How's things?

Man I got all excited for you! Where did it fall short on getting you to pull the trigger?

 

A+, Security+, CySA+, Pentest+, CCNA, OSCP, Associate of ISC2 (Passed CISSP exam but lack the formal experience to fully be endorsed as a CISSP).

CISSP was by far the most challenging because after obtaining all the previous technical certs, the CISSP is a mindf*** because it is non technical, a mile wide and an inch deep with the perspective of management.

I finished OSCP in 8 hours, but spent another 7 hours on the documentation side of the exam (you have to document everything you do in the Pentests). The documentation part was challenging.

 

Correct. My job focuses on bringing the company into ISO27001 compliance for future certification and to maintain it once we do. The secondary aspect of my job is more of a sysadmin.

 

As far as time goes for obtaining the certifications, that's really dependent upon you. CISSP and CISM certifications also have experience verification requirements. I was fortunate that I was able to cross that experience threshold relatively sooner than I expected, because chunks of my background fell within the required domains.

The job market, if you have no experience is abysmal as industry has gone through many bloodbath level layoffs in the last couple of years. Much of it is due to the COVID-19 era over-hiring practices coming full circle and contracting. The pendulum has fully swung back into the employer's favor. Getting into the industry now is a different animal. Previously some basic experience and a couple certifications could help you walk into the door in many places. Now, most of the people you are competing against for low level jobs are people with somewhat levels of respectable experience, certifications AND degrees. Now, with AI being in the fold, its an even bigger challenge as large organizations move to use AI for heavily improving efficiency.

One aspect I really hate about the information security niche of IT, is that there are so many social media personalities on TouYube, FaceTokGramChat and others that peddle nonsense like "These two certifications will get you a $150k yesterday!" and talking about how there are shortages of infosec professionals. While there is a severe lack of infosec professionals in the industry, the shortage is for quality and experienced professionals; not the flood of newbies chasing fast cash.

I got lucky going into the industry when I did, luckier finding the employer that I did, and even luckier that I've been able to carve out a nice little gig for myself and was able to transform my role very drastically to more of what I wanted. While the bulk of my role is information security, it has also shifted to steering the organization's AI strategy and governance. This is perfect because I've held the belief for a while now that while many jobs are at risk of disappearing in organizations because of AI, those jobs that CONTROL the organization's AI are being permanently cemented. As soon as I finish my master's degree, I have a place waiting for me in the C-suite to boot.