Summary
CEH and CISSP are respected certs, but they test the wrong things for DevSecOps and AI security hires. Neither exam asks a candidate to secure a CI/CD pipeline, scan a container, or stop a prompt injection. Requiring them filters out hands-on builders and rewards exam prep. Replace them with hands-on certs that match the work, such as CDP for pipelines and CAISP for AI systems. Then confirm the skill with a short practical task.
Most DevSecOps job posts open with the same two lines: “CEH and CISSP required.” The wording gets copied from one req to the next, long after anyone stopped asking whether it fits the job.
It usually doesn’t. Neither exam asks a candidate to secure a CI/CD pipeline, scan a container image, or stop a prompt injection. They test security knowledge through questions, not the hands-on work a DevSecOps or AI security engineer does every day.
The cost is quiet but real. A hard CEH or CISSP requirement screens out the platform and SRE engineers who learned security by building it, and screens in people who are good at exams. For AI security roles, where the attacks are new and few people have years of track record, the mismatch is even wider.
This isn’t an argument against certifications. It’s an argument for requiring the ones that match the work.
This guide covers what CEH and CISSP actually test, why they miss for pipeline and AI roles, which hands-on certs to ask for instead, and how to confirm skill with a short practical task. It also covers the cases where keeping CEH or CISSP is still the right call.
What CEH and CISSP Actually Test
Both certs measure security knowledge through exam questions. Neither one asks a candidate to secure a build pipeline or an AI system.
That matters because most DevSecOps job posts copy these two certs from older security roles. Before you keep them, look at what the exams really check.
CEH: a broad offensive security knowledge exam
The base Certified Ethical Hacker (CEH v13) credential comes from a 125-question multiple-choice exam in 4 hours. It covers reconnaissance, scanning, system hacking, malware, web attacks, and cryptography.
EC-Council also offers a separate CEH Practical exam with 20 hands-on challenges in 6 hours. Passing both earns CEH Master. Most job posts ask for plain “CEH,” which means the multiple-choice exam.
CISSP: a security management credential
The CISSP exam outline from ISC2 spans eight domains, from risk management to software development security. The English exam is adaptive, with 100 to 150 questions in up to 3 hours.
Full certification also requires five years of paid, full-time experience in two or more domains. Candidates who pass without that experience become an Associate of ISC2 instead.
| Points | CEH (base) | CISSP |
| Issuer | EC-Council | ISC2 |
| Exam format | 125 multiple-choice questions | 100 to 150 adaptive questions |
| Time | 4 hours | Up to 3 hours |
| Hands-on component | Optional, separate CEH Practical | None |
| Experience needed | 2 years or official training | 5 years paid work in 2+ domains |
| Built for | Offensive security fundamentals | Security managers and architects |
Both are solid credentials for the roles they were built for. CISSP fits a security manager who owns policy and risk. CEH fits an analyst moving into penetration testing. The problem starts when a hiring manager asks either one to stand in for pipeline or AI skills.
Why CEH and CISSP Miss the Mark for DevSecOps Roles
A DevSecOps engineer spends the day inside CI/CD pipelines, container registries, and infrastructure code. CEH and CISSP touch those topics at the concept level, if at all.
The daily work vs. the exam content
Here is what a typical DevSecOps engineer does in a week, compared with what each cert actually checks.
| Daily DevSecOps task | Tested hands-on by CEH (base)? | Tested hands-on by CISSP? |
| Add SAST and SCA scans to a GitHub Actions or GitLab pipeline | No | No |
| Tune scanner rules to cut false positives | No | No |
| Scan container images and block risky base images | No | No |
| Write policy as code for Kubernetes or Terraform | No | No |
| Manage secrets in CI without leaking them in logs | No | No |
| Generate and review an SBOM | No | No |
| Explain a finding to a developer and agree on a fix | No | No |
CISSP does include a software development security domain. It covers secure design and the SDLC from a policy angle. A candidate can answer those questions well without ever opening a pipeline config file.
Three ways the mismatch hurts your hiring
- It filters out builders. Platform and SRE engineers who learned security on the job rarely hold CEH or CISSP, so a hard requirement removes them before anyone reads their resume.
- It blocks mid-level hires. CISSP needs five years of paid security experience, so a DevOps engineer with three years of pipeline security work cannot hold the full credential yet.
- It sends the wrong signal. Candidates read the cert list to understand the job, and CEH plus CISSP suggests pentesting or governance work. Pipeline specialists may skip the post.
A quick example
Picture two candidates for a mid-level DevSecOps role. Candidate A holds CISSP and has spent six years writing security policy. Candidate B holds no cert but has run Trivy, Semgrep, and OPA in production for three years.
A “CISSP required” post hires Candidate A. Your pipelines need Candidate B.
Why They Fall Even Shorter for AI Security Roles
AI security roles expose the gap fastest. The attacks are new, the defenses are new, and the classic exam blueprints were built for networks, hosts, and web apps.
