After recently seeing yet another job ad for a penetration tester that demanded a CISSP certification, I would like to say a few words about it. The short version: the CISSP has nothing to do with penetration testing or ethical hacking. Absolutely nothing.
In contrast to the CISM (Certified Information Security Manager), the CISSP (Certified Information Systems Security Professional) is more technically oriented. That much is correct. Nevertheless, the CISSP targets security specialists who are indeed somewhat more technically oriented than purely classic managers, but whose primary focus is precisely not pentesting. Not at all. Sure, there are pentesters who can point to a CISSP certification. But one should rather demand pentester certifications such as OSCP, OSCE or CEH in job ads and calls for tender.