nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Career questions

babble

Hello,

I have been a DoD civillian for the past 5 years, I started off as a Fortan/C developer on a weapon system for 2.5 years, and for the past 2.5 years, I have been a system admin / IA guy for this system that we are trying to get our installation to use.

System Admin stuff is fairly straight forward.

The IA work, was basically working with "approving authorities" to conduct C&A validation testing, documenting results, remediate and mitigate vulnerabilitie to attain Authority to Operate (ATO) for the system on the installation network.

I just got Security+ because the only person in the group who had it left.
__

Now, I am really liking Infosec stuff, it's interesting and seems to be in demand. Should I start studying for the CISSP? I know there is a 5 year requirement (4 years, if you have Security+)?

I also have a Master's degree in Computer Engineering.

Eventually, I would like to be a CISO in a federal agency.

I guess my question would be - what's the general career path for a CISO? Should I get more experience? Or should I get more certificates?

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

networker050184

babble wrote: »

Should I get more experience? Or should I get more certificates?

Definitely get both.

paul78

The certs may be useful but generally not required. As for experience, it does need to be relevant. Are you already in IT management? Your first step would be to get into a leadership role of some sort. I can't speak for what a CISO does in public sector but in private sector, the role also requires strong business management acumen.