Stop Collecting Certifications. Start Building a Cybersecurity Career

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:03

Welcome to Hacking Your Cyber Career. Episode 9. Stop collecting certifications. Start building a cybersecurity career. Which qualifications are worth your time, your money, and your effort? And which can wait? Here's Steve.

SPEAKER_01 0:24

Welcome to the Certification Industrial Complex. You want a cybersecurity career, so naturally, someone has suggested you need six certifications, three boot camps, an expensive lab subscription, and possibly a second mortgage. Before we start, let me be clear. I like certifications. I have several. My CISSP, which I earned nearly 20 years ago, has been one of the most valuable professional qualifications of my career. But here's the question. Are you choosing certifications to build a career or collecting letters because you're not sure what else to do? Cybersecurity isn't a single career path, as we discussed last episode. ASOC analyst, penetration tester, cloud engineer, GRC specialist, and aspiring CISO have different needs. The right qualification for one might be a complete distraction for another. I have interviewed candidates with impressive lists of certifications who couldn't clearly explain how they would apply what they had learned. I've also met excellent candidates with relatively few qualifications who were curious, capable, and eager to grow. Neither extreme tells the whole story. So today we're going to sort through what makes sense when you're starting, when you're specializing, and when you're aiming for leadership. We'll discuss the value of structured learning, the difference between vendor-neutral and vendor-specific qualifications, and why experience still matters. We'll also talk about costs, experience requirements, and how to avoid studying for a qualification you cannot yet fully claim. I want you to leave with a plan, not a shopping list. Because your career isn't a game of Scrabble. You don't win by collecting the most letters after your name. I'm Steve, and this is Hacking Your Cyber Career. Let's start with what a certification actually tells an employer. In the best case, it demonstrates that you've studied a recognized body of knowledge, met an assessment standard, and invested time in your development. That's useful. It gives a hiring manager something to compare, especially when applicants have very different backgrounds. But it doesn't automatically demonstrate how you behave when a production system fails at 2 in the morning, when a colleague challenges your recommendation, or when the business needs a practical decision rather than a textbook answer. In my hiring decisions, qualifications and everything else are roughly a 50-50 consideration, although it varies enormously with the position. A specialized engineering role may require particular technical knowledge. A more junior role may give greater weight to curiosity, learning potential, and communication. Don't interpret 50-50 as a mathematical hiring formula. It's simply my way of saying certifications matter, but they're not the whole person. There's another reason I value them. Learning. A well-designed curriculum gives you a framework for things you might otherwise discover only by accident. You study concepts outside your immediate job. You begin to see how risk, operations, technology, and governance connect. That broader understanding can make you more effective, even before you pass the exam. But here's a trap. Memorizing practice questions is not the same as understanding the material. If you can select the correct multiple choice answer but cannot explain the concept to a colleague, you've probably got more learning to do. So treat the exam as a milestone. The real goal is being able to apply what you've learned. A certificate might get your resume a second look. Your judgment, behavior, and ability to contribute are what makes someone want to work with you. Don't start by asking which advanced cybersecurity qualification has the most impressive name. Start by understanding the foundations. How do computers, operating systems, networks, and identities actually work? What happens when a user logs in? How does traffic move? What are common security controls trying to prevent? Compia's foundational qualifications can provide a structured route. A plus and network plus may be useful if you lack general IT knowledge, while Security Plus introduces important security concepts. ISC2's Certified in Cybersecurity, often called CC, is another entry-level option worth examining. These are examples, not instructions to take all of them. If you already have solid IT experience, you may not need to go back and certify every foundational topic. Choose the learning that closes your gaps. For somebody starting from scratch, I'd rather see a sensible foundation and a little hands-on practice than a collection of advanced exam badges without context. Build a home lab if you can do so safely. Learn to read basic logs. Explore access controls. Understand networking. And explain what you're learning in your own words. Certifications can help you get through the initial resume screening, but your ability to discuss the material matters when you get to an interview. Also, consider your budget. Training courses can be expensive. You may not need an expensive boot camp when a good study guide, official learning resources, and practical exercises will do the job. And check the current exam objectives, fees, and renewal rules directly with the certification provider before paying. Those details change. The starting point is not how many qualifications you can afford. Suppose you want to work in a security operations center. Your certification roadmap should reflect the work: analysing alerts, understanding networks, interpreting logs, investigating suspicious activity, and communicating