Guys,
Just want to post an update and offer my opinion for those considering taking the CISSP...
I took and passed the CISSP in March of this year (2013). At the time I wore several hats in a Network Engineering team at a Fortune 500 company, but the work I was doing was diminishing since what I was responsible for wasn't the core competency of our group. I had been at the company for 13 years. I started out in the Windows Server Admin team, migrated to a team that was focused on deploying Internet facing services in the DMZ (firewalls, hardening bastion systems, IIS administration, load-balancers, forward and reverse proxy servers, email gateways, two-factor authentication, etc.), and this group was eventually grafted into the Network Engineering team where I continued performing those duties. I never became a hardcore Cisco guy (can get my way around switches and routers, but not at engineer level), I leaned more toward the security side in our group, but our company was deciding to outsource more and more of the security work. I enjoyed the security work that I had done over the years and decided to shore up my credentials with the CISSP and a couple of vendor specific certs. (i.e. Palo Alto Networks firewall). My plan was to get into a job dedicated to security.
After passing the exam and posting my updated resume on the job boards, the calls started. I had to weed through the jobs where they wanted me to go to Timbuktu for 3 weeks, the insurance agent job in disguise, and the viable Security Engineer positions. My plan was that I'd keep myself on the boards for a year with the possibility of trying out a few positions to find the right one, which I'd want that one to be a permanent position (not contract). I took a long term contract position in early June at a major auto supplier in their IT Security Engineering team....Fast forward and I'm in my second position (contract to hire) and I was just offered a permanent position at one of the largest companies in the world - this might be that position I thought it'd take a year to find
I see people rip on the CISSP on the boards, but I'll say it has been a great addition to my toolbox in my quest to refine my career. Whereas it wasn't the most technical test in any specific area, it helped me to see the big picture. That isn't to say it wasn't a difficult test - it covered alot of ground! Studying the 10 domains as they defined them allowed me to make many mental connections between the disparate parts of the IT security discipline. I can now speak confidently about overall strategy (thanks CISSP), and then pull from my experience for the tactical and more technical portions. These last two jobs have been great, and the CISSP absolutely helped me get a serious look and the interviews.
I'd say, if you have the requisite experience but are maybe having difficulty making a total transition to Security, or you need to fill in some blanks in the logical big picture, then go for it. It really helped shore up my career. I'm really happy I did it!
