Technology

Certifications are there to assure the employer that A) you know something B) you are able to be trained. The reason you use 20-30% is because few jobs on the planet require you to know everything. The certification assures that you are at least well read on whatever 20-30% is thrown your way.

Literally the only thing i really used on a regular basis from Sec+, is extremely basic PKI (private/public keys). I got it to meet 8570 requirements.

I learned far more useful skills on the job.

As a hiring manager, I don’t give a shit about certs. AWS certs, for example, serve primarily as marketing material and free money. Soft skill certs like agile methodology (of which I have several) are equally bullshit in that everything is a pattern not a prescription yet many people miss that and shoot their teams in the foot. There are some security certs I do value, such as CISSP, because they can be required for certain industries and actually do carry some gravitas. Even those, though, aren’t necessarily valuable for the things I actually need my security folks to do.

I’d say the market is maybe 30/70 split with folks like me and ATS or idiot hiring managers thinking your ability to memorize the specific GCP settings no one uses will actually make you understand why prod blew up. I refuse to get any; I actively support my team getting them as long as they know what they’re getting into.