Good security engineers rarely wait for a career conversation. Many already have recruiters in their inbox, and a defined route to a respected certification can give them a reason to stay. It only works if the employer backs it with time, money and a clear sense of what comes next.
This guide covers why security staff leave, how to decide who belongs on a CISSP track, how to turn the certification’s requirements into career stages, and how to support each stage so the credential helps retention instead of helping people leave. It ends with a table of warning signs to check once the program is running.
Why Security Engineers Leave, and Where Growth Fits
Growth is one reason among several. ISACA’s State of Cybersecurity 2022 report, which surveyed more than 2,000 professionals, found that 60% of respondents had difficulty retaining qualified staff. The top reasons for leaving were being recruited by another company (59%), poor financial incentives (48%), limited promotion and development opportunities (47%) and high work stress (45%). That report is a few years old, so treat the numbers as a snapshot.
A more recent survey points the same way. The IANS and Artico Search talent report, covered by CSO Online in May 2026 and based on 500 professionals, found that only 34% planned to stay with their current employer. It described salary as important but not the main driver, and noted that candidates increasingly ask about growth paths. The two surveys measure different things, so they are best read side by side, not combined.
The practical lesson is that a career path will not fix poor pay, constant stress or weak management support. It does address the development gap, which sits near the top of both lists.
Decide Whether the CISSP Fits the Role
The CISSP is built for experienced practitioners, so it does not suit every engineer. Before you open the track, decide who it is for. Three questions help:
- Experience: does the engineer have, or will they soon have, years of hands-on security work across more than one area?
- Direction: do they want broad responsibility across risk, architecture and operations, or a deep specialty in one tool or technique?
- Timing: is there a realistic next role that the certification supports?
An engineer who wants to stay deeply technical in one area may be better served by a specialist certification. Make the track an option with clear entry criteria, not an expectation for the whole team.
Ask before you assume. A short conversation with each engineer about where they want to be in three years will tell you who sees the certification as a goal and who sees it as a chore. Record the answers, because they also show you which roles you will need to fill as people move up.
Map the Path From Associate to Certified Professional
Once you know who the track is for, turn the certification’s rules into stages. The CISSP certification requirements summarised by DestCert, a training provider that states it is not affiliated with ISC2, include five years of cumulative paid experience in two or more domains. A maximum of one year of that requirement can be substituted for relevant education or an approved ISC2 certification. Candidates who pass the exam without the full experience can become an Associate of ISC2 and have six years to complete it.
After the exam, endorsement has to be completed within nine months, and maintaining the certification takes 120 continuing professional education credits every three years. Rules like these change, so confirm the current details with ISC2 before you publish a path to your team.
Those requirements translate into five career stages. Each one has a point where the engineer is working toward something and a point where the employer has something to do:
- Build experience: the engineer works in a security role and gains breadth across domains.
- Pass the exam: the employer protects study time and supports the exam.
- Associate, if needed: the engineer keeps logging qualifying work, with a plan to finish the experience.
- Endorsement: the employer helps the engineer find an endorser and finish within the window.
- Maintain: the engineer earns credits, and the employer funds time and activities for them.
Publish these stages, name who owns the program, and say what each stage means for the engineer’s role.
Rotate Engineers Across the Eight Domains
The experience requirement spans two or more domains, which makes rotation a practical way to help. An engineer who spends all year on one tool may struggle to show breadth, even after years in the job. The eight domains are security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security.
You do not need formal secondments. Short, planned assignments work: shadowing an access review, joining a design review or sitting in on an incident. Each assignment should have a named host, a start and end date, and a short note afterwards on what the engineer did, because that note can support the experience record later. Record what each engineer has covered in a training matrix, so gaps are visible to both of you. Cross-training employees also reduces the risk of one person holding all the knowledge for a domain.
Back the Study With Time, Money and a Mentor
A certification path with no support is a to-do list. The IANS report, as covered by CSO Online, said mentorship, coaching and career development give staff a sense of purpose and progression, and that support for certifications helps teams stay motivated and keep developing. In practice, support comes in four forms: time, money, people and recognition.
- Time: protect weekly study hours during working time, and agree them in advance.
- Money: decide whether the employer covers or shares the exam fee, and what happens if the engineer needs a second attempt.
- People: pair each candidate with a colleague who holds the certification, or with an outside mentor. The difference between the two is covered in this guide to coaching vs mentoring.
- Recognition: mark each milestone publicly, and link it to a conversation about role and pay.
Agree in advance what happens if an engineer does not pass on the first attempt, so a setback does not feel like a failure. A clear plan for a second try keeps the goal alive and shows that the support is real.
Write the commitments down in each person’s employee development plan, so the support does not depend on a manager’s memory.
Make Sure the Certificate Is Not an Exit Ticket
A new credential makes an engineer easier to hire elsewhere. That is not a reason to avoid the program, but it is a reason to link it to real change at your company. When an engineer reaches a milestone, review their role, scope and pay. The IANS researchers said wage growth matters more than the absolute level of pay for reducing turnover, so a credential that brings no movement is a risk.
Some employers ask engineers to repay certification costs if they leave soon afterwards. Rules on this differ by country and state, so check any such agreement with employment counsel before you use it, and weigh whether it fits your culture.
Then listen. Regular stay interview questions tell you whether engineers on the track feel supported, and keeping an eye on your employee retention rate shows whether the program is working over time.
Warning Signs Your Certification Path Is Not Keeping Engineers, and What to Do About Each
Review this table every quarter. One sign means fix one thing. Three or more mean the program is a benefit on paper and needs redesigning.
Turn the Path Into a Reason to Stay
A CISSP track works when it is specific, supported and tied to real career movement. Decide who it is for, publish the stages, rotate engineers across domains, back the study and review roles at every milestone. Start by writing down the five stages and the owner, and let the rest follow from there.
