CSSLP, anyone?

tedjames

Been away for awhile, but now I'm back, baby! I'm considering pursuing the CSSLP certification. Looks like there hasn't been much discussion on this topic.

My functional title is Application Security Engineer, and I've spent the last five years working on a software development team testing web applications (white box), teaching developers about security and getting them to write more secure code (uphill battle), implementing SecDevOps principles, SDLC, etc. I'm wondering if, at this point, I really need to pursue this certification. I plan to stay at this job until I retire in 2026. I'll likely continue my career somewhere else at that point unless my current employer makes it worth my while to stay. I'm not looking at job listings and employer requirements regarding this certification. I don't care if CSSLP is not in a lot of job descriptions. I tend to think more about how the knowledge I would gain might benefit my work. I don't really care about having more letters behind my name, either. I'm really just hoping to add to my knowledge so I can be a more rounded appsec person.

All that said, if you have prepared for and taken this exam, do you feel that what you learned has benefited you more than, say, a couple of cheap Udemy, etc., courses might give you? Was it worth your $600 and all the time you spent studying? Thanks!

JDMurray

tedjames said:

I tend to think more about how the knowledge I would gain might benefit my work. I don't really care about having more letters behind my name, either. I'm really just hoping to add to my knowledge so I can be a more rounded appsec person.

I've had this same thought with regards to pivoting my own career towards AppSec. I never found a opportunity to do so in my work experience. Now with AI being added to all the source code checking tools I'm wondering is the market for AppSec humans will be narrowing over the next few years.