There is one way: cut HR out of any and all technical hiring - Back in 2000 (I've changed jobs since), my staff and I used to do our own resume screening with most unqualified candidates being tossed within thirty seconds or less apiece - anyone who claimed to have supervised 2,000 computers was dead meat. We did spent 5 minutes apiece on some unqualified resumes, but only to heap verbal abuse on the authors. We gave each candidate we chose to interview every chance to hang himself by having him do all the talking, and none of the surviving unqualified candidates missed his chance.

What's this stuff about "the person doing the hiring does not have the time to interview every applicant?" Is that a code word for saying that taking the time and trouble to interview every serious candidate is not worth your trouble, and that you'd rather put your employer and your colleagues at risk?

Another thing: the reason I became a security guy was to differentiate myself from the paper MCSEs and CNEs whose existence devalued my certifications, and turned my original efforts to get these certifications into a joke at my own expense. Any certification that leaves out learning most of the skills needed to succeed on the job has to be questionable, because there is a disjoint between the certification and the real world.

Now that security has a become a hot topic, just about anyone can hang out a shingle and call himself a security expert. Taking it one step further, just about anyone and his brother can offer a security certification. Getting a certification that's worthless takes time, effort and money away from getting certifications such as the SANS that are worthwhile.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/118/16926#16926