I am, and I disagree with a lot of what the OP put forward. Security academics, self-taught pentesters, and people who simply gained hard security experience i

I am, and I disagree with a lot of what the OP put forward. Security academics, self-taught pentesters, and people who simply gained hard security experience in their day to day jobs each bring something unique to the table. I'm far more likely to pick up the principal engineer with a security MS for a security architect role than I am someone who can prove to me they passed an OSCE. That said, for the person who can prove to me they passed an OSCE, I'll knock two years off the pentest experience requirement for any such role.