[reduxredacted]

I thought about this one for a little bit and threw it into the bucket of "well, most certifications are worthless", but I don't think I fully believed that.

Our security team consists of individuals that I would consider great and folks that do some of the leg work required of a security department at a large company. We have folks who audit and provision access, a job that would require knowing the basics of RBAC most of the time.

I think the point this article is making isn't entirely correct. I've yet to find a test that magically ensures that someone is competent, be it a large number of tests required to pass a degree program or a single test required to pass a certification. It is part of a broader picture. A resume with zero experience/visible work that includes a degree in CS is going in the bin unless it's a person targeting an intern position. A resume with zero degree, a few years of experience and solid examples of their work is going to get attention (and depending on the work, it won't matter if you have traditional corporate experience).

In InfoSec it's possible to get the equivalent. Companies who care enough to fix the problems in their software grant credit that can be cited in a resume/CV. Some will pay bug bounties if you find a vulnerability and follow their disclosure requests.

[gapanalysis]

I'm not sure that the article really tries to say that a certification is a magical elixir. I think he's saying that they are sold as being magical. I also think he's intentionally calling attention to qualities and criteria that are not easily measured. But that's my read.