Is the CISA (auditor) worth it? What 368 job postings say
368 open job postings from 231 employers name CISA (auditor). 31% require it; the rest list it as a nice-to-have. It's asked for most in security jobs, where 5% of postings name it.
31% of the 368 postings that name it require it. It signals experience: 96% of the postings that state a level are senior or above.
- Employers name it
- 23110th of 40 we track
- Require it
- 31%of postings that name it
- Level
- Professionalour classification
- Exam fee
- $575–$760official price
Who should take it?
Built from what the 368 postings ask for, not from opinions.
Take it if you…
- aim at security jobsNamed in 5% of security postings
- target employers that screen for it31% of the postings that name it require it
- already have years in the field96% of these postings are senior or above
Skip it (for now) if you…
- want it to land your first jobOnly 3% of the postings that name it are junior or intern roles
- don't meet the requirements yetRequired: 5 years of IS audit, control, assurance or security experience within the last 10 years (up to 3 years can be waived); you can sit the exam first and apply within 5 years
- see CISSP in your target postings594 employers name it, against 231 for CISA (auditor)
Recognition: widely recognised, 10th of 40 by the number of employers that name it (231). We can't yet measure whether CISA (auditor) gets a particular person hired: that needs outcomes from people who earned it.
How much it counts in each kind of job
Share of each job family's postings that name CISA (auditor), and how many of those require it.
Job titles
CISA (auditor) shows up most in GRC Analyst, Security Engineer and Security Analyst postings. Ranked by the number of different employers, so one big hirer can't fill the list.
| Job (level and location removed) | Employers | Postings |
|---|---|---|
| GRC Analyst | 13 | 14 |
| Security Engineer | 12 | 18 |
| Security Analyst | 6 | 6 |
| GRC Manager | 5 | 5 |
| Technical Program Manager | 5 | 5 |
| Internal Auditor | 4 | 5 |
| GRC Engineer | 4 | 4 |
| Chief Information Security Officer | 4 | 4 |
Required or a plus?
How the 368 postings that name CISA (auditor) ask for it.
Who it's for: seniority
Level stated in the job title, 178 postings.
Who asks for it
Employers with the most postings
- Coupang · 10
- Accenture Federal Services · 8
- Anthropic · 8
- Capco · 8
- GuidePoint Security · 8
- xAI · 7
- CrossCountry Consulting · 6
- True Anomaly · 6
- Aprio · 5
- GovTech · 5
Where the jobs are
44% are fully remote (of 155 postings that say).
60% of the postings are in the United States: the job boards we read lean towards US tech companies, so other markets are under-represented.
What these jobs pay
Advertised US base pay in postings that name CISA (auditor) and publish a salary range (157 postings).
Often asked for together
Other certifications named in the same postings as CISA (auditor).
Share of the postings that name CISA (auditor). Postings often list several certifications as alternatives (“CISSP, CISM or equivalent”).
Compared with similar certifications
CISSP, CompTIA Security+ and CISM are named by more employers.
| Certification | Level | Exam fee | Employers | Required | Senior or above | Junior or intern |
|---|---|---|---|---|---|---|
| CISSP | Professional | $749 | 594 | 35% | 97% | 2% |
| CompTIA Security+ | – | – | 356 | 51% | 76% | 13% |
| CISM | Professional | $575–$760 | 353 | 31% | 96% | 2% |
| GIAC (any) | – | – | 302 | 34% | 90% | 5% |
| CompTIA A+ / Network+ / CySA+ / CASP+ | – | – | 296 | 41% | 68% | 18% |
| CISA (auditor) | Professional | $575–$760 | 231 | 31% | 96% | 3% |
| CCSP | Professional | $599 | 196 | 39% | 98% | 1% |
| OSCP / OffSec | Associate | $1,749 with course | 192 | 18% | 95% | 1% |
| Certified Ethical Hacker (CEH) | Associate | – | 118 | 28% | 91% | 5% |
Exam and requirements
From the official ISACA pages, checked 14 November 2026. Formats change: confirm before you book.
What the exam covers
Share of the exam, from the official exam outline.
What it costs
- Exam
- $575 for ISACA members, $760 for non-members
- Keeping it
- Continuing education hours and an annual fee of $45 for ISACA members, $85 for non-members
Official prices only. Courses, practice tests and retakes come on top; their prices vary too much between providers to average.
Sources: ISACA: maintain CISA, ISACA: CISA, ISACA: CISA exam content outline, ISACA: CISA requirements, ISACA exam candidate guide.
How we count
- Source. 199,799 unique open postings from company job boards on Greenhouse, Lever, Ashby, crawled November 2026.
- Named only. A posting counts when it names CISA (auditor), not the bare word “certified”. Certifications offered as a benefit (“we pay for your exam”) don't count.
- Required or a plus. Read from the section and the sentence the mention sits in.
- Checked by hand. In 150 random matches the extractor had never seen, 148 named the right certification and 147 had the right type.
- Minimum sample. Seniority, locations and pay are shown only with at least 30 postings behind them.
- Limits. A posting is what an employer asks for, not who they hire. The boards lean towards tech companies and the US.
FAQ
Is CISA (auditor) worth it in 2026?
It depends on the job you're aiming at. 231 employers name it in 368 open postings, most often in security (5% of that family's postings). 31% require it. For those jobs it can decide whether your application gets past the first screen.
Will CISA (auditor) help me get an entry-level job?
Rarely on its own. Only 3% of the postings that name it and state a level are junior or intern roles; 96% are senior, lead or staff. Employers treat it as a mark of experience, not a way in.
How much do jobs that ask for CISA (auditor) pay?
US postings that name it and publish a salary advertise a median base pay of $167K (middle half $138K–$214K, 157 postings). Compared with a job without a certification at the same company, same job family and level, they advertise 4% less. That's what the job pays, not what the certificate adds.
Which certifications are asked for together with CISA (auditor)?
Most often CISSP (named in 78% of the same postings), CISM (named in 57% of the same postings) and CCSP (named in 13% of the same postings).
What is on the CISA (auditor) exam?
The official outline weights information systems operations and business resilience (26%), protection of information assets (26%) and information systems auditing process (18%) most.
How much does CISA (auditor) cost?
$575 for ISACA members, $760 for non-members, according to the official page as of 14 November 2026. Prices change, so check before you pay.
Not sure a certification is your gap?
See all 40 certifications side by side, or check the skills employers in your target role ask for.