James,
@crossmage wrote:
In the 90's I used lots of certs after my name on cards and e-mail signatures, to try to prove my worth (as much to myself as to my customers).
You raised an interesting point about ego. I have an example of that in play when I first started advertising my qualifications in email and business cards, and another about when I stopped.
Eating my Alphabet Soup
There was definitely a time in my career when I walked around flaunting my qualifications. I found that before I either had the qualification or used it, I would often have to defend my designs and estimates articulately to my boss and my clients. I believed at the time (in the late 90’s early 00’s) that if I beat people about the head with my alphabet soup of qualifications that they would stop making me do all the extra work defending my position. That was before I was mature enough to realize that relationships were more important than lapel pins.
What I actually found was that I had to defend my position even more than before. Once I earned a more advanced certification, I found myself now being challenged by my own peers on my designs and estimates; even bringing competing designs and estimates to my boss. We would have laborious conversations in front of a dry erase board about the detailed steps and settings and their net effect. I had no problems sharing my knowledge and experience and taking criticism on my design, but somehow it always seemed to be under the pretext of proving that the certification was a sham or I that didn’t deserve it.
I never recovered while I was in that position. When I moved on to the next position, I only used the CISSP-ISSEP and eventually dropped even that from my signature line. Instead I went back to citing and sourcing all of my designs and estimates in the proposals and all was good with the world.
Alphabet Soup with Crackers
What happened at this next position as the CISSP (and other qualifications) became more prevalent solidified my view that relying upon certifications in professional communication is problematic. At this next position, I worked as a systems security engineer. Instead of submitting designs and proposals, I was now reviewing them for completeness and errors. I would forward them on with a “recommend approval” letter or a “recommend denial” letter with a statement of reasons.
Several folks would submit proposals, which overall were very detailed and complete, but had one fatal flaw or just needed a small change in order to meet organizational policy. Although several people made challenges as to credentials, one stands out in my mind as the most appalling. I went back and forth with a systems architect over a proposal, and returned the proposal with comments citing organizational policy and collateral impacts to security. Now, I returned the proposal expecting those issues to be addressed with either mitigative controls or a request to accept the residual risk. Instead, I got a message that said, “There are no residual risks, and I’m right because I’m a CISSP.”
I mean, I’ll admit that I’ve silently thought I’m right because I’m a CISSP in my head, but I would never say it much less rely on it as my evidence of a sound proposal! We went back and forth, and this other CISSP basically argued with Gibberish expecting that as apparently a non-CISSP (because it wasn’t in my signature line), the argument would appear over my head and I would concede. The proposal had 30 days to be corrected before it was outright denied. We went back and forth so long that it finally reached the 30 day mark, and I signed the “recommend denial” letter using my credentials, a copy of which went back to the architect. I never heard from that other CISSP again.
