A Rare Credential, Mostly Asked For by Defense Contractors
Certified Network Defender (CND), the EC-Council credential for network security operations, appears in 87 of the 14,366 postings we scanned (0.6%, about 1 in 165), and where a posting makes the wording clear, 19 of 28 mentions (68%) call it required rather than preferred. The other 59 mentions do not say either way, which is why that 68% describes a minority of the 87.
The bigger story is who is asking. We looked at every active Information Security Analyst, Network Engineer, Cybersecurity Engineer, and Systems Administrator posting on the InterviewStack.io job board over the last 90 days. One contractor, Leidos, accounts for 1 in 5 CND mentions (counted as postings, so a requisition reposted across shifts or locations counts more than once), and seven defense and government contractors together account for well over half. CND has long appeared on the U.S. Department of Defense's approved baseline certification lists for cyber defense work, which fits that employer mix. A CND line in a posting is usually a hiring-compliance filter from a defense contractor, not a signal that the open market is bidding for the exam.
Every comparison below uses other postings in the same four roles as the baseline, not the whole job market.
Key Findings
- 87 of 14,366 postings (0.6%) in four security, network, and systems roles mention Certified Network Defender.
- 19 of the 28 mentions that say required or preferred (68%) say required; 59 of the 87 mentions (68%) do not specify either way.
- Leidos alone accounts for 18 of 87 mentions (21%); seven defense and government contractors account for 50 of 87 (57%).
- Information Security Analyst postings mention CND at 1.1%, about 3 times the rate of Systems Administrator postings (0.4%).
- At mid-level, US postings mentioning CND advertise a $122,275 median base salary (n=49) against $114,400 (n=3,456) for mid-level postings without it, a 6.9% gap.
- Senior and staff CND salary samples are 5 and 7 postings, too few to report, so there is no honest senior-level comparison.
- 78% of CND-mentioning postings are mid-level versus 66% of other postings in the same roles; only 19.5% are senior or staff versus 30.1%.
- 74% of CND postings also name CompTIA CySA+ and 70% name CompTIA Security+.
Seven Contractors Account for 57% of Mentions
The employer list is short, and it reads like a defense contractor directory. That clustering is the single most useful thing to know before you spend money on this exam.
| Employer | Postings mentioning CND |
|---|---|
| Leidos | 18 |
| Northrop Grumman Corporation | 8 |
| CACI International | 6 |
| SOSi | 5 |
| Peraton | 5 |
| AnaVation | 4 |
| Booz Allen Hamilton | 4 |
| THOR Solutions | 3 |
The first seven rows sum to 50 of 87 mentions (57%). Counts are postings, and a requisition reposted across locations can count more than once, so treat them as approximate and read the pattern rather than any single ranking. The pattern is the point: these are firms that staff federal network defense contracts, where a named, DoD-recognized credential on the resume is often contractually expected. Job titles in the sample back this up: Cyber Defense Analyst shift roles, Cyber Security Watch Officer, and titles that name Top Secret or classified environments. The same sample also shows near-duplicates (three Cyber Defense Analyst shift variants, two identical Cyber Security Watch Officer titles), so Leidos's 18 is likely fewer distinct openings than it looks.
The practical read: if you are not targeting defense and government work, CND is a very small part of the market. If you are, it is a recurring filter at the biggest names. Browse Information Security Analyst openings to see which employers ask in your area.
19 of 28 Classified Mentions Say Required, and 59 Say Nothing
Among the 28 CND mentions where a posting makes the wording clear, 19 (68%) say required and 9 (32%) say preferred. That is a high required share, consistent with a compliance credential. The caveat is the denominator: 59 of the 87 mentions sit in a list of certifications without "required" or "preferred" nearby, so the real-world required share across all 87 could be lower. We cite the split off the 28 classified mentions only, and where wording is ambiguous we count the mention as preferred.
For a job seeker, the rule is simple: when CND appears, read the sentence around it. "Must hold one of the following approved certifications" is a different statement from a nice-to-have list.
Pay Comparisons Only Work Inside One Level: Mid
Salary figures below are US advertised base salary on postings that disclose it; equity, bonuses, and clearance-related allowances are not included, so total compensation is higher. Postings that disclose pay are not a random sample of all postings.
Only one seniority band has enough CND-mentioning salary data to report. At mid-level, postings that ask for CND advertise a median of $122,275 (49 postings) against $114,400 (3,456 postings) for mid-level postings in the same four roles that do not mention it, a gap of $7,875 or 6.9%. Treat that gap as fragile: the same $122,275 is the CND-side median for all levels combined (n=63), for mid-level (n=49), and for Information Security Analyst postings alone (n=38), which usually means many of these postings advertise an identical salary, such as a reposted requisition, so the effective sample is smaller than n=49 suggests.
| Level | Mentions CND (median, n) | No mention (median, n) |
|---|---|---|
| Entry | Not reportable (n=2) | $80,450 (n=132) |
| Mid-level | $122,275 (n=49) | $114,400 (n=3,456) |
| Senior | Not reportable (n=5) | $155,000 (n=1,156) |
| Staff | Not reportable (n=7) | $171,000 (n=577) |
The chart has one bar pair because mid-level is the only band where both sides clear our minimum sample of 25; a gap of 6.9% there is a statement about which mid-level jobs ask for CND, not a price tag on the exam.
