CBK Domain Experience Example

Maxcz

Hello fellow enthusiasts,

I was wondering if the following career experience would be considered valid in terms of CISSP CBK Experience requirements.
This question may sound a bit obvious but I have been having a hard time finding actual examples of what would be considered "valid" security experience.

- 2 years as a security operation analyst. Basically doing access control and audits. Finding out patterns in the day to day and automating it.
- 6 years as a Microsoft System Engineer for a major company. ( Included everything from Architecture planification to license consumption )
- 2 years as a IT/business analyst in a highly regulated financial firm ( Creation of all automations would require in depth SOX knowledge due to regulations. Process/procedure/standards/baselines/ are all actually existing and in effect in such firms compared to most other establishments. )

I also have Security+ Certification dating from 2009 as well as multiple Microsoft certifications.

Although none of these jobs are directly labeled as security ( besides the first one ), the tasks performed certainly pertained to it.
If you already are CISSP and replying to this thread, please also share what was your experience prior to the cert.

Regards

Webmaster

JDMurray can probably give you some more details, but I wishfully read the requirements once or twice a year to try again to somehow match my experience with the CBKs and there's one line that wakes me up every time:

The five years of experience must be the equivalent ofactual fulltime Information Security work (not just Information Security responsibilities for a five year period); this requirement is cumulative, however, and may have been accrued over a much longer period of time.

With Sec+ and the 2 years security operations analyst you'd still need 2 more years, so you might want to consider the IS2 Associate for CISSP depending on which of the three you mentioned is your current role or whether you are trying to get an infosec position.