HN Explorer

Ask HN: What's the deal with self appointed regulating bodies in security?

1 points by drdunce ↗ HN
The whole computer security field now seems completely gated. The plethora of industry certifications from self-appointed regulating bodies is so incredibly extensive. A new one seems to pop up every week. I'm seeing job postings requiring 6+ certifications costing 1000's each.

General computing jobs are subject to a very high amount of competition, 100's of applicants to one position. Naturally, succeeding in these certifications offers no guarantee of employment, but in fact having them has become the bare minimum and it seems highly unlikely that one would be employed regardless. How does one justify gambling 1000's? Is there a better way?

Is this beneficial to anyone? Is this the future of computing jobs? Will we end up seeing this in other fields?

4 comments

[ 3.4 ms ] story [ 24.1 ms ] thread
ttyprintk
I’ve been thinking of creating and advertising my own certification paths. Maybe a certification for weeding through certifications. When there’s a gold rush, sell pickaxes.
incomingpain
This all started long ago. There's some statistic that the vast majority of security professionals don't have any credentials. Not even a university degree. That the sole and only way to reliably hire security professionals is to not look at credentials at all.

>I'm seeing job postings requiring 6+ certifications costing 1000's each.

They don't realize that skilled security professionals aren't bothering with any certs. Why would we? Work experience >>> certification, always has been for all IT fields. Certifications are about entry level positions. It's not like security pros are sitting at home unemployed thinking 'if only I had some certification then I'd be employed.' No, there's a ridiculous security pro shortage.

So why do employers list all-of-the-certs? They need people so desperately that they'll take anything.

It's about to get worse as well. The governments who realize a cyberwar is ongoing are all spending big into cybersecurity and building cyber armies. Meanwhile insurance seeing this reality is making the exception of 'nation state attacks'.

Want my advice? Get the certs you think that will develop your personal skills the best. Apply to the jobs ignoring any cert requirements. You'll probably end up getting the job anyway.

drdunce
This is very interesting. I have a PhD in Machine Learning but cannot get work. It seems like like everyone has one! I'm thinking of switching to security and kind of assumed it would be the same, especially seeing the ostensibly high entry requirements. Sounds promising, thank you for the insight
incomingpain
>This is very interesting. I have a PhD in Machine Learning but cannot get work. It seems like like everyone has one! I'm thinking of switching to security and kind of assumed it would be the same, especially seeing the ostensibly high entry requirements. Sounds promising, thank you for the insight

Like this advice isn't security related. It's HR related. They aren't experts like you in X. They were told to hire X and they wrote a job listing hoping to attract the best cost efficiency candidate there is. They want as many options as possible. Always apply to all. In fact, high entry requirements can work to your benefit. Everyone else sees ridiculous requirements and doesn't apply. Leave you the only candidate and you're hired.

A PHD in machine learning is all the certification you ever need. You should be employable in that field. Apply to all the machine learning jobs.

Also question, what did you do your thesis/dissertation in? Could you just entrepreneur that right now?