3 ms·

That seems the opposite of true. They have pretty standardized certifications in the field. CISSP is much more consistent and predictable and known than random

That seems the opposite of true. They have pretty standardized certifications in the field. CISSP is much more consistent and predictable and known than random sampling of leetcode questions. Of course, you don't need to score 100% on the exam to pass it, and not being familiar with the content of the exam, I'm not vouching for it or anything. But it is effectively the equivalent of something like a CPA or CFA that Software Engineering has no analog of.

qzx_pierri 5y ago
As someone who recently left a security job at a very prestigious and well known organization.. The person you're replying to isn't wrong. Certifications only prove that you took the time to memorize a set of concepts. > CISSP is much more consistent and predictable and known than random sampling of leetcode questions Even the CISSP is just a test of memorization - The ISC2 cert prep book is 10 miles long, but only about 5 feet deep (if that makes any sense). Being a good security engineer comes with experience and knowledge of basic scams such as caller ID spoofing (something I did to my friends as a bored 6th grader). Being a good security engineer is having a keen eye for small changes and being skeptical about EVERYTHING. Any security engineer worth their salt would never discuss anything containing PII on an inbound phone call.
- antonvs 5y ago
  > Any security engineer worth their salt would never discuss anything containing PII on an inbound phone call. Yeah. Clearly "security" means something different to him than it does to us.
- nobody9999 5y ago
  >Even the CISSP is just a test of memorization - The ISC2 cert prep book is 10 miles long, but only about 5 feet deep (if that makes any sense). Except passing the (broad, but shallow) test isn't the real reason why CISSP is a decent certification. Passing the exam is just the first part. You then need to document at least five years of professional infosec experience[0] and have one or more current CISSP holders recommend you[1]. Experience and the approval of your peers are much better predictors of value/knowledge than a test. That's not to say that every CISSP cert holder is a rock star, but it's a lot more than just passing a test. [0] https://www.isc2.org/Certifications/CISSP/experience-requirements https://www.isc2.org/Certifications/CISSP/experience-require... [1] https://www.isc2.org/Endorsement https://www.isc2.org/Endorsement
wglb 5y ago
There is much doubt about the correlation of CISSP certificate holders and good security engineers.
giaour 5y ago
If you spend time working in a field that requires a CISSP (like most info sec roles in the US government), you will meet plenty of people who crammed for a test but are otherwise completely incompetent. I would not recommend viewing the CISSP as anything other than an attestation that someone can memorize a few concepts for a test.

qzx_pierri 5y ago

As someone who recently left a security job at a very prestigious and well known organization.. The person you're replying to isn't wrong. Certifications only prove that you took the time to memorize a set of concepts. > CISSP is much more consistent and predictable and known than random sampling of leetcode questions Even the CISSP is just a test of memorization - The ISC2 cert prep book is 10 miles long, but only about 5 feet deep (if that makes any sense). Being a good security engineer comes with experience and knowledge of basic scams such as caller ID spoofing (something I did to my friends as a bored 6th grader). Being a good security engineer is having a keen eye for small changes and being skeptical about EVERYTHING. Any security engineer worth their salt would never discuss anything containing PII on an inbound phone call.

antonvs 5y ago
> Any security engineer worth their salt would never discuss anything containing PII on an inbound phone call. Yeah. Clearly "security" means something different to him than it does to us.
nobody9999 5y ago
>Even the CISSP is just a test of memorization - The ISC2 cert prep book is 10 miles long, but only about 5 feet deep (if that makes any sense). Except passing the (broad, but shallow) test isn't the real reason why CISSP is a decent certification. Passing the exam is just the first part. You then need to document at least five years of professional infosec experience[0] and have one or more current CISSP holders recommend you[1]. Experience and the approval of your peers are much better predictors of value/knowledge than a test. That's not to say that every CISSP cert holder is a rock star, but it's a lot more than just passing a test. [0] https://www.isc2.org/Certifications/CISSP/experience-requirements https://www.isc2.org/Certifications/CISSP/experience-require... [1] https://www.isc2.org/Endorsement https://www.isc2.org/Endorsement

wglb 5y ago

There is much doubt about the correlation of CISSP certificate holders and good security engineers.

giaour 5y ago

If you spend time working in a field that requires a CISSP (like most info sec roles in the US government), you will meet plenty of people who crammed for a test but are otherwise completely incompetent. I would not recommend viewing the CISSP as anything other than an attestation that someone can memorize a few concepts for a test.