findings. Security Plus can establish a broad baseline. Depending on your interests and the roles you're targeting, options to investigate include Comptia CYSA Plus and Cisco's Cybersecurity Operations Learning and Certification Pathway. More advanced incident response professionals may consider specialized GIAC qualifications, but those are usually a more substantial investment and should fit the work you intend to do. Here's my advice. Don't choose a certification because somebody online says it's essential for every SOC analyst. Read real job descriptions. Look at the tools and capabilities employers mention. Then ask whether the curriculum helps you develop those capabilities. And get some practice. Use authorized training environments and sample logs. Work through incidents. Practice writing a clear incident summary. What happened, what evidence supports your conclusion, what remains uncertain, and what should happen next. That's the difference between knowing the terminology and doing the job. Some employers care more about practical demonstrations than a long list of credentials. Others have formal requirements. Neither is inherently wrong. Your job is to understand the market you're entering. If you're already in an SOC, certifications can help you deepen your investigative skills or move toward incident response, detection engineering, or threat hunting. But don't forget communication. An analyst who can explain a complex investigation clearly is enormously useful. A certification may help you build knowledge, it won't write the incident report for you. This is where the certification landscape can get particularly noisy. There's a genuine difference between learning security concepts, learning offensive techniques in a controlled environment, and demonstrating that you can complete a practical assessment. Early on, options such as EJPT can help you explore whether hands-on penetration testing appeals to you. Comptia Pentest Plus covers relevant knowledge and methodology. As your technical skills develop, practical qualifications such as PNPT or OffSex OSCP may be worth considering, depending on your goals, preparation, and budget. These are not interchangeable, and you should compare the current exam format and requirements before committing. And please remember something we discussed in episode 8. Professional penetration testing is authorized work. Scope, permission, documentation, and reporting are essential. Being able to exploit a vulnerability in a training lab is useful. Being able to explain its business impact and recommend a sensible fix is what makes that skill valuable to an organization. Don't fall for the idea that the most expensive or difficult certificate is automatically the right next step. If you're still learning networking and Linux fundamentals, start there. If you've been practicing in labs and want a realistic skills assessment, choose one that tests the abilities you want to demonstrate. And if you discover you don't actually enjoy spending hours methodically investigating technical problems, that's valuable information too. Better to learn that before paying for several specialist courses. The aim is to become a capable professional, not merely someone with an impressive profile picture and the word hacker in their biography. If you work in Microsoft environments, look at the current Microsoft security and identity certification paths. If you're supporting AWS, investigate the appropriate AWS cloud and security qualifications. If you're working with Cisco technologies, Cisco's relevant networking and security credentials may make sense. The exact exam names and programs change, so always check the vendor's current catalogue. But the principle is simple. If you are expected to design, deploy, configure, or secure a platform, structured training in that platform can be valuable. That doesn't mean vendor neutral learning is irrelevant. Quite the opposite. You need to understand the principles behind the configuration. At least privilege, segmentation, logging, resilience, identity lifecycle, and data protection. Otherwise, you're just learning which button to click in the current interface. And interfaces have an unfortunate habit of changing just after you've memorized them. For security architecture, broader credentials such as CISSP can become useful as your responsibilities expand, while cloud security specialists may eventually consider CCSP when they meet the relevant requirements. But again, sequence matters. Start with the systems you're actually working on. Develop hands-on experience. Learn why the controls exist. Then expand your understanding across technologies and architecture. A certification roadmap that follows your responsibilities is usually more valuable than one based on whichever exam happens to be trending on LinkedIn this week. GRC is not the consolation prize for people who don't want to configure firewalls. It's a vital cybersecurity discipline. Professionals in this area need to understand risks, controls, audit evidence, regulatory obligations, policies, and how organizations make decisions. If you're entering from internal audit, finance, or corporate controls, you may already have valuable qualifications and experience. Don't automatically assume you must start again with a cybersecurity certificate. Ask what you actually need to learn. If you want to understand information security management systems, ISO 27001 training can be useful. Foundation, implementation, and auditing courses serve different purposes, so choose carefully. If your focus is risk management, ISACA's CRISC may be relevant as your experience grows. For broader security management, CISM is a credential I value. But remember, these qualifications have differing experience and eligibility requirements. Check them before committing. In GRC, a certificate might teach you a control framework, but the