Should I take the CISSP Exam?

baraynavab

Ok first of all my background.

I have a Bsc in Electrical Engineering. and have a good job that i enjoy a lot in the Wireless Telecom industry(Can you hear me now) doing Data System performance. The thing i realized in this company is there is not a lot of room for advancement to become a manager etc.etc... Althought the money is decent I know with my background i can do some kind of consulting and get better money.

So what got me thinking of CISSP is that my brother got a consulting gig at $70/hr doing SOX stuff. If he got that much then i thought I surly can do some other kind of certification and go into consulting. Frankly it for the money for me. especially if i dont see any advancement.

My background is in Wireless Networks, Networking(i did get myself a CCNA in 2000) that helped me a lot in this job. Cause it does require me to log in and configure Cisco routers and switches. So this type of experience and a 4 year degree will enable me to take the CISSP exam. And i do have lots of experience in fixing, building, deploying small IT networks. Not a lot of experience with sniffers and sniffing protcols.

So now in my early 30's i am thinking of changing my field to IT security and I believe CISSP is a good way to start. All the experience I have is in the above fields. Not a lot in Security. But by looking at the exam i know some of the Domains are not to hard and others are(cause i didnt come in contact with them).

With the above history of mine do you CISSP experts even think its worth my time to try to study and get this exam?. I know i can get the certification after about 3-4months of studying.

Also i would like to know what kind of pay scale do decent CISSP people make? frankly speaking I make about $30/hour.

Please advise me. Thanks a lot

keatron

baraynavab wrote:

Ok first of all my background.

I have a Bsc in Electrical Engineering. and have a good job that i enjoy a lot in the Wireless Telecom industry(Can you hear me now) doing Data System performance. The thing i realized in this company is there is not a lot of room for advancement to become a manager etc.etc... Althought the money is decent I know with my background i can do some kind of consulting and get better money.

Make sure the money is not the only reason. You can't be great in IT Security unless you truly enjoy it. Things change almost daily (latest exploits and vulnearbilites, etc), so you have to be able to commit to constant reading and knowledge enhancements. I hear people complain about reading 2 to 4 hours per day preparing for exams; I read that much almost every day even when I'm not preparing for exams. If you don't think you'll enjoy reading, it will be tough. Unless you get a job that only requires you to know one very specific area (like a firewall specialist), and even then you'll have to read some.

baraynavab wrote:

So what got me thinking of CISSP is that my brother got a consulting gig at $70/hr doing SOX stuff. If he got that much then i thought I surly can do some other kind of certification and go into consulting. Frankly it for the money for me. especially if i dont see any advancement.

You have to be careful here as well. A lot of times people land these jobs out of necessity or pure luck. For example, being in the right place at the right time. I can tell you for a fact, I've done no less than 10 Sox Audits (as a subcontractor of one of the Big Three accounting firms), and it's the most boring thing I've ever done in IT Security (except maybe watching packets all day). So again, $70 an hour might sound good, but will you enjoy it enough to stick with it. Ask your brother what his job is like every day and try to figure out if you can see yourself enjoying it. I'm certainly not saying it wont be enjoyable for you, because different people enjoy different things. I'm simply saying find out what the job entails. I'll be happy to post what a typical month is for me.

baraynavab wrote:

My background is in Wireless Networks, Networking(i did get myself a CCNA in 2000) that helped me a lot in this job. Cause it does require me to log in and configure Cisco routers and switches. So this type of experience and a 4 year degree will enable me to take the CISSP exam. And i do have lots of experience in fixing, building, deploying small IT networks. Not a lot of experience with sniffers and sniffing protcols.

People mean different industries often times when they say wireless networking. Some people are referring to celluar carriers, and others are referring to WLANs. Which are you referring too (I can only assume cellular based on the can you hear me know bit). Wireless LANs (specifically 802.11 based) has become a field of it's own. I've seen several people leap in to 802.11 world out of Celluar land and end up running for the hills. Again not saying it will happen to you, just research and make sure you feel you can maintain interest. Concerning meeting the requirements to sit the CISSP, you will never know 100% if you qualify until you apply and your application is evaluated. Keep in mind, qualifying to sit the exam, and actually qualifying to be awarded the certification are not one in the same. However, on the surface it certainly sounds like you meet the requirements.

baraynavab wrote:

So now in my early 30's i am thinking of changing my field to IT security and I believe CISSP is a good way to start. All the experience I have is in the above fields. Not a lot in Security. But by looking at the exam i know some of the Domains are not to hard and others are(cause i didnt come in contact with them).

It's certainly not too late to change careers. If you have a true passion for it, the sky is the limit as to where you can go. I have never recommended anyone "start" a career in IT security by going straight for the CISSP. It's expensive, and requires serious study time. Start with something simpler and not as broad. Security+ or a vendor specific equal. Though some of the domains SEEM to be not hard, you might be very shocked when you actually see the real test questions. They are very complex, and often scenario based. After a few hours your brain starts to drain and last thing you want is scenario questions at the point. And guess what you'll get? More scenario questions!!!!! I've posted some simple versions of CISSP-like questions in this forum in the past. Look at some of those and you'll basically get and idea. Remember mine are simplified versions.

baraynavab wrote:

With the above history of mine do you CISSP experts even think its worth my time to try to study and get this exam?. I know i can get the certification after about 3-4months of studying.

Really? How do you KNOW this? As I've already stated, just because you pass the exam doesn't mean you'll get the certification. I have over 11 years experience in IT security and training, and that's direct IT security and I didn't risk only preparing for 3 to 4 months. Again, you might be better starting with something simpler and working up to CISSP, while getting some hands on in the process. I recently won a pentesting contract over a person with a PHD, but his experience was not even close to mine. So a CISSP's value is increased exponentially with the right experience behind it.

baraynavab wrote:

Also i would like to know what kind of pay scale do decent CISSP people make? frankly speaking I make about $30/hour.

Please advise me. Thanks a lot

Most CISSP's I personally know make anywhere from 45 to 85 an hour, if working on an IT staff, and from 55 to 125 working on a consulting team or for a consulting company. I bill at much higher rates than that, and own 80% of the company. Which means my actual income reflects well over what you'd expect as just an employee. But just pure salary wise I pay myself about 200,000/year, which based on my experience, and qualifications, I'm right in line with the top 10 percent of the industry. And I pay my employees just as well (almost half my guys make more than I do in salary). But again, if you go grab a CISSP without any relevent experience (which will be difficult enough), you'll find it tough to land a top paying job. You certainly shouldn't have much of a problem actually getting a job, but a really good one will reserved for people with significant experience. For example, a CISSP implementing firewalls all day (not designing rules, just implementing someone else's designs) would be better suited to be going after that specific vendor's firewall certifications (remember it's usually best to try to certify in what you work with everyday FIRST).

All in all I think you have a good shot at making a successful career out of it all, just be careful, research plenty before making the jump, and ask many questions.

Keatron.