What next?

PeterHands

I have CEH and CISSP.... Im looking to be more achitecture now but I'm feeling I should do CISM as a) its very sought after and b) I should keep the balance between tech and risk governance.

Also I've looked into the CISSP concentrations, but there isn't the info out there comparable with the main CISSP and they don't seem well thought off.

Any thoughts?

dinger68

TOGAF is a good one for architecture.  If not that one then one of the other main architecture frameworks.

mikey88

I've never seen any job postings that ask for CISSP and CISM. But if you have the budget for it and your career goals are aligned with the path, then why not. 

X5c0r

mikey88 said:

I've never seen any job postings that ask for CISSP and CISM. But if you have the budget for it and your career goals are aligned with the path, then why not. 

This.  Generally if you check one high level tech cert you'll get your foot in the door.  The more you learn about how the industry reacts to certs on a day to day level the better you can plan your attack.

laurieH

I guess the question to ask yourself is do you need to do a certification in order to know more about architecture? In my experience the certifications are either a good way to get through the HR sift or may be a requirement from a risk point of view. Otherwise why not just learn what you need to know without doing a certification?

isc2cisspbouncr

dinger68 said:

TOGAF is a good one for architecture.  If not that one then one of the other main architecture frameworks.

Agree that TOGAF and the likes of SABSA are a good idea but note that TOGAF is concerned about Enterprise Architecture nor Enterprise IT Architecture not Enterprise IT Security Architecture.  Enterprise IT Architecture and Enterprise IT Security Architecture are "subordinate" to Enterprise Architecture. 

isc2cisspbouncr

laurieH said:

I guess the question to ask yourself is do you need to do a certification in order to know more about architecture? In my experience the certifications are either a good way to get through the HR sift or may be a requirement from a risk point of view. Otherwise why not just learn what you need to know without doing a certification?

CISM does not cover much about architecture.  It's more about management.