You may also see a different number if you compare everything at once: the 63 US CND-mentioning postings with salary show a median of $122,275 against $129,575 for 5,321 others, which is 5.6% lower. That aggregate points the opposite way from the mid-level result, and it should not be read as "CND lowers pay." It is a composition effect. CND postings are concentrated at mid-level (78% versus 66%) and thin at senior (9% versus 21%), where the non-CND median is $155,000. Only 19.5% of CND postings are senior or staff, against 30.1% of other postings in these roles. One limit: seniority is inferred from title keywords, and postings with no level word (many here are bare titles such as "Network Administrator" or "Cybersecurity Analyst") default to mid-level, so the true mid-level share is probably overstated on both sides and the exact gap between 78% and 66% should be read loosely. Pool everything and the comparison group is pulled up by a senior tail that CND postings mostly lack.
Does CND Demand Look the Same Across All Four Roles?
No. Demand is lopsided toward one role. Information Security Analyst postings mention CND at 1.1% (45 of 4,208), about 3 times the rate of Systems Administrator postings (0.4%, 10 of 2,855). Network Engineer sits at 0.5% (13 mentions) and Cybersecurity Engineer at 0.4% (19 mentions). Analysts account for 52% of all CND mentions while making up 29% of the postings scanned.
We report the ranking as the data gives it and stop there. The sample for each non-analyst role is 10 to 19 mentions, small enough that the ordering among those three could shift.
CND Rarely Travels Alone: CySA+ and Security+ Show Up Beside It
CND postings are stacked-credential postings. 64 of 87 (74%) also name CompTIA CySA+ and 61 (70%) name CompTIA Security+. Roughly half also name GIAC GICSP (53%) or SSCP (49%), and GIAC GSEC (41%), CCNA (40%), and CISSP (36%) are common too. These postings often list several approved options, so an applicant frequently needs one credential from the set, not CND specifically. If a CND posting also lists Security+, the cheaper and far more widely recognized exam may already satisfy it.
The skills named in the same postings point to security operations work: Monitoring (52%), Splunk (28%), Risk Management (26%), Incident Response (22%), Linux (22%), and SIEM (20%). Note this is a share of CND-mentioning postings, not a measure of what employers pay extra for. The cert's role is as a gate. The skills are what you are actually hired to do.
How to Use This in Your Job Search
Treat CND as a targeted credential. If you want defense or government security work, check the Information Security Analyst board and the postings from the contractors above, then read whether each lists CND as required or one option among several approved certifications.
Skills are what get you through the interview, whatever the posting lists. Use AI mock interviews to rehearse incident-response and monitoring scenarios out loud, drill SIEM, networking, and detection questions in the Question Bank, and build foundations with our interactive courses. If you want to see how clearance-heavy roles compare for network specialists, browse Network Engineer and Cybersecurity Engineer postings too.
FAQ
Q. How many job postings ask for the Certified Network Defender (CND)?
87 of 14,366 active postings (0.6%) for Information Security Analyst, Network Engineer, Cybersecurity Engineer, and Systems Administrator mention CND, over the last 90 days. That is roughly 1 in 165 postings in those four roles.
Q. Is CND usually required or just preferred?
Where a posting makes it clear, 19 of 28 CND mentions (68%) say required and 9 (32%) say preferred. The other 59 mentions do not say either way, so the split covers only the 28 classified mentions.
Q. Which employers ask for CND most often?
Defense and government contractors dominate. Leidos accounts for 18 of the 87 postings (21%), followed by Northrop Grumman (8), CACI (6), SOSi (5), and Peraton (5). The top seven contractors together cover 50 of 87 mentions (57%). These are posting counts, so reposted requisitions count more than once and distinct openings are likely fewer.
Q. Do postings that ask for CND advertise higher pay?
Only at mid-level can the comparison be made reliably. US mid-level postings that mention CND advertise a median base salary of $122,275 (n=49) versus $114,400 (n=3,456) for mid-level postings in the same four roles that do not, a 6.9% gap. Senior, staff, and entry-level samples are too small to report. This is what postings advertise, not what the certification is worth.
Q. Which certifications appear alongside CND in job postings?
CompTIA CySA+ appears in 74% of CND-mentioning postings (64 of 87) and CompTIA Security+ in 70% (61 of 87). GIAC GICSP (53%), SSCP (49%), GIAC GSEC (41%), CCNA (40%), and CISSP (36%) also show up frequently.
Q. Which roles mention CND most?
Information Security Analyst postings mention CND most, at 1.1% of that role's postings (45 mentions, 52% of all CND mentions). Network Engineer (0.5%), Cybersecurity Engineer (0.4%), and Systems Administrator (0.4%) trail well behind.
Read the Employer Before You Read the Cert
A CND line in a posting tells you more about who is hiring than about what the market values. It is rare, it is mostly a defense contractor requirement, and it usually sits next to Security+ or CySA+ as an approved alternative. Start from the employer you want, read how the posting words the requirement, and pick the credential that covers the most of your target postings.
Topics
Ready to practice?
Put what you've learned into practice with AI mock interviews and structured preparation guides.