I Stopped Hiring for Certifications. Here’s What I Look For.

I used to filter security résumés by certifications. CISSP, sure. A wall of acronyms after the name, even better — it felt like a shortcut, a way to sort a stack of unknowns into “serious” and “not.” It took a few expensive hires to realize I was optimizing for the wrong thing. Some of the best security people I’ve ever worked with had thin certification lists, and some of the worst had every letter you could collect. Once you’ve seen that pattern a couple of times, you can’t unsee it, and you start wondering what the acronyms were ever really telling you.

What a cert actually tells you

A certification tells me you can pass a test. That’s not nothing — it shows discipline, some baseline knowledge, and the willingness to grind through material that isn’t always fun. I’m genuinely not anti-certification; I hold several, and they opened doors early in my career. But a cert says very little about whether you can walk into a messy, political, half-broken environment, figure out what actually matters, and get people who don’t report to you to change how they work. And that second thing — not the knowledge, the judgment — is the entire job. The test has a right answer printed in a book. The job never does.

What I look for instead

Curiosity, mostly. I’ll take someone who lights up explaining how they took something apart over someone who memorized a framework. The person who got nerdy about how a protocol actually works, who broke something at home just to understand it, who can’t leave a system alone until they get how it fits together — that person will keep learning long after the certification’s material is obsolete, and in this field the material is always about to be obsolete. Curiosity is the thing that keeps someone sharp over a decade. A cert is a snapshot; curiosity is the engine.

“Tell me about a time you were wrong”

It’s my favorite interview question, and the answer tells me almost everything. I’m listening for whether they can actually do it — name a real belief they held, describe the evidence that changed their mind, and own the update without spin. The people I trust most are the ones who revise their thinking when the facts move, because the field moves too fast for anything else. Yesterday’s best practice is today’s incident. Someone who can’t say “I was wrong about that” in an interview is going to defend a bad call in production, and a security team full of people who can’t admit error is a security team that learns nothing from its own near-misses.

The soft skill that isn’t soft

I look hard for people who can talk to humans, because a brilliant control nobody will follow is worthless. So much of security is persuasion — getting an engineer to change how they build, getting an executive to fund something boring, getting a whole organization to give up a convenience. The technically strongest person on the team can be a net negative if they can’t explain why something matters without condescending, or if they turn every disagreement into a fight. Communication isn’t a nice-to-have bolted onto the “real” security skills. In a leadership-track security role, it is the real skill, and the technical depth is what earns you the right to use it.

You can teach tools. You can’t teach caring.

Here’s the thing I keep coming back to: almost everything on a job description is teachable. A specific tool, a cloud platform, a framework, a compliance regime — a curious, capable person picks those up in months. What I cannot teach is whether someone genuinely cares about getting it right when no one’s watching, whether they’ll dig into the uncomfortable finding instead of closing the ticket, whether they feel the weight of what’s on the other side of their decisions. That’s either there or it isn’t, and it’s the single best predictor I’ve found of who turns into someone I’d trust with the crown jewels.

So hire for judgment and curiosity. Use certifications as one weak signal among many — a hint about discipline, not a verdict on ability — and spend your real attention on how someone thinks, whether they can change their mind, and whether they can bring people along. You can teach the tools. You can’t teach someone to care, and caring is what actually keeps the organization safe.