Hi Forensic Focus'ers,
I currently have a SANS GIAC forensic certification, and I am now considering studying for the EnCE EnCase certofocatopm. The exam is only $200, but I am not sure if it's worthwhile to me since I already have the SANS GIAC forensic certification and I am already making quite a bit over $100,000 in my current security job here in the United States. I am not planning to do a ton of hands-on forensics in the future (I currently do), but would want to manage a team of forensic specialists.
Being a foreign national, I will not be applying for for government forensic positions here in the USA now or in the future, but instead I would countinue to stay in the private sector, if that makes any difference. I know the EnCE is valued with the government and government contractors (neither of which I would be applying to), but I am not sure about the private sector.
What do you guys and gals think, will an EnCE bring much value to someone already forensic certified from SANS GIAC?
Well, we are kind of limited on our survey response options.
…will an EnCE bring much value to someone already forensic certified from SANS GIAC?
First off, I agree that the poll really doesn't provide many response options.
Second, I do think that the EnCE will provide you some value, regardless of any additional certifications that you hold. In my experience over the years, many hiring managers seem to have a requirement (however artificial) for the EnCE cert, which means that in order to get your resume viewed by someone in HR and forwarded to the hiring manager, you need to have the EnCE.
Remember, the reality is that regardless of what you can actually do, it's about how you look on paper when it comes to getting an interview, and a job.
The still-broken polling system strikes again! But yes, the EnCE is a definite plus, IMHO.
I guess it depends on what you plan on doing. If you are in a 100k job that you have no intention of leaving, then probably not.
If you want to learn EnCase, you can do so without getting a certification, or spending a lot of money (I recommend Bunting's book).
However, the value of certifications, in my opinion, is that they get your resume read, get you the interview, and get you the job. If you have no plans to move to a new position, then I see no need to shell out the cash.
Of course, if your employer will pay for the certification, definitely go for it.
The still-broken polling system strikes again!
Quite possibly, although I'm starting to quite like it - its negative outlook makes me chuckle lol
I don't think that it's the polling system that's broken…what good is a poll when two of the questions are identical?
Not to go any further off-topic but there is a bug, if you edit a question it tends to repeat the previous selection instead. I will get round to looking at it when I get time - promise!
Having done both the GCFA sometime ago and the EnCE quite recently I would say that the SANS course teaches you how to investigate Network Intrusion events using 'low cost' Linux based tools and carve files as necessary, whereas the EnCE certifies that you know how to 'drive' EnCase with confidence. In my opinion these are two distinct career paths, Network Security v Law Enforcement, so if you don't intent to do traditional LE investigations then I would say that the EnCE is not for you.
My two cents for what they're worth are that if you intend to stay in the private sector then you must market your skills to the range of people present in that sector who could be outsourcing work.
Take for example a solicitor in the UK who may only come into contact with a forensic specialist once or twice a year. If that solicitor has received any form of ediscovery training or has spoken to a colleague about their new forensic case, then EnCase is bound to be mentioned (along with some other tools obviously).
A quick google search by the solicitors' paralegal will show that this is a major tool to our community, it is usually a requirement in job specifications, and there for seen as a valuable asset on a CV.
To reiterate keydet89's comments, in order to get your CV noticed it is better to have it, and in order to secure further work it is highly desirable.