Do you need certifications to get an InfoSec job?

I’ve seen Tweets and heard many discussions about certifications, like CISSP, CEH, OSCP  and so on, in InfoSec. No doubt certifications have value – in many situations hiring managers are quickly going through resumes and certifications are symbolic of at least book-learning, and some degree of dedication to InfoSec. Certifications can be expensive and time consuming so having them clears the bar of at least slightly dedicated.

While certifications are arguably a “good thing” inferring a recognized value understood in the InfoSec community, do people really need them to land jobs? After all, job seekers are existentially in need of employment and not likely to want to spend time and money on certifications if they are not necessary.

We have published previous blogs on certifications in InfoSec. But I was still curious as to whether certifications are required to get a job in InfoSec. So I decided to do a Twitter poll on my personal Twitter account to gather more data to help write this blog.

Is it fair to ask new folks in InfoSec to have to have expensive certifications to be worthy of consideration, given you're a hiring manager? Tagging in @MalwareJake for insights.

— Kate Brew (@securitybrew) October 14, 2019