CKS - Certified Kubernetes Security Specialist

This is the security tier of the Kubernetes family. You can't sit it without a current CKA, and that gate keeps holders scarce even as demand for container security keeps rising.

Platform security engineers who harden clusters: admission control, runtime security with Falco, supply-chain scanning, network policy. They mostly sit in enterprises running regulated workloads on Kubernetes.

It brings together the two strongest demand signals on the index: Kubernetes is everywhere, and security talent is short. The CKA prerequisite keeps holder numbers in check on top of that. On a risk-adjusted basis it's the pick of the cloud-native family.

The caveat is consolidation. If the managed security layers from cloud providers start doing the cluster hardening for you, the specialist niche shrinks. It's a slow drift, but managed services have a habit of moving that way.