anyone telling you, on evidence like this, that one certification is “what employers want” is reading an order into noise.
What the data can say is the scale. Add up every mention of all six certifications and you get 42, counting a posting twice if it names two. Python alone is in 113 postings, and incident response in 80. At these companies the credential is rarely the thing written into the posting.
The finding above has a hard boundary, and it matters more here than anywhere else on this page.
These are 51 technology companies hiring through modern applicant tracking systems. Government agencies, defense contractors, and the firms that serve them are not in this sample, and that is exactly where security certifications are frequently mandatory rather than optional. US Department of Defense roles have long carried explicit certification requirements for security positions, and banking, healthcare and consulting each have their own conventions.
So the honest reading is narrow: if you are targeting security roles at technology companies, your resume should lead with the systems you have secured and the code you have written, not the credentials after your name. If you are targeting the public sector or a regulated industry, this data says nothing about you.
Code. Python appears in 53.3% of postings and Go in 30.7%. Security work at these companies is engineering work, and a resume built around certifications rather than shipped code is answering a question they did not ask.
A named cloud. AWS is in 46.7%, GCP in 34%, Azure in 21.7%. Naming the specific cloud you have secured matters more than the generic phrase “cloud security,” because that is the term recruiters search on.
The generic category, more than the product. SIEM is named in 26.9% and Splunk in 6.6%; EDR or XDR in 19.3%. If you ran Splunk, write both words.
Frameworks, occasionally. MITRE ATT&CK and SOC 2 sit at 10.8% each, ISO 27001 at 9.4%, NIST at 8.5%. Compliance vocabulary is worth including when you have it, but it is not what most of these roles are screening for.
Share of the 212 postings mentioning each term, with its 95% interval. Read gaps smaller than the interval as ties.
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| CISSP | 12 | 5.7% | ±3.1 |
| OSCP | 12 | 5.7% | ±3.1 |
| CISM | 6 | 2.8% | ±2.2 |
| Security+ | 5 | 2.4% | ±2.1 |
| GIAC / SANS | 5 | 2.4% | ±2.1 |
| CEH | 2 | 0.9% | ±1.3 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| incident response | 80 | 37.7% | ±6.5 |
| threat modeling | 74 | 34.9% | ±6.4 |
| IAM / identity | 51 | 24.1% | ±5.8 |
| vulnerability management | 42 | 19.8% | ±5.4 |
| penetration testing | 41 | 19.3% | ±5.3 |
| detection engineering | 41 | 19.3% | ±5.3 |
| on-call | 40 | 18.9% | ±5.3 |
| cryptography | 29 | 13.7% | ±4.6 |
| secure code review | 26 | 12.3% | ±4.4 |
| red team | 24 | 11.3% | ±4.3 |
| zero trust | 22 | 10.4% | ±4.1 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| AWS | 99 | 46.7% | ±6.7 |
| GCP / Google Cloud | 72 | 34% | ±6.4 |
| Kubernetes | 49 | 23.1% | ±5.7 |
| Azure | 46 | 21.7% | ±5.5 |
| Terraform | 36 | 17% | ±5.1 |
| Linux | 25 | 11.8% | ±4.3 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| SIEM | 57 | 26.9% | ±6 |
| EDR / XDR | 41 | 19.3% | ±5.3 |
| SAST / DAST | 24 | 11.3% | ±4.3 |
| Splunk | 14 | 6.6% | ±3.3 |
| vulnerability scanning | 9 | 4.2% | ±2.7 |
| Burp Suite | 5 | 2.4% | ±2.1 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| SOC 2 | 23 | 10.8% | ±4.2 |
| MITRE ATT&CK | 23 | 10.8% | ±4.2 |
| ISO 27001 | 20 | 9.4% | ±3.9 |
| NIST | 18 | 8.5% | ±3.8 |
| FedRAMP | 13 | 6.1% | ±3.2 |
| GDPR | 10 | 4.7% | ±2.8 |
| PCI DSS | 7 | 3.3% | ±2.4 |
| HIPAA | 2 | 0.9% | ±1.3 |
| Term | Postings | Share | ±95% CI |
|---|---|---|---|
| Python | 113 | 53.3% | ±6.7 |
| Go | 65 | 30.7% | ±6.2 |
| Bash / shell | 12 | 5.7% | ±3.1 |
Which titles counted. Titles naming a cybersecurity role, security engineer, application or product security, detection, incident response, red team, threat intelligence, appsec and related. Physical security roles are explicitly excluded: “Lead Physical Security Engineer” matches the same words and is a different profession.
Terms that needed care. “Go” is matched case-sensitively with exclusions, because a bare match also catches “go to market.” Certification acronyms are matched as whole words only, and CEH case-sensitively as well.
Limits. 212 postings gives margins of error between ±1.3 and ±6.7 points, shown against every figure. Terms outside the 40-term list are uncounted, so absence here is not evidence of absence. It is a snapshot of open roles on 2026-08-29. And as above: technology companies only, so the certification finding stops at their door.
affirm · anaplan · anthropic · asana · bitgo · braze · brex · chime · cloudflare · coinbase · databricks · datadog · discord · elastic · faire · figma · flexport · gemini · gitlab · gusto · gympass · hellofresh · instacart · intercom · justworks · klaviyo · launchdarkly · lyft · mixpanel · mongodb · okta · oscar · peloton · pinterest · postman · reddit · ridgeline · ripple · robinhood · samsara · smartsheet · sofi · squarespace · stripe · tide · tripadvisor · twilio · vercel · verkada · zocdoc · zscaler
All seven studies use the same collection and counting method, so their figures can be read side by side.
A percentage is the share of the 212 postings in this sample that name the term at least once. It is not the share of all employers that ask for it, a cutoff an applicant tracking system applies, or a measure of your chances of an interview.
The 95% interval shows sampling error only. It does not correct for which companies publish on the job boards it draws from or for the one-day snapshot. A larger sample for one role says nothing about which role is more in demand or more important.
The table as it stands: 212 postings from 51 companies, 40 terms, method v1.0.
Every withdrawn row and corrected figure across the studies is listed in the corrections log. The analysis script that built this table and the collector it reads from are published as plain text.
Quote any figure on this page. If you do, link back to it so readers can see the sample and its limits rather than the number alone.
General citation
ResumeFitting, “What 212 Cybersecurity Job Postings Actually Ask For” (method v1.0, data collected 2026-08-29). https://resumefitting.com/cybersecurity-job-description-keywords
APA style
ResumeFitting. (2026-08-29). What 212 Cybersecurity Job Postings Actually Ask For. https://resumefitting.com/cybersecurity-job-description-keywords
MLA style
ResumeFitting. “What 212 Cybersecurity Job Postings Actually Ask For.” ResumeFitting, 2026-08-29, resumefitting.com/cybersecurity-job-description-keywords.
Chicago style
ResumeFitting. “What 212 Cybersecurity Job Postings Actually Ask For.” ResumeFitting, 2026-08-29. https://resumefitting.com/cybersecurity-job-description-keywords.
Before you apply
A government or regulated-industry role may name the certification this sample rarely does. Paste the posting you are applying to and see what it asks for.
Check My ResumeOr read the infrastructure postings, where the cloud rows overlap · how often engineering postings name Python and Go
The rest of the research
The study hub holds the method, every role's figures, the limits of each sample, and the full dataset as a CSV.