Security career cert questions

I do not work in security, but after interviewing for an entry level security position a while back, I had some minor epiphanies. One, information security is not ideal for new entrants to the IT field (I don't know your level of experience, but seeings how you're on the 2nd half of the A+, I'd wager you're on the newer end of the spectrum).

You can speak the language, understand the concepts, but in the absence of professional IT experience, you're probably not an ideal candidate. The fellow who bested me was a systems engineer with a CCNP. If memory serves, he had been doing systems engineer things for a number of years. I, on the other hand, had been doing Tier 1 help desk things for less than a year. The organization probably didn't want a SOC analyst who had never configured a firewall, configured a router, or managed logs in an enterprise environment. (Plus I'm old. Avoid being old during the job hunt.)

Outside of the USG ecosystem, I believe it is difficult to cert your way into information security. Even in the USG/Contractor space it isn't always a sure thing. As a contractor I hold the A+ through the CASP+ and I am still, basically a switchboard operator in my position.

I don't want to defecate on the CompTIA certs, but I will offer the critique that they do not aid you in cultivating hard skills. They are kinda like vocabulary exams for different IT topics. After finishing a CCENT study guide, I've realized the Network+ really didn't teach me that much about networking.

I'd say the CCENT/CCNA would probably be a good start. Even if it doesn't get you into infosec, it'll give you the hard skills upon which to build the IT career that could eventually get you into infosec.

If you can find an ISC(2) sponsor, maybe consider the SSCP as an alternative to the Security+? The cert appears to be better respected or better known. Of course, in the absence of relevant work experience or education, the Security+ may be your only option. I recommend capping your CompTIA venture there though. Pentest+ and CASP+ were a serious waste of time and money for me.

Best of luck to you with your testing appointment.

/r/ITCareerQuestions Thread