3 ms·

Yes, as you get deeper in the industry, you will be expected to have the basic validation certs, CISSP, CISA, CISA, CISM, etc.

tptacek 5y ago
No, you won't. Some people have them, the best people often don't. There are some jobs that will performatively demand them, and those are all terrible jobs that will sap status and retard your career.
dogma1138 5y ago
It really depends on how you enter and where you enter into the industry. Overall I find these certs to be a waste of time and money, and when hiring candidates I usually filter out those who have every ISC2 cert under the sun. In fact I tend to dismiss CVs for non entry jobs that have certificates listed at all. If you have 10+ years of experience I don’t care about your “education” if those 10 years can’t speak for themselves you’re probably not the candidate I’m looking for.
- delaynomore 5y ago
  >In fact I tend to dismiss CVs for non entry jobs that have certificates listed at all Listed? I guess every employer has their own little biases.
evgen 5y ago
If you see a job where there is some validation cert listed you should apply anyway. Either the company is dumb and insists on the cert, in which case you dodged a bullet when they passed you over for lack of a cert, or they know that the certs are bullshit and will ignore them but someone (usually a recruiter) insisted on putting them into the description.
jcims 5y ago
I don't find this true in the least. I've been at this for 25 years, ran a small consultancy for 15 of that, and certs have been wholly useless save for a very very small fraction of our business as a DoD subcontractor. In general I found that customers that demanded certifications were not expecting our consultants to do much thinking, they really just wanted box checkers. I didn't quite understand this until after a few years of hiring folks that were hell-bent on stacking certs...they tended to be box checkers. So, intentional or otherwise, it ultimately made sense. I find that the education associated with most (not all) certs to be sub-par and not particularly applicable, and it tends to stratify the thinking around how you educate yourself in a career that is at least as much based on vocational/practical knowledge as it is academic. Right now I'm working as part of an infosec org that is >>1000 full time employees and industry certs are a non-factor, the company generally doesn't invest in them unless they somehow directly align with your role and almost nobody that I work with advertises that they have any. So, in short, I'm closer to anti-certification than anything. That said, don't be religious about it. If that's what the offerings in your area or industry of interest require, do it.
- randombits0 5y ago
  So. GRC or security? It’s a rhetorical question. Is GRC security? Not exactly, but if you can’t demonstrate security, no one knows if you have security or not. GRC is the ability to quantify/qualify security. For true security, as in secure-by-design, etc, you need subject matter experts in that field. Since there is no security knowledge qualifying body for (most) platforms, the credentials don’t really matter much. But for GRC, they are essential. The question is also difficult to answer because there is no one thing that is security. You can manage vulnerabilities or provide incident response, both security topics but with wildly different skill requirements, for example. Security engineering, security management, security testing, security reporting, etc, etc. All very different things.
rsj_hn 5y ago
In my experience it is the opposite. These types of certs are often used in low skilled positions or entry level positions, as they generally don't carry a lot of weight in more senior roles.
iou 5y ago
Agree, you won't ever need them, and if you do those aren't the type of interesting jobs you'll want to gain access to. Infosec is very much "learn by do", because technology and this corner of it specifically moves too fast for certificate processes

tptacek 5y ago

No, you won't. Some people have them, the best people often don't. There are some jobs that will performatively demand them, and those are all terrible jobs that will sap status and retard your career.

dogma1138 5y ago

It really depends on how you enter and where you enter into the industry. Overall I find these certs to be a waste of time and money, and when hiring candidates I usually filter out those who have every ISC2 cert under the sun. In fact I tend to dismiss CVs for non entry jobs that have certificates listed at all. If you have 10+ years of experience I don’t care about your “education” if those 10 years can’t speak for themselves you’re probably not the candidate I’m looking for.

delaynomore 5y ago
>In fact I tend to dismiss CVs for non entry jobs that have certificates listed at all Listed? I guess every employer has their own little biases.

evgen 5y ago

If you see a job where there is some validation cert listed you should apply anyway. Either the company is dumb and insists on the cert, in which case you dodged a bullet when they passed you over for lack of a cert, or they know that the certs are bullshit and will ignore them but someone (usually a recruiter) insisted on putting them into the description.

jcims 5y ago

I don't find this true in the least. I've been at this for 25 years, ran a small consultancy for 15 of that, and certs have been wholly useless save for a very very small fraction of our business as a DoD subcontractor. In general I found that customers that demanded certifications were not expecting our consultants to do much thinking, they really just wanted box checkers. I didn't quite understand this until after a few years of hiring folks that were hell-bent on stacking certs...they tended to be box checkers. So, intentional or otherwise, it ultimately made sense. I find that the education associated with most (not all) certs to be sub-par and not particularly applicable, and it tends to stratify the thinking around how you educate yourself in a career that is at least as much based on vocational/practical knowledge as it is academic. Right now I'm working as part of an infosec org that is >>1000 full time employees and industry certs are a non-factor, the company generally doesn't invest in them unless they somehow directly align with your role and almost nobody that I work with advertises that they have any. So, in short, I'm closer to anti-certification than anything. That said, don't be religious about it. If that's what the offerings in your area or industry of interest require, do it.

randombits0 5y ago
So. GRC or security? It’s a rhetorical question. Is GRC security? Not exactly, but if you can’t demonstrate security, no one knows if you have security or not. GRC is the ability to quantify/qualify security. For true security, as in secure-by-design, etc, you need subject matter experts in that field. Since there is no security knowledge qualifying body for (most) platforms, the credentials don’t really matter much. But for GRC, they are essential. The question is also difficult to answer because there is no one thing that is security. You can manage vulnerabilities or provide incident response, both security topics but with wildly different skill requirements, for example. Security engineering, security management, security testing, security reporting, etc, etc. All very different things.

rsj_hn 5y ago

In my experience it is the opposite. These types of certs are often used in low skilled positions or entry level positions, as they generally don't carry a lot of weight in more senior roles.

iou 5y ago

Agree, you won't ever need them, and if you do those aren't the type of interesting jobs you'll want to gain access to. Infosec is very much "learn by do", because technology and this corner of it specifically moves too fast for certificate processes