How to tell junior team member that particular certification may be not right for them at this time without being demoralizing?

Question

I have been working in the cybersecurity profession for about close to 6 years now, and just last year got CISSP certification, along with the AWS Security certification recently.

As the team lead, I was meeting with a team member today to discuss their goals for this year. The team member wanted to complete the CISSP exam as a goal this year. However, he has been working in Cybersecurity for only slightly more than 1 year, and I feel this goal is overly ambitious for him at this time. Per the ISC^2 who sponsor the CISSP exam, and also my friends who work in cybersecurity, experience is critical to doing well as lots of material on the exam does not lend well to memory / just reading a book, given its very broad curriculum scope and significant focus on security governance / management. Its often not recommended to attempt the CISSP until the ~ 5 years experience range.

The other reason I am reluctant to encourage him to pursue the certification at this time is that he has expressed doubt about whether he wants to remain in the cybersecurity profession. I don't want to him to waste time in pursuing a goal that may not be helpful to growing his career. As I began my career as a security auditor, I was convinced that I absolutely wanted to become a cybersecurity professional, as I am passionate about IT Security. So in my case, this certification was well worth it, and has benefitted my career growth significantly.

If I directly tell him that pursuing CISSP certification may not be the most appropriate goal at this time, and he may want to consider waiting a few more years, I am afraid of demoralizing him and he may think I don't support him. He is an excellent team member who supports others well so I don't want to lose him or have his productivity decrease. Ordinarily, I am a pretty forward person in my communication but I am afraid it may be too painful for him.

Edit to incorporate comments: He wanted to pursue this goal because CISSP is one of the mist recognized certs in the cybersecurity profession and our profession is one in which certifications play a larger role as attestation of one's knowledge. Maybe less true for CISSP but absolutely true for hands on exam like OSCP. I can say from experience my team member is right.

How can I communicate to him that his goal may not be the most beneficial for him in a clear manner and minimize any negative fallout on this team member?

Answer 1

Experience is not only critical to doing well, but as you know having passed it, is a mandatory pre-requisite to writing the CISSP exam:

Candidates must have a minimum of five years cumulative paid work experience in two or more of the eight domains of the CISSP CBK. Earning a four-year college degree or regional equivalent or an additional credential from the (ISC)² approved list will satisfy one year of the required experience. Education credit will only satisfy one year of experience.

From your description, your junior simply doesn't meet this requirement and is thus not eligible to write the exam.

The experience requirement is validated within one year after passing the exam by being vouched by an existing CISSP.

You could approach it thusly:

• Explain to the employee that they do not meet the experience requirements, and that even passing the exam would not award them the CISSP. They can look at the Associate track (below).

• The goal of the CISSP is less to train, and more to validate knowledge gained over many years of experience, filling in any gaps. Your junior isn't there yet and that is not a reflection of their ability, but a reflection of the amount of time they have been working.

• Suggest training in the place of CISSP. Perhaps a series of Udemy courses, or a more start-of-career certification like a Security+. There is also Associate of (ISC)² as an entry-level path.

• Be kind but frank with them about the issue of them being uncertain of their career path.

Answer 2

How can I communicate to him that his goal may not be the most beneficial for him in a clear manner and minimize any negative fallout on this team member?

First, make sure that you're being objective and that this isn't just your personal opinion.

If you are being objective then give him objective reasons why you think this isn't the best course of action for him at this time.

Then let him know that you support and encourage his commitment to furthering his education and skills, whether or not he chooses to go forward with this particular certification.

Next, give him what you see as viable alternatives should he choose to heed your advice. If the CISSP isn't the best road for him at this time, then what is? Don't just tell him you don't think the CISSP isn't the right thing right now, give him guidance on what he can do that will help him at this point in his career.

Answer 3

How can I communicate to him that his goal may not be the most beneficial for him in a clear manner and minimize any negative fallout on this team member?

This goal setting process is supposed to be a two way street.

If you their supervisor, and as somebody who recently completed that particular certification, think that their goal for the year is too much of a stretch then you need to provide guidance regarding setting a proper goal.

You don't want to outright reject what they have proposed. There is a common piece of advice that an employee can't just point out a problem to their manager, they need to propose a solution so that the manager can act. In this situation the roles have to be reversed. If CISSP can't be done in the time limit then layout a pathway of what can be done now, and then what can be done next year.

You can propose a milestone they can complete before the end of the year. You might suggest that they take one of the official training opportunities and that it can be paid for from either your training budget, or as a part of the employee improvement budget your company might have. That means that this goal becomes a shared goal.

You could suggest that they complete one or more certifications that can be useful as a pathway to CISSP. Then tell them that next year you will revisit the longer term goal of CISSP. Also see if the company will pay for completed certifications.

Answer 4

You should show him a career path. With only one year's experience, a CISSP (or an Associate CISSP, which is all he can gain), is a waste of time for him. It's a managerial qualification rather than a technical one.

I'd start him with Security+, then switch over to (ISC)2 courses such as OSCP. These will give him the technical grounding for his profession, and then he can look at the CISSP in four years (passing other exams gives him a year off the 5 year qualification period) once he's ready to start taking more managerial responsibility.

Answer 5

I'm answering this Q based on the specifics of the CISSP requirements, which I wasn't aware of beforehand (I do work in IT, I even work with CISSP-people, but am detached from the info-sec sphere day-to-day), although I have knowledge and experience with IT certifications in general. The previous answers clued me in to the specifics of the CISSP.

The CISSP certification, as per your link, is ostensibly for 'senior-level' cybersecurity professionals. Example job titles given in your link are "Chief Information Security Officer", "IT Director/Manager", "Security Architect", "Network Architect", etc. It does have a minimum requirement of 5 years' experience over various security-related domains such as IAM and asset security.

When you took this exam and qualified as a CISSP last year, you were presumably subject to proving the "5 years' experience" requirement, so I expect you are still aware of this.

You used a number of "hedging" statements and I'm unclear (but you need to be clear with yourself) whether it is because you are being "circumspect", or haven't fully understood the hard line requirements. e.g. "experience is critical to doing well": yes, as it is in many certifications, but in this case it is actually a hard-line requirement.

As such I don't think your context is really "It's often not recommended to attempt the CISSP until the ~ 5 years experience range." as much as it is that being a hard requirement (and ipso facto that's why it's 'not recommended', I suppose!)

So how to move forward with your team member? I would suggest you:

• follow up the discussion (if you didn't already) about the motivation for wanting to get a certification. For example is it that the company seems to reward 'externally validated' achievements like a certificate, but doesn't value 'internal-only' accomplishments?
• go back about the concrete/"hard" requirements for the CISSP and explain that your team member doesn't have the experience to enter for that exam right now, as you went off and researched (on Workplace.SE admittedly...) it.
• look upward in the company about what is communicated as valid "goals" or "things to strive for" for example.
• research alternative certifications (I didn't look too much into this as it isn't my area, so it may be that there is something "prior to" the CISSP that your team member could work towards) if that is the route to recognition
• think about your own goals for your report for the next year, and tactfully bring them up as 'suggestions' next time you meet about this.