Certs for a CIO/CISO

So one day I would like to be CIO or CISO of a Fortune 500 company. I realize that experience is going to be the most important factor in getting such a position, however, if you had the following qualifications, which Certs, if any, would you recommend attaining in order to speed up the promotion process?
BA in Management
Law Degree
MS in Security
CISSP
CIPP

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

paul78

@MickQ - Apprenticing does occur - perhaps as less formal mentorship programs in IT. It's definately one aspect which can help build the next generation of senior IT leaders in any organization. My observation has been that if one seeks the career path to senior leadership roles, it's really up to the individual with that aspiration to find that way.

Getting degrees and certs adds knowledge and skillset, but there are other ways to do it. @UnixGuy and @Powerfool - I don't disagree that formal education with the degree/cert opens the door, but it's really about work-ethic and fostering the relationships which may provide for a better ROI.

@UnixGuy - One thing that I hadn't seen mentioned regarding your earlier question about stories about getting to these senior CIO/CISO type roles - is that the person that wants to move-up typically needs to be willing to relocate as opportunities present - I was going through my head of folks I know and pretty much all of them have relocated at least once or more times - and it's usually to go with someone else who brought them in - maintaining those relationship are really key. People like to work with people that they already know, especially if those people helped to make them successful and they want to share in the success.

@N2IT - management at higher-levels isn't really that much different. The concepts are the same. The stakes may be higher.

erpadmin

Based on reading the last few posts (which by the way, have many great points), here is my take:

1) Experience certainly trumps education, in this regard. My CIO had only a BS in CS, yet was able to pick up on MBA topics throughout the years. Something has simple as SWOT analyses was learned on the job for this CIO. At one point, I was asked if I knew what one was. This was early in the morning and I had Strengths and Weaknesses on lock but had Opportunities and Threats on the tip of my tounge but the CIO was convinced I knew it with how quickly I answered. (I wasn't exactly ready for a pop quiz...lmao.) But my point is that many of these topics one learns in a MBA program is learned on the job (story of my life....) HOWEVER...here's point number 2....

2) Without that "piece of paper, [MBA degree]" it is difficult to be given a shot to learn those topics on the job. Many MBA degree holders are given such shots for the simple fact that they hold an MBA. Others without an MBA are given that shot because of a whole bunch of other things (who they know, how long they've been there, a handle on organizational culture, blah blah blah.) But I truly believe, right or wrong, that an MBA, leveraged with experience, can propel an individual to a leadership position. The current reality really is due to the dot-com bubble of the nineties. We (IT professionals) used to be seen as gods-among-men; technology was king and business just ran with that. After that, that was no longer the case and business now wants to make sure those days never comes back again. The biggest lessons learned I took away from the era, and this was without so much as a cert, much less a degree, was that during that time, the simple business fundamentals were ignored; the textbook stuff. That's why, for me, it was more important that I pick up that knowledge in a graduate environment and have that codified with the piece of paper, with the addition of valid IT experience. That's why I still incorporate my prior IT experience on a resume that doesn't involve ERP work, to tell prospective employers that I was around during the mistakes IT, as a whole, made and I want to ensure that those mistakes are not repeated, but with the understanding that IT should have a seat at the table (but not necessarily at the head...unless it is purely an IT organization.)

erpadmin

paul78 wrote: »

[edit] The Portable MBA series seemed to have gotten a lot more complicated as a series since I last looked - I was referring to this one - Amazon.com: The Portable MBA in Finance and Accounting (9780470481301): Theodore Grossman, John Leslie Livingstone: Books

During a B&N run, I looked at this book while looking for an Accounting book:

Amazon.com: The Mobile MBA: 112 Skills to Take You Further, Faster (9780133066333): Jo Owen: Books

From what I saw, it covered a bunch of MBA topics in a concise, easy-to-read, manner.

paul78

@erpadmin - you raised an interesting point about the dot-com era. Many in IT that were propelled into leadership positions during that era really had the benefits which may be different today - either you built the business and made it success or you failed but learned some real-life lessons. Either way - it was a tremendously fast-paced time where the leaders of today could rise without the need for formal degrees and certs.

Having the MBA degree today can certainly get the foot-in. But I really do think that after a certain level in someone's career, it's really about what successes and accomplishments the individual can point to.

erpadmin

paul78 wrote: »

Having the MBA degree today can certainly get the foot-in. But I really do think that after a certain level in someone's career, it's really about what successes and accomplishments the individual can point to.

I wish that were true...I really really do. When I see leadership postings with either a BS in whatever and x amount of experience in managing, and preferred qualifications are a Masters degree in something (e.g. MBA) I'm inclined to believe that your statement (while ideal) is not enough...especially if one is trying to get in with no hook (connections.)

I don't necessarily disagree with you; it's really more of a "I don't see it" or "I'm not seein' it" kind of deal.

Also, the dot-com era has been brought up by me here on more than one occasion. I'm very proud that I survived that era and was not seduced by the ridiculous six-figure salaries that were the norm of that era. I'm all about risks, but even my risks are calculated ones.

paul78

erpadmin wrote: »

I wish that were true...I really really do.

If its encouraging for you to know, I don't have an MBA or degree and I'm in a senior leadership role. It is possible, just not the norm.

I found some stories which you and @UnixGuy may find interesting.
http://www.kelloggforum.org/succeeding-without-a-traditional-business-degree/
Executive Life; A Driven Bunch Says No Degree, No Problem - New York Times
Success without a college degree - CNN.com

One of the articles raises an interesting ethics question - and not a path that I would ever advocate.

N2IT

@Paul

Thanks for the heads up. I never managed at that level so I wouldn't know. I can see that being the case, I am one who assumes things are much more complicated and difficult than they usually are. It's just the way I am wired I suppose.

jdubb45

ASIS - Certified Protection Professional (CPP)
IAPP - Certified Information Privacy Professional - Information technology (CIPP)
SANS - GIAC - Security Leadership certification
ITIL
ITSM

Also:
https://www.cool.navy.mil/ia_documents/ia_iam_flow.htm

Seeing how the government is trying to toss a ton of laws concerning the access and flow of information (BAN ON ANONYMOUS POSTINGS, PIPA/SOPA/COICA/NDAA..etc) it only makes sense to stay ahead of the game and be prepared. Contracts (Northrup Grumman, Lockheed martin..etc) are going to open up all over! I want to be on the side holding the bigger stick. -- Tony Stark (iron man)

My $.02

powerfool

A recruiter contacted me last week about where I wanted my career to go and the best analogy I could come up with is chess. You have to know where you are and where you want to be to determine the moves in between. For me, getting the PMP is one of those chess moves. I think that there are several certifications that fit that criteria... they aren't necessary for the end move, but they are nearly (if not) necessary for some of the in between moves.