Being in a position to hire people here is what I saw in recruiting efforts.
1) People applying for jobs for which they totally lacked the required experience. Just because you have the CISSP certification DOES NOT mean that you are ready to configure firewalls, IF you have zero hands on experience doing so. It means that you would be able to help guide me in the selection of, define the purpose of, and help guide the use and placement of firewalls, but not necessarily be able to configure a rule set for one.
2) People applying for jobs that were a stretch for them based on their experience. If we said 5 years of experience, they applied with one or two years of experience. I know some candidates that were very eager learners who MIGHT could have performed OK (and it showed in their resumes) but most people who lack the amount of experience would struggle until they had learned through experience.
3) People that were overqualified for the experience. People have reasons for applying for positions that are downgrades from previous positions, but most employers would question the why and if the why was not a strong enough argument, the employer would wonder about the stability of the applicant and worried about them leaving once a better job opportunity presented itself.
Why did you get the CISSP? Did you think it would magically make you qualified for more jobs? A lot of people do, but understand that is not the purpose of the certification. It can help open job doors and I once got a position because I held the CISSP while the desired candidate did not (and didn't want to earn it).; however it is not a magical thing that once you get it people come running at you like paparazzi. Obtaining the CISSP shows that you have an amount of knowledge desired in the field of information security and have been successfully evaluated by a third-party as having obtained that knowledge.
If you only have experience in 2 of the domains, what are you doing to gain experience in the other domains? You need to work on obtaining that other domain experience if you want to expand your job opportunities. EVEN if you have to do it for free. Ask around. I often find plenty of INFOSEC jobs going undone because no one wants to step up and take on the additional tasks because they aren't getting paid OR they have too great of a fear of failure.
What does your home lab look like? I once got a job where I lacked the "official" full-time paid job experience, but had taken the time to set up a lab in my home with 3 servers, multiple computers (13 in all) and switching and routing. They pointed out my lack of paid experience and I told them that I had been obtaining the experience in my home lab and showed them a picture. They said "If you took the time to set that up and learn that on your own, I think you will be a good asset to our team." What else have you done since you passed the CISSP? If you are job hunting seriously, you need to be in continual self-improvement mode. Reading books, listening to podcasts, taking courses, etc. Show your potential employers that you love to learn, this will help overcome the lack of experience and show that you aren't afraid to learn new things.
What are you doing to improve your current position? I would take an applicant who only has a few years experience but is making big positive changes or actions to improve his/her current place of employment over someone who just came in, did what they were told, and then went home for 20 years. What you do at your current job speaks volumes about what you will do when I hire you. Look for opportunities to shine in your current job. I asked many applicants "What makes you different than the other applicants I am interviewing?" I want to hear how they are improving where they are (and hopefully they have improved their jobs at every employer they have been at and have a track record of doing so). I don't want to hear they are leaving because the job is boring or they aren't getting the opportunities they "deserve".
If places want specific experience with IDS/IPS, can you gain that at your current employer? Have you asked about job rotation, mentoring programs, job shadowing, cross-training opportunities, etc? If you can't get it where you work, can you find a way to do it at home? Or take a course at a school for it?
One of the things I did when climbing the job ladder was to look at job postings for jobs I would want someday but were not qualified for yet. I saw what the requirements were and sought out those opportunities to gain experience, again whether I was paid to do it or not. I wanted the experience now to get the pay later so I did a lot of stuff for free, volunteered, etc. and I became the go-to person for each of my bosses. My former bosses always spoke highly of me. Believe me, when I call an applicant's reference and they say "Yeah, they worked here." and that is all I get from them, I understand the hidden, unspoken meaning which is "They weren't the greatest employee. You don't want to hire them." If they were or are a great employee, I usually can't get the boss to shut up about them, and that tells me volumes about the applicant. So become very good at what you do, where you are, so that you become very desirable to the place you want to be. Look at jobs you want in the future in order to prepare yourself for them, then once you have gained the experience, apply for them. Keep looking down your career road and you can make it to the CISO's chair, if that is where you want to be.
