Skip to content
CertGPS

Do Security Internships Require Certifications?

Industry trend

What federal security internships actually ask for, why nobody can count certification demands in private intern postings, and when a $199 exam helps.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

Do Security Internships Require Certifications?

The security internships that publish their rules ask for enrollment, grades, citizenship and clearance eligibility, and none of the federal programs we read lists a certification. Private employers set their own terms, and nobody publishes a count of how many intern postings name one. An entry certification can still help a student, mostly on defense work, though for most it matters less than coursework and projects they can show.

What the federal programs ask for

CISA's Pathways internship spells out its requirements. You need US citizenship, a minimum age of 16, transcripts and a GPA of at least 2.5 that you keep through the internship. You must be enrolled when you apply and when you start, and stay at least a part-time student. To be eligible for a job after graduation you have to work 640 hours before you graduate, and you must be able to obtain and keep up to a Secret clearance. No certification appears on the list. CISA's separate page for cyber and IT interns sets the pay grade by years of study, from GS-1 for high school students aged 16 or older to GS-5 through GS-7 for graduate students, and it too asks for a relevant degree program and never mentions a certification.

The National Science Foundation's scholarship program turns the internship itself into the requirement. Now called the CyberAICorps Scholarship for Service, its current solicitation (NSF 26-503, posted February 4, 2026) says recipients "must participate in qualified summer internships related to AI or cybersecurity." It pays stipends of $27,000 a year for undergraduates and $37,000 for graduate students, and recipients owe government service for at least as long as the scholarship ran. The award also carries a $6,000 yearly professional development allowance whose listed uses include certifications.

What nobody measures

There is no dataset on private-sector internships. CyberSeek, the job-posting tool run by NIST's NICE program with Lightcast and CompTIA, counted 514,359 cybersecurity-related listings from May 2024 through April 2025. Its June 2025 release breaks those listings down by NICE Workforce Framework category and by state, and says nothing about internships. The Bureau of Labor Statistics writes in its Occupational Outlook Handbook that "many employers prefer to hire candidates who have information security certification," but that sentence describes analyst jobs, not student roles.

When a careers site tells you that most security internships want Security+, ask where the count came from. Without a named source, the figure comes from a keyword search the author chose: which job board, which month, and whether "preferred" was counted as "required" all change the answer.

Defense work is the exception worth checking. ISC2 states that its Certified in Cybersecurity (CC) credential is approved under the Defense Department's DoDM 8140.03 manual, and CompTIA maps Security+ to DoD 8140 work roles such as cyber defense analyst. An internship on a defense contract can therefore come with a qualification rule tied to the work role, so ask the recruiter which role the position is coded to.

Where internships show up in the workforce data

The 2025 ISC2 Cybersecurity Workforce Study, an online survey of 16,029 people responsible for security, run in May and June 2025, found that only 3% of respondents entered the field through an internship or apprenticeship. The share is higher among the young: the report puts it at 8% for respondents aged 21 to 29. Those who came in that way were the most likely to recommend their route to others, at 69%, against 57% of all respondents.

Conversion is the other number students ask about. The National Association of Colleges and Employers (NACE) surveyed 284 employers between October 2025 and January 2026 for its 2026 Internship & Co-op Report and put the conversion rate for 2024-25 interns at 63.1%, the highest in five years. That figure covers every major, not security alone; no one publishes a security-specific equivalent.

One more reason to keep records: ISC2 counts internships toward the five years of experience that CISSP requires. Its experience page says paid or unpaid internships are acceptable with documentation on the organization's letterhead, or on the registrar's stationery if you interned at a school. Ask for that letter before you leave, while your supervisor still remembers what you did.

When a certification is worth buying as a student

ISC2 changed its pricing this year. It closed its free CC program to new enrollments on May 20, 2026, so the exam now costs $199, though unexpired codes from the program still work until December 31, 2026. ISC2 lets you sit an exam from age 16, with a parent or guardian at the test center. Security+ costs $439 for a voucher and has no prerequisites; since June 23, 2026, CompTIA has required parental consent through its CompTIA Central account system before anyone 17 or under can register.

Our view: if the internship you want is on a defense contract, or you have no IT work, lab or project to show yet, one entry exam is a fair way to prove you've covered the basics, and CC does that for the least money. If you already have a home lab, capture-the-flag results or a course project you can talk through, put the $199 toward hardware or keep it. Skip expensive exams aimed at practitioners. CISSP wants five years of experience before you can hold it, though the internship hours you document now will count toward them.

For the order to take certifications in during a degree, see the college student roadmap and our guide to choosing a first certification.

Sources (13)