I'm an ISO (Information Security Officer). I am responsible for IT security for a large organization.<p>I don't have a CISSP, although most other ISO's I know do. I've worked in security for about six years. It's a real mixed bag. Some ISO's are just high-level managers, while others are much more hands-on and technical. I do have several SANS GIAC technical certifications, although I don't consider those better or worse than a CISSP. Certs are really just a requirement if you want to work in IT security.<p>Like all certs, the CISSP is not a good measure of practical knowledge. I've met hundreds of people who hold various certs and various degrees. And none of that really matters.<p>What matters is prior computing experience and interest. Have they coded? What languages? Do they have a real interest in general computing. Can they show code they have written? Do they have github accounts (or similar)? Have they been a sys admin or network admin? Do they know OS fundamentals (file systems, user accounts, IPSec, firewalls, logging, shell scripting, etc).<p>If you find someone who has that past computing experience and a keen interest in general computing, and who has a college degree (major doesn't matter) and who holds a CISSP or SANS GIAC certs, then they'll work out great. But you don't want to hire the guy or gal with an MBA and a CISSP who has never administered a system unless you're only looking for a manager and you have security analysts/engineers to do the heavy technical lifting.<p>And I think this is where the problem comes in. These kinds of people (MBAs with no experience) are hired, then when the sys admins and other technical staff meet them they are shocked and amazed at how little they know about general computing and wonder how on earth they're going to "secure" systems when they've never installed an OS or configured iptables/pf or brought up a SPAN interface on a Linux box running snort or sent a PGP encrypted email message. In these cases, you have to have analysts and engineers to do the actual work and the managers can do the policies/documentation/audits.<p>So it's important to be very clear on the technical requirements and expectations (if any) of the security positions. You don't want to find out later that your "security guy" doesn't know what a bit or byte is and has never heard of IPv6 and thinks it has something to do with car engines.<p>Just my experience.