Being a manager of an InfoSec team I agree with this, especially the CISSP and CEH.

I've seen a few folks get a CEH and then they're off to App testing land, but the funning thing is, none of them has ever written an app, some not even a script, and they are now doing security testing on mobile apps. Basically they just push a button on an app scanner and pull a report, it's sad.

The folks that do succeed in security are the ones with curiosity, experience and drive to learn.