Most of the top tier people that I know in cyber security are not certified professionals, but rather people that have deep knowledge in their area of expertise with the ability to apply security knowledge to it.
The list of certifications is bad because:
- it only focuses on offensive security work, which is a small part of the actual field (there is the entire blue side as an example)
- it focuses heavily on the software side of the house which is once again not the entire field (more than a few places have been popped due to infrastructure misconfigurations and issues)
- it ignores many common enterprise environments that use things like Active Directory, Otka, EUA, SSO, etc. These are things that you will encounter and must know how to work with or secure if you are a generalist in the field (if you're specialized you may never touch these things at all).
In short, this is good if you want to be a consultant doing generic penetration testing but not much more than that. They may also serve as HR checkboxes for recruiters that do not understand the job requirements.