What an AI security engineer actually defends
An AI security engineer protects LLM features, model pipelines, and agents. The core threats look like this:
- Direct and indirect prompt injection through user input, documents, or tool output
- Sensitive data leaking through model responses
- Insecure output handling, where model text flows into code, SQL, or a browser
- Poisoned training data or a tampered model file in the supply chain
- Agents with too much permission calling tools they should not reach
These map to frameworks such as the OWASP Top 10 for LLM Applications and MITRE ATLAS. CEH v13 added AI-themed content, but the base exam stays multiple choice. CISSP covers governance broadly and does not test LLM attacks hands-on.
Where CAISP fits
The Certified AI Security Professional (CAISP) was built for this exact gap. Its 7 chapters cover the OWASP LLM Top 10, MITRE ATLAS, AI supply chain attacks, AI threat modeling with STRIDE, and governance under NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
The exam is task-based. Candidates solve 5 practical challenges in 6 hours, then have 24 hours to submit a report. Labs include prompt injection, scanning a malicious pickle file, and signing models with Cosign.
| AI security skill | CEH (base) | CISSP | CAISP |
| Prompt injection attack and defense | Concept level | Not covered hands-on | Hands-on labs |
| OWASP LLM Top 10 | Not a focus | Not a focus | Full chapter |
| MITRE ATLAS | Not a focus | Not a focus | Covered |
| AI supply chain and model signing | Not a focus | Not a focus | Hands-on labs |
| AI threat modeling | Not a focus | General threat modeling | STRIDE for LLM apps |
| AI governance (NIST AI RMF, ISO 42001, EU AI Act) | Not a focus | General governance | Covered |
| Exam style | Multiple choice | Adaptive questions | 5 practical challenges |
For agent-heavy teams, the follow-on Certified Agentic AI Security Expert (CAASE) covers memory poisoning, tool-calling abuse, and multi-agent identity. The Certified MCP Security Expert (CMCPSE) focuses on MCP servers and tool poisoning.
What to Ask for Instead: A Replacement Guide by Role
Swap each generic cert for one that tests the actual job, and pair it with a line that accepts equivalent experience. That keeps the bar high without shrinking the pool.
The replacement table
| Role | Drop | Prefer instead | Equivalent experience to accept |
| Junior DevSecOps engineer | CEH | Certified DevSecOps Professional (CDP) or Certified Security Champion (CSC) | 1+ year adding security scans to CI/CD |
| Mid-level DevSecOps engineer | CISSP | CDP or Certified DevSecOps Expert (CDE) | 2+ years running SAST, SCA, or IaC scanning in production |
| Container or Kubernetes security | CEH | CCSE or CCNSE | Hardened images and RBAC in a real cluster |
| AppSec engineer | CEH | CTMP or CASP | Threat models or API reviews you can walk through |
| Software supply chain security | CISSP | CSSE | SBOM, signing, or provenance work in a pipeline |
| AI security engineer | CEH and CISSP | CAISP | Hands-on LLM red teaming or securing an LLM feature |
| Agentic AI security | CEH and CISSP | CAISP plus CAASE or CMCPSE | Testing agents or MCP servers for tool abuse |
The Linux Foundation’s Certified Kubernetes Security Specialist (CKS) is performance-based and a strong fit for cluster security roles. For offensive AppSec work, a practical pentest exam such as OSCP or the CEH Practical tells you far more than a multiple-choice score.
What to desire beyond any cert
A cert is one signal. The strongest candidates also show these:
- A public repo, blog post, or talk that shows real pipeline or AI security work
- A specific story about a finding they fixed and how they convinced a developer
- Comfort reading YAML, Dockerfiles, and Terraform without help
- For AI roles, a working example of a prompt injection they found or blocked
- Clear judgment on when to block a build and when to log a ticket
The Practical DevSecOps learning path shows how these certs stack by level. It helps you set realistic expectations for junior, mid, and senior hires.
[IMAGE: role-to-certification map showing old requirements crossed out and hands-on replacements | alt: Diagram mapping DevSecOps and AI security roles from CEH and CISSP to hands-on replacement certifications]
Job Post Rewrites: Before and After
Seeing the change on a real requirement line makes it easier to apply. Here are three common posts and how to fix each one.
| Example 1: DevSecOps engineer Before: Required: CISSP or CEH. 5+ years of security experience. This line asks for a manager’s credential and an offensive security credential for a pipeline job. It also rules out strong DevOps engineers with three years of hands-on security work. After: Preferred: CDP, CKS, or similar hands-on certification. Equivalent experience counts: 2+ years adding SAST, SCA, and container scanning to CI/CD pipelines in production. You will own security gates in GitHub Actions and Kubernetes. |
| Example 2: AI security engineer Before: Required: CISSP. CEH a plus. Experience with AI/ML preferred. The only AI line is an afterthought. Nothing here tells candidates the job involves LLM attacks, and the required cert does not test them. After: Preferred: CAISP or similar hands-on AI security certification. Equivalent experience counts: you have tested an LLM application for prompt injection, data leakage, or insecure output handling. You will threat model new AI features and build guardrails before launch. |
| Example 3: Senior AppSec engineer on an AI product team Before: Must hold CISSP and CEH. After: Preferred: CAISP, CTMP, or OSCP. We value a portfolio of threat models, security reviews, or public research over any single credential. |
A copy-ready requirement block
Use this pattern for most DevSecOps and AI security posts:
- One line on what the person secures in the first 90 days
- Three or four core skills written as tasks, such as “tune SAST rules to cut noise”
- One “Preferred” line naming hands-on certs that match those tasks
- One “Equivalent experience” line with a clear, measurable bar
- A note that you fund certification after hire, if you do
Point 5 widens your pool fast. Teams that hire for potential can certify new staff through enterprise training during onboarding.
