Value of intermediate status to certification in cybersecurity profession - Associate ISC^2

Question

In the past year, I successfully passed the CISSP exam administered by ISC^2 . The CISSP certification is highly reputable and the most widely recognized certification amongst IT Security professionals. I still need about 1 year of additional work experience to obtain CISSP certification, but passing the exam does allow me to use status of Associate of ISC^2.

I am updating my resume to reflect recent accomplishments and new responsibilities assumed in my changed job role, from an IT auditor to security analyst. My questions:

How valuable are intermediary "accomplishments" such as described here for professional working in cybersecurity?

In general, is it worthwhile to include on resume as a distinguishing factor from other candidates?

Field of cybersecurity is highly dynamic and fast growing, and is one area where I feel certifications as evidence of competence really can make a difference. In networking with other InfoSec associates, this view seems to be shared.

I am open to all perspectives, but specifically want to hear from other people working in IT Security if possible, management and non - management level employees alike.

Answer 1

In the information security profession as a whole, the CISSP reputation is deteriorating fast. It has not been seen as any sort of gold standard for many years, and in fact has been derided by many top security professionals as simply a money earner for ISC2 now. I held my CISSP for 10 years but dropped it about 8 years ago as it no longer gave me any value.

I give a lot of lectures on security careers, and while I still include CISSP as one of the certifications along the way, it is only of reasonable value early on in your career, and then only if you are intending to be a technical security generalist.

As @StyxxUK pointed out, it does still open some HR doors if you have it on your CV, so always add your certs on your CV...but of much higher value (assessed by independent HR industry studies, and my own experience working with all the relevant organisations) are:

• vendor specifics (specialisations such as CCSP)
• ISACA's CSX Practitioner (begin with their Fundamentals and work up)
• OSCP or CREST once you have experience in penetration testing
• ISACA's CISM if you plan on heading into security management

If you are in the UK seriously look at the Chartered Institute of Information Security (CIISec) - the skills framework is being followed by more big organisations as it gives a great way to measure your skills against industry and company needs.

Here's a lecture I gave to Abertay university 6 years ago. It has moved on a bit, but still broadly useful chat about certifications and their value.

https://www.youtube.com/watch?v=57BzHxcn2V0

And of course, pop into the Security Stack Exchange chat at any time. I'm a moderator over there.

Answer 2

Include it, it shows you're well on the path to full certification and has it's own value as a certification. Once I see a relevant certification it tells me that the chap has what it takes to pass and the motivation to do so, and a general idea at least of the field. The level is important of course, but it's much better than nothing.

Clearly preferable to someone who hasn't got the basic certs all else being equal.

Answer 3

Include it without a doubt - just having the keyword "CISSP" in your CV will get it picked up by the automated systems many agencies use, and hence get your CV looked at by more people. (Do make sure however you clearly do not claim CISSP certification!)

It also shows you are serious about your career path and can absorb the information required and all you need is the hands on experience in the required Domains.

In the interim however whilst gaining hands on experience I would certainly look to some of the vendor specific or other specialised certifications to show you have technical abilities in those areas - CISSP is a mile wide and inch deep its a great cert to have but doesn't prove any level of hands on technical ability.