real work involves people. You may identify a risk and then need to persuade an operational team to address it. You need to understand competing priorities, explain the business consequences, and find a workable path forward. But no exam can completely simulate that. I've seen people transition successfully from audit and other business functions because they bring process knowledge, judgment, and an understanding of accountability. That experience matters. If GRC is your chosen path, build on what you already know. Add cybersecurity knowledge deliberately, and practice translating security findings into language a business leader can actually use. That's a skill worth developing, whether or not there's a certificate attached to it. From the hiring desk. Imagine two candidates. One has an impressive collection of certifications, perhaps more letters than fit comfortably on a business card. The other has fewer credentials, but can explain what they've learned, describe practical experience, and show real curiosity. Who do I hire? Well, it depends on the role, which is not the most exciting answer, but it's the right one. In my experience, certifications and other qualities carry roughly equal weight overall. Some positions need specific knowledge or recognized credentials, but I'm also looking at attitude, communication, willingness to learn, initiative, and how someone might work with the team. A certificate tells me you've completed a program. It doesn't tell me whether you'll take ownership of a problem or admit when you don't know something. I've occasionally seen candidates with an extraordinary number of qualifications. That's not automatically a negative, but it can raise a question. What is the strategy here? Have they been applying this knowledge, or simply moving from one exam to the next? I'd rather hear a thoughtful explanation of why someone chose a particular qualification and what they learned from it. Here's another point. Many employers will support relevant professional development. If you're employed, ask about training budgets, examination reimbursement, and study time. If the company won't fund a particular certification, it may be because that qualification isn't relevant to your role, or it may indicate a broader lack of investment in people. Those are very different situations and worth understanding before drawing conclusions. Don't let the absence of company funding automatically stop you learning, but don't spend blindly either. Your certification choices should tell a coherent story about where you're going. I earned it nearly 20 years ago, and its breadth across security domains helped me think beyond whichever technical problem was in front of me. It's also widely recognised. CISM has been valuable as my responsibilities have centred on security management, governance, and leadership. And more recently, I pursued Iseka's Advanced in AI Security Management Qualification, AAISM. Here's the important part. I didn't pursue AAISM simply because I wanted another set of letters. I wanted a structured way to learn more about managing and securing AI in organizations. It's a developing area, and we all need to keep learning. That's what good professional development should do. For somebody aiming at management, CISSP or CISM may be sensible goals once they have the required experience. These are not necessarily beginner credentials. There are experience requirements, endorsement or application processes, ongoing professional education and maintenance obligations to understand. Passing an exam does not always mean you immediately hold the full designation. Verify the current rules with ISC2 or ISICA. At more senior levels, credentials can also help executives and boards benchmark candidates. They don't prove you're a good leader, but they offer a recognized signal of professional knowledge and commitment. And if you want to become a CISO, remember that no single certification will teach you how to manage budgets, influence executives, lead teams, or make difficult trade-offs. Those abilities develop through experience. Think of qualifications as supporting your career, not replacing the career itself. I want you to build a certification roadmap, but just a small one. First, write down the career direction you're exploring. SOC, penetration testing, cloud security, engineering, GRC, or leadership. Second, identify your current stage. Are you completely new to IT? Do you have some technical experience? Are you already working in cybersecurity and looking to specialize? Or are you moving toward management? Third, look at five real job descriptions for the role you want. Note which skills and certifications appear repeatedly. Don't panic if every advert asks for five years' experience in a technology release last Tuesday. Job descriptions are wish lists, not sacred texts. Fourth, choose one meaningful learning goal for the next six months. That might involve a certification, but it might also involve hands-on practice, shadowing a colleague, or taking responsibility for a project. Fifth, work out the full cost. Training, exam fees, possible retakes, maintenance, and your time. Check whether your employer can help. And finally, ask yourself, if I pass this exam tomorrow, what would I be able to do better? If you cannot answer that question, reconsider the choice. I genuinely believe certifications are valuable. My own career has benefited enormously from them. But the best qualifications are those that help you develop the knowledge, confidence, and judgment to contribute. You don't need every certification on the market. You need the right learning at the right time for the direction you're heading. I'm Steve, and this has been Hacking Your Cyber Career. Keep learning, stay curious, and remember, your career isn't a game of Scrabble. You don't win by collecting the most letters after your name. See you next time.