Hacker News Reader

Comment by grepfru_it | Hacker News Reader

Is this recent? I held every cert under the sun in the 2000s and companies GOBBLED ME UP. In the early 2010s I could walk into companies by simply having a VCP cert. I'm sure if I held a K8s or some hashicorp cert, or AWS or Azure certs I would be pulled into any org hiring today. And I put all of my certs on my resume (that I can fit with most recent first).

I should also clarify, I only put certs that matter (why put an Azure cert on a resume submission to an AWS shop) and certs that are recent (I have 20 years on my resume, why would i put my CCNA on there). I think a large number of irrelevant certs would be a negative signal. I think a large number of relevant certs AND job history to back them up would be a super strong signal.

View on HN

I remember many years ago, Google internally knew that one of the only signals obtainable from CVs was the negative signal from number of certs. I don't think this knowledge was actually used for anything, it was just a correlation, but yeah it's sort of an open secret in the business that the sort of people who get lots of certifications do very badly when asked to demonstrate actual technical skills.

It's a response to large number of people who know very little and want to compensate with memorizing stuff and passing certificates without deeper understanding of what they're doing.

It's kind of a stupid response, especially considering that the same people would most likely view 10+ certs on your CV as a positive if your name is western-sounding...

Idk, i haven't been in the industry long enough to compare. Also, i work in security (in north america and not gov), maybe other areas are more pro-cert.

I also disagree with your first comment. Large amounts of difficult certs have never been a negative signal and I’ve been doing this for like 20 years. Especially in cyber security where a wide breadth of various knowledge is needed, certs can really help show who has the ”full-stack” so to speak.

That being said, 20+ CompTIA cents isn’t going to move the needle for me.

I say all that to say “it depends on the cert”

I think that's fair. I more saw it as the 20+ comptia certs.

Actually cyber security is one area where a lot of certs are a strong negative signal. They basically broadcast course-taking and cert-chasing over real world experience. If you have an OSCP cert I will treat that as a potentially good signal, but if your CV includes CISSP I will walk in to an interview with low expectations and if it has CEH or similar wastes of time the recruiting lead would have known to filter the CV out so that I do not even see it. This if for FAANG environments though, so maybe if you are aiming for a corporate cube farm in a smaller market other certs will be useful. Just not with me.

OSCP vs CISSP is a ridiculous line to draw, they cover very different job types.

I don’t know what jobs you’re hiring for, if any, I simply don’t see how more data is a negative signal.

I think that’s silly.

I disagree with the entirety of your reply, except for the CEH zinger ;)

SANS certs? CCIE? GSE? OSEE?

SANS certs are great

As a Red Team manager with both the OSCP and CISSP, in my opinion neither is worthless but they are oversold and they aren't really comparable.

The CISSP is a risk management cert that's sometimes oversold as an infosec cert. It's been quite useful to me in dealing with the (Fortune 1000 mostly) bureaucracies that take Red Team and pen test findings and turn them into remediations or risk acceptances.

The OSCP is a technical cert that's oversold in a different way: because the test is fairly difficult, lots of people assume it's an advanced cert. It's a beginner cert (and Offensive Security has several more you can take after it). What it does prove is that you probably have the right mindset to be a penetration tester (which is not necessarily the same mindset you need for Red Teaming, i.e., unannounced adversarial simulation).

tl;dr: I don't think any cert is bad as long as everybody understands what it's for. But I'm one of those people who collects them (at employer expense) as a way to structure my learning, and then never renews them.

Reply on news.ycombinator.com