@Jack_Burton wrote:
Hello ICS2
I am a 40 year old Talent Acquisition professional (recruiter) for a top 10 US Bank (household name) looking to make a career change and enter into the world of Cybersecurity. I have a BA in Psychology and no technical training whatsoever. The majority of my career has been cororate and agency technology recruiting.
I was advised by a Security Executive in my company to study for and take the CISSP exam as he said this would be the most appealing cert to Info Sec hiring managers. ... Having heard all of this, do you agree with my Security Executive's opinion that I should go straight for the CISSP or would you recommend starting with smaller or easier certifications? ...
Jack,
Your "Security Executive" is an ID10T and has given you TERRRIBLE advice. The CISSP is not an entry level certification, and is worthless to seek as an entry point into the cybersec/infosec field. If you were to follow his advice the best you could do is accomplish the test by rote and luck, then spend three six years as an Associate of (ISC)2 and then not be eligible to be certified, unless you got a solid security position within a year of passing the exam. [Edited 5/4 to correct the timeline as not d by Alec @AlecTrevelyan below.] You would lose your Associate status at the end of your allowed experience period, and have to start over with a new exam.
Since that "executive" is still above you in the company, remain polite with that person, but ignore any "helpful career advice" coming from that source.
That said, there is value in obtaining the Official (ISC)² CISSP CBK Reference, Fifth Edition and reviewing to learn the breadth of job types that make up then infosec world. Do not study it as for the exam, read it to learn how and why there are eight domains, and the sort of work that constitutes information security.
Next, go look at the NIST NICE program and in particular their cybersecurity workforce framework for a breakdown of tasks and work in the security field. By combining what you learn from the NICE framework and the (ISC) CBK domains, you will be able to determine with area your interests and talents may be best seated. Then plan your development course of action to learn more about those ares, while also picking up side knowledge in the other fields.
Next, go for advice with people who will know what they are talking about. (I repeat, your "security executive does not.) If there are active chapters of ISSA or (ISC)2 in your area, join them. Talk to the hands-on security practitioners in your company, since you said they are willing to help you transition. There are many legitimate infosec tasks and jobs that are not hard-line tech, but you do need to understand some aspects of technology to practice in any sub field.
If you wish to build on your psychology education, look at areas in human factors, and threat analysis. There is a crying need for social scientists in cybersec/nfosec to deal with the people part of our work that many techies ignore.
For formal training and education to enter the field, as well as credentialing that will make sense for your situation, (the CISSP does not). consider one of the many master's degree programs available online that are designed specifically for holders of undergrad degrees wishing to transition into the field. For meaningful certifications as formal credentials, CompTIA has a few that are relevant for basic tech into, particularly the A+, Network+, and Security +. Even if you work in a non-tech area of cybersec, the basic knowledge of those certifications will benefit you.
Should you be successful in entering the cybersec field, some years down the road the CISSP will become meaningful and appropriate. Should you get the basics of tech and wish to practice in the tech arena, then target the SSCP from (ISC)2 as a goal, after at least the tech knowledge from an appropriate MS or MA degree, or the A+ and Network+ certs.
Please stay active here in this forum with both questions and reports on your progress.
Good luck,
Craig
