Do you know anything about computer security?
Aaaah, forget I asked. It wasn't necessary for the last holder of the position.
I worked in the IT field for 33 years. In the past decade or so certificates have taken the place of an education and experience. Most certificates are based on a short instructional period of cramming for an exam. The person is usually no more qualified in computer security ( or fill in the blank ) 2 weeks after the exam than they were 2 weeks before the class. Managers love it because they can check a box and hire a kid or a foreign worker with no experience and pay next to nothing. The company is happy because technically they are not libel if they followed the NIST procedures and protocols even though few people really understand what they are looking for / doing from the top down.
Most security related degrees and certificates are a joke. The person has learned to run network scans for open ports, write reports every other year to be in compliance with some ridiculous NIST standard written by a person at NIST who has even less practical experience, and they’ve learned to compare software and hardware release/version number list for known bugs.
Few companies have a staff of people who are actively working with and running proactive intrusion protection/detection software manned by human beings.
When someone like John Podesta, at the white house, can have a password of password1 and not have it detected within minutes of trying to set it automatically and not have that password rejected and then be scheduled for a remedial education class almost immediately you know your in deep doo-doo,