> There's also a huge industry around certification and compliance that adds almost no value. I've never known any experienced security professional who places

> There's also a huge industry around certification and compliance that adds almost no value. I've never known any experienced security professional who places any value in CISSP, CEH, etc. (In fact they're often a negative indicator of competence). They're the security equivalent of a 6-week coding bootcamp. Mostly just a cash grab. Preach. The number of times I have had to explain basic computer to a cissp is larger than I’d like to admit.