4 ms·
People saying certs aren't worth it are only looking at half the picture. EVERYONE knows most certs suck, and the few that are good are drowned out by the volum
by Beached 6y ago
People saying certs aren't worth it are only looking at half the picture. EVERYONE knows most certs suck, and the few that are good are drowned out by the volume of half ass shitty certs that are just money grabs.
But certs are an unfortunate necessity in a world where fresh college graduates without a days worth of experience in IT or Security are pre-filtering resumes. Certs ARE worth it, to get past HR. I always tell everyone who wants to get into security that the first infosec job is the hardest to get, and for that, you need to play the HR game, and that means a couple certs. You need to sit down in front of the hiring manager for an interview to get the job, your hiring manager will know your cert means nothing, almost guaranteed he never even asks you about any of them.
Your resume means everything to get in front of the manager, then your resume means jack shit to the manager. It is stupid, but is the world we live in.
You can get hired into infosec without the certs though, and that's know the hiring manager or know someone on the team you are applying for. Hiring managers can tell HR "I want to interview Joe Somebody, he said he will apply this week", and in security, id say more than 50% of the hires are indeed that. So to do this, go to the local professional meetups that meet monthly, go out for beers with the people, go to the local conferences and make friends with many people already in the industry, maybe do a talk at the meetups or local conference. Then when a position opens up at a place where there is someone you know, you now can get an interview.
But you really should be doing both at once. Most competent developers or IT people can pass Sec+ blindfolded, you most certainly do not have to take the class, at MOST skim the study guide book once, and your almost guaranteed to pass. It is a joke, everyone in the industry knows it, yet if you could dramatically increase your chances of getting an interview while you are taking the time to develop those relationships, what idiot wouldn't?
- radditone 6y agoI've heard this a lot before and I'm sure its true in a lot of cases. But I've been in security over a decade, and have hired at smaller boutique pentest companies, and multi billion dollar companies. In all cases, the CVs/resumes come straight to us, they never go via HR.
- g_p 6y agoI can sympathize with the comment, and know for a fact it's true in a lot of fields, including ones it shouldn't be done in due to similar skills niches. Despite this, as you say, I've usually seen CVs/resumes come straight to the hiring team - the first thing an effective security lead does ensure there's no pre-screening on CVs, as they want to see the "unconventional" CVs as much as the conventional ones. There's also companies that actively have their techies go out and fly the flag, post on the /r/netsec or HN hiring thread, and give a point of contact straight to a personal or team mailbox.