When Keeping CEH or CISSP Still Makes Sense
Dropping these certs is the right default, though not a universal rule. In some cases they remain the correct requirement.
Keep them when an outside party demands it
U.S. defense work follows DoD Manual 8140.03, which replaced the older 8570 framework in February 2023. Certification is one of several ways to qualify under 8140, yet many contracts still name specific credentials. If your contract lists CISSP or CEH for a work role, keep it.
The same applies when a customer audit or a regulator names a credential. Ask your contracts or compliance team before you edit the post.
Keep CISSP for leadership roles
CISSP is strong evidence for a security manager, director, or CISO. Those roles own risk, policy, and budget across many domains, which is exactly what the exam covers. A DevSecOps lead who manages a team and reports to the CISO may also benefit from it.
Keep CEH Practical for offensive roles
A red team or pentest role gains real signal from the CEH Practical, since it tests live exploitation. The base multiple-choice CEH adds less.
| Role | CEH | CISSP | Verdict |
| DevSecOps engineer | Drop | Drop | Replace with pipeline-focused, hands-on cert |
| AI security engineer | Drop | Drop | Replace with CAISP or similar |
| Penetration tester | Keep Practical, drop base | Drop | Hands-on offensive exam matters |
| Security manager or CISO | Drop | Keep | Matches risk and governance work |
| DoD contract role | Per contract | Per contract | Contract terms decide |
How to Screen Candidates Without the Old Certs
A short practical task replaces the filtering job CEH and CISSP used to do, and it does it better. Keep tasks under two hours, base them on your stack, and pay for anything longer.
Practical tasks by role
| Role | Task | Time | A strong answer |
| DevSecOps engineer | Add secrets scanning and SCA to a sample GitHub Actions workflow | 60 to 90 min | Fails the build only on high-severity issues and explains the threshold |
| Container security | Review a Dockerfile and a Kubernetes manifest | 45 min | Flags root user, unpinned tags, and missing resource limits |
| AppSec engineer | Threat model a three-service app from a diagram | 45 min | Names trust boundaries and ranks threats by impact |
| AI security engineer | Test a small RAG chatbot for prompt injection and data leakage | 60 min | Shows a working indirect injection through a document and proposes a fix |
| Agentic AI security | Review an agent config with shell and file tools | 60 min | Spots over-broad tool scope and adds human approval for destructive actions |
Interview questions that replace exam trivia
Skip “What port does SSH use?” Ask questions with no textbook answer:
- “Your SAST tool returns 300 findings on day one. What do you do first?”
- “A developer marks a finding as a false positive. How do you decide who is right?”
- “Our support bot reads customer emails and can issue refunds. How would you attack it?”
- “Walk me through a build you broke on purpose. Why that one?”
Strong answers name a tool, a number, or a trade-off. Weak answers recite framework names without a decision.
Verify any cert a candidate lists
If a candidate lists a hands-on cert, check it. Practical DevSecOps lets employers verify a certificate online, and holders can share digital badges. Then use the cert to skip basics in the interview and spend the time on judgment calls.
Final Thoughts
CEH and CISSP earned their reputation in network and governance security. For DevSecOps and AI security hiring, they test the wrong job. Ask for hands-on certs that match the daily work, accept equivalent experience in writing, and let a practical task make the final call. For AI security roles, CAISP gives you a structured signal in a field where few people have years of track record yet.
Next reads: the CAISP syllabus, the CAASE syllabus, and the certification process page.
Training a whole team? See Practical DevSecOps enterprise training.
Start your Free Trial Today.
Certified AI Security Professional (CAISP)7-day free trial
Open a live AI security lab in your browser today
Real targets, real terminals, no local setup.
No credit card required.
Frequently Asked Questions
No. CISSP builds broad security and risk knowledge, which helps anyone who moves into leadership. It just does not prove a person can secure a pipeline, so it should not gate a hands-on engineering hire.
Keep the credit. CEH Master includes the 6-hour CEH Practical, which tests live exploitation. That is useful evidence for AppSec and red team work, though less so for pipeline roles.
It changes who applies. You will see more platform and SRE engineers with real tooling experience. Your practical task then becomes the quality filter.
CAISP shows the candidate has attacked and defended LLM systems in a lab. Pair it with a practical task on your own product. Experience shipping AI features securely still counts for more at senior levels.
Offer an “or equivalent” clause with a measurable bar. Most HR teams accept it once the bar is clear and written